Jelly Tap Match Privacy Policy

In short

• No account. You play Jelly Tap Match without signing up. Your progress stays on your device and is not sent to us.
• Ads only when you choose. The game shows rewarded video ads from Google AdMob only when you decide to watch one for a reward. To show and protect these ads, Google's software processes your device's advertising identifier, IP address and similar data. Ads are personalised only where the rules below allow it, and never for players under 18.
• Purchases through the store. Coins, packs and the Jelly Club subscription are sold through Google Play or the App Store. We never see your payment details.
• Your age, on your device. The game asks your age once to switch on protections for younger players. Your answer stays on your device.
• No tracking of our own. The game has no analytics, crash-reporting or tracking tool of our own and sends nothing to servers we run.
• Online features are off in version 1.0. Before they are switched on, we will update this policy and the game will ask you first.
• You stay in control. You can delete all game data from inside the game (Settings → My Account → Delete game data on this device) and ask us by e-mail to delete anything we hold, without reinstalling the game (Data & account deletion).
• The game is for players aged 13 and over.

Who we are

Jelly Tap Match is made by CS Digital Games, a brand of CS MEDYA TICARET VE YAZILIM ANONIM SIRKETI, a joint-stock company registered in Türkiye ("we", "us"). We decide how and why the personal data described here is processed: we are the "controller" (in Türkiye the "veri sorumlusu", in Brazil the "controlador", in Japan the "business operator handling personal information").

• Address: Bursa 16200, Türkiye
• Privacy contact: support@csmediadigital.com. Every privacy request sent there reaches the person with the highest authority in our company, who is responsible for privacy.

Representatives and data protection officer. We have not appointed a representative in the European Union or the United Kingdom, a legal representative or data protection officer (encarregado) in Brazil, or a data protection officer under any other law. Wherever you live, you can contact us directly, in English or Turkish (other languages are welcome; we may answer with the help of a translation), at the e-mail address above.

This policy covers the Jelly Tap Match app (app ID games.csdigital.jellytapmatch) on Google Play and on the App Store. Our website has its own website privacy policy. Players in Türkiye can also read the KVKK Aydınlatma Metni (Turkish). More details about us: Company information.

What is processed, why, and on what basis

1. Your game, on your device

The game keeps on your device:

• your level progress and stars, coins (paid and free counted separately), powers, lives, looks and outfits, daily rewards and tasks;
• your settings (sound, music, vibration, language, accessibility) and the name you give your jelly;
• the records of your purchases and rewards, so each one is given exactly once;
• your parental-control settings and the daily play-time totals they show (a parental PIN is stored only as a salted, one-way hash, never as the PIN itself);
• your answers on consent and information screens (for example the KVKK consent screen in Türkiye or a pre-purchase confirmation) with the version of the text you saw;
• a check value made from your device's identifier that detects edited save files.

• Where: only on your device. Android backups are switched off for the game, so this data is not copied to cloud backups either. We do not receive it, and we cannot see, change or restore it.
• Why: to run the game you asked for, to remember your choices and to protect the game from cheating.
• Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in a fair game (Art. 6(1)(f)).
• How long: until you delete it in the game, clear the app's storage or uninstall the game (how).

2. Your age and your region

Once, at the latest before the first ad or purchase, the game asks for your month and year of birth with a neutral question (nothing is pre-filled). From this the game works out an age range (under 13, 13–17, or 18 and over; in South Korea under 14 counts as a child). If a later version uses an age signal from Google Play or the App Store instead, it will use the signal only for the protections below and will not store it.

The game also reads your device's region setting to apply the right regional rules (for example the consent screen in Türkiye or the opt-out button in the United States).

• Where: only on your device. The ad service receives only a protection setting ("child", "under the age of consent" or none), never your age or birth date. Google's ad software is not started at all until the age question has been answered.
• Why: to apply protections for younger players: no personalised ads for anyone under 18, the strictest child setting for ads below 13, no purchases below 13, and purchases switched off for 13 to 17 year olds until a parent turns them on.
• Legal basis: our legal obligations to protect minors (Art. 6(1)(c) GDPR, where such rules apply to us) and our legitimate interest in protecting younger players and meeting the age rules of the countries where the game is offered (Art. 6(1)(f)).
• Do you have to answer? No, but without an answer the game cannot show ads or sell anything, because it cannot apply the right protections. You can still play every level.

3. Ads from Google AdMob

The game shows rewarded video ads only: an ad plays only after you tap to watch one for a stated reward. There are no banner ads and no ads that interrupt play. The ads come from Google AdMob, provided by Google Ireland Limited and Google LLC. To prepare, deliver, measure and protect ads, Google's Mobile Ads software and its consent tool (User Messaging Platform) collect from your device:

• your device's IP address, which can show an approximate location;
• device identifiers: on Android the advertising ID and the app set ID; on iPhone and iPad the advertising identifier (IDFA) only if you allow tracking in Apple's App Tracking Transparency prompt, and otherwise identifiers that Apple permits without that permission; where applicable, identifiers linked to accounts signed in on the device;
• ad interactions, such as app launches, taps and video views;
• diagnostic information, such as app launch time, hang rate and energy use;
• your ad privacy choices (for example a consent record).

What happens next depends on the protections that apply to you and on your choices:

On iPhone and iPad, the game shows Apple's App Tracking Transparency prompt before ads that may use the advertising identifier. If you do not allow tracking, the advertising identifier is not available to the game or to Google, and you can still watch every reward video.

• Why: to give you the reward you chose, to pay for the free game, to measure ads and to prevent ad fraud.
• Legal basis: your consent for personalised ads and for reading or storing information on your device where the law requires consent (Art. 6(1)(a) GDPR and Art. 5(3) of the ePrivacy Directive and the national laws implementing it); our legitimate interest in showing ads you chose to watch and in preventing fraud (Art. 6(1)(f)).
• Google's role: Google uses this information also for its own purposes as an independent controller, under the Google Ads Controller-Controller Data Protection Terms, as described in How Google uses information from sites or apps that use its services and the Google Privacy Policy.
• Ad content: the game asks only for ads suitable for a general audience (rating "PG"; "G" for children).
• Do you have to allow it? Watching an ad is always optional. If you refuse all ad processing, you can still play every level; only the extra rewards from videos are not available.

4. Purchases

Coins, packs, unlimited-lives time and the Jelly Club subscription are sold through Google Play Billing on Android and through Apple's App Store (StoreKit) on iPhone and iPad. The store handles payment and keeps your order history under its own privacy policy (Google, Apple); we never receive your card or bank details or your account password. To deliver what you bought, the game receives the store's purchase confirmation (order or transaction number, product, purchase time, a purchase token and the store's signature). The game checks the signature and keeps these records on your device; they are not sent to us. The stores report sales to us for accounting in their developer consoles (for example order number, product, price, country and date), without your name or contact details.

• Legal basis: performance of the purchase contract (Art. 6(1)(b) GDPR) and our legal obligations, for example tax and accounting (Art. 6(1)(c)).

5. Reports from Google Play and Apple

If you allow your device to share usage and diagnostics with Google or with app developers (Apple), the store may provide us with crash reports and aggregated performance and usage figures for the game (for example Android vitals or App Store Connect analytics). We use them only to fix problems and improve stability. They do not identify you to us.

• Legal basis: our legitimate interest in a working game (Art. 6(1)(f) GDPR); your choice in the device settings decides whether these reports are made.

6. When you write to us

If you e-mail us, we receive your e-mail address, your name if you give it, your message and anything you attach (for example your device model). We use this only to answer you and handle your request, including privacy and deletion requests. Our e-mail service is provided by Google (Google Workspace) as our service provider.

• Legal basis: taking the steps you ask for (Art. 6(1)(b) GDPR), our legal obligations when you exercise privacy rights (Art. 6(1)(c)) and our legitimate interest in answering (Art. 6(1)(f)).

Please never send passwords, payment card numbers or copies of identity documents.

7. Device permissions

The game asks for no sensitive permissions: no location, camera, microphone, contacts, photos or files. On Android it uses ordinary permissions for the internet connection, network status, vibration, keeping the screen awake, Google Play Billing and, for Google's ad software, the advertising ID and basic phone state (network type).

Summary table

Who receives personal data

We do not sell personal data for money, and we do not share it with anyone else. We choose only providers that commit, in their terms with us, to protect personal data at least as well as this policy and the store rules require (for Google, the Google Ads Controller-Controller Data Protection Terms and the Google Workspace data processing terms; for Cloudflare, its data processing addendum). If our company is ever merged or sold, the buyer may take over the game and must keep to this policy or tell you about changes in advance.

Transfers to other countries

We are based in Türkiye, and our providers process data in the United States and other countries.

• EEA, UK and Switzerland: transfers rely on the European Commission's adequacy decisions (including the EU–US Data Privacy Framework with its UK extension and the Swiss–US framework for certified recipients such as Google LLC and Cloudflare, Inc.), and otherwise on the standard contractual clauses in our providers' terms (Art. 46 GDPR). Your e-mails reach us in Türkiye because you send them to us yourself (Art. 49(1)(b) GDPR, where needed).
• Türkiye: we transfer personal data abroad only under Article 9 of Law No. 6698; see the KVKK Aydınlatma Metni.
• Brazil: transfers rely on LGPD Art. 33, in particular the standard contractual clauses approved by the ANPD where available, and otherwise on the other mechanisms of Art. 33.
• Japan: see the Japan section below for information about the countries of the recipients.
• Other countries: we apply the safeguards your local law requires.

You can ask us for a copy or a description of the safeguard that applies to you.

How long we keep data

• Data on your device: until you delete it in the game (Settings → My Account → Delete game data on this device), clear the app's storage or uninstall the game.
• Google's ad data: Google keeps it under its own retention rules; Google states that it anonymises advertising data in server logs by removing part of the IP address after 9 months and cookie information after 18 months (how Google retains data).
• E-mails: up to 2 years after our last exchange, then deleted; longer only while needed for a legal claim or required by law.
• Sales and accounting records from the stores: 10 years, as Turkish commercial and tax law requires (Turkish Commercial Code Art. 82; Tax Procedure Law Art. 253).
• Records of privacy requests: up to 3 years after the request is closed, to show that we handled it.

When a period ends, we delete electronic records so that they cannot be restored (including from the e-mail trash; backups expire in the provider's normal cycle) or make them anonymous. We do not keep paper records of personal data.

Security

We protect personal data with appropriate technical and organisational measures. Google's and Apple's software sends information over encrypted connections (TLS). The game checks every purchase signature, detects edited save files and stores a parental PIN only as a salted hash. Only the people who need it to answer you can read your e-mails. No system is completely secure; keep your device updated and protected with a screen lock.

If a personal data breach happens that is likely to put you at risk, we will inform the competent authorities and, where required, you, within the deadlines the law sets (for example within 72 hours of becoming aware of it to the supervisory authority under the GDPR and under the practice of Türkiye's Personal Data Protection Board).

Your choices

• Ads: watching an ad is always optional. Change your ad choices in Settings → My Account → Ad privacy choices. On Android you can also reset or delete your advertising ID in your device settings; on iPhone and iPad you can change tracking permission in Settings → Privacy & Security → Tracking.
• Consent: where we rely on your consent, you can withdraw it at any time in the same place, as easily as you gave it; withdrawal does not affect processing before it.
• Purchases: a parent can switch purchases off in Settings → Parental controls; Google Play (Family Link) and Apple (Ask to Buy, Screen Time) can require approval for every purchase.
• Your data on your device: delete it at any time (Data & account deletion).

Your rights

Depending on where you live, you have the right to:

• know whether we process your personal data and get access to it and a copy;
• have it corrected or completed;
• have it deleted;
• restrict its use;
• receive it in a portable format and have it sent to another company;
• object to processing based on legitimate interests;
• withdraw consent at any time;
• opt out of the sale or sharing of personal data and of targeted advertising;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects (we make no such decisions);
• not be treated differently for using your rights.

How to use your rights. Write to support@csmediadigital.com. You do not need the game installed or an account. Because the game data stays on your device, you can usually check or delete it yourself in the game. We answer free of charge and without undue delay, within the deadline that applies to you, for example: one month (EEA, UK, Switzerland; extendable by two months for complex requests, in which case we tell you why), 30 days (Türkiye, Canada, Australia, Saudi Arabia), 45 days (US state laws; extendable once by 45 days), 15 days (Brazil, for a full copy), 10 days (South Korea), and the deadlines of the laws of Japan, India and Indonesia. If we need to check that a request is yours, we ask only for what is necessary. An authorised agent or a parent may make a request for you where the law allows it. If we refuse a request, we tell you why and how to appeal (reply to our answer); you can always complain to a supervisory authority.

For data that Google or Apple hold as independent controllers, you can also use their own tools: Google's My Ad Center and your Google Account, and Apple's Data and Privacy page.

Supervisory authorities

You can complain to the data protection authority where you live, work or think your rights were infringed, for example:

We would like the chance to solve your concern first, so please write to us; we answer every complaint within 30 days at the latest.

Children and teens

Jelly Tap Match is made for players aged 13 and over and is not directed at children. We do not knowingly collect personal data from children under 13. The game asks every player's age with a neutral question before any ad or purchase. If the answer shows that a player is under 13 (under 14 in South Korea), the game:

• marks every ad request as child-directed, so Google serves only non-personalised, "G"-rated ads without remarketing or third-party ad vendors (in Türkiye, no ads at all);
• switches purchases off completely;
• keeps the age answer only on the device.

Players under 18 never get personalised ads; purchases are off for 13 to 17 year olds until a parent turns them on with a PIN in Settings → Parental controls. If you are a parent and believe your child under 13 has given us personal data, for example in an e-mail, write to us and we will delete it promptly. More information for parents: Information for parents.

Region-specific information

European Economic Area, United Kingdom and Switzerland

The legal bases are listed in each part above. You have the rights described under "Your rights" (Arts. 15–22 GDPR / UK GDPR; Swiss FADP) and can complain to the authority where you live or work. We have not appointed a representative under Art. 27 GDPR or UK GDPR; contact us directly. Giving personal data to us is not a legal or contractual requirement; the consequences of not giving it are explained in each part. In line with the UK Age Appropriate Design Code, players under 18 get high-privacy settings by default.

Türkiye

Our KVKK Aydınlatma Metni sets out the notice required by Law No. 6698 (Art. 10), your rights under Art. 11 and how to apply. Personalised ads and sending ad data abroad need your explicit consent (KVKK Açık Rıza Metni); players under 18 are not asked and never get personalised ads.

United States

This section is our notice at collection and privacy policy under the California Consumer Privacy Act as amended by the CPRA (CCPA) and the consumer privacy laws of other states, such as those of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others. We give these rights to residents of every US state whether or not a law requires it.

• Categories collected in the last 12 months: identifiers (advertising ID, app set ID or IDFA, IP address); internet or other electronic network activity (ad interactions, diagnostics); approximate geolocation derived from the IP address; inferences Google may draw for personalised ads where allowed; and, if you e-mail us, your e-mail address and message. Game data, age range and purchase records stay on your device and are not collected by us.
• Sensitive personal information: we do not collect it, and we do not use any personal information to infer characteristics about you.
• Sources: your device, through Google's ad software; you, when you write to us; the app stores (sales reports).
• Business and commercial purposes: providing rewarded ads, measuring them, preventing fraud and keeping the game secure, answering you, accounting.
• Disclosure, sale and sharing: identifiers, network activity and approximate geolocation are disclosed to Google (an advertising network). We do not sell personal information for money. Allowing Google to personalise ads may count as "sharing" for cross-context behavioural advertising, as "targeted advertising" or as a "sale" under these laws. E-mails are disclosed only to our e-mail service provider for a business purpose.
• Do Not Sell or Share My Personal Information: opt out in the game in Settings → My Account → Ad privacy choices → Do Not Sell or Share My Personal Information. The game then requests only non-personalised ads with Google's restricted data processing. Our website does not sell or share personal information, so it needs no opt-out; it would honour a Global Privacy Control signal.
• Minors: we do not sell or share the personal information of consumers we know to be under 18, and we do not show them targeted ads; the game's age protections switch personalised ads off for them.
• Retention: as described under "How long we keep data".
• Your rights: to know and access, to delete, to correct, to a portable copy, to opt out of sale, sharing, targeted advertising and profiling, to limit the use of sensitive personal information (we do not use any), and not to be discriminated against for using these rights. An authorised agent may make a request for you with your signed permission. If we refuse a request, you can appeal by replying to our answer within 60 days; we decide on an appeal within 60 days (45 days in some states) and, if we refuse it, you can contact your state attorney general.
• Financial incentives: we do not offer any financial incentive for personal information. The reward for watching a video is the same whether or not ads are personalised.
• Children (COPPA): the game is not directed to children under 13 within the meaning of the Children's Online Privacy Protection Act. See "Children and teens" for what happens when the age question shows a child.

Brazil

Under the Lei Geral de Proteção de Dados (LGPD, Law 13.709/2018), we process personal data on the bases of contract performance, compliance with legal obligations, legitimate interest and, for the protection of children and adolescents, their best interest (LGPD Arts. 7 and 14). The information required by LGPD Art. 9 (purpose, form and duration of processing, our identity and contact, sharing and its purpose, responsibilities and your rights) is set out in this policy.

• Your rights (LGPD Art. 18): confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary or unlawful data, portability, deletion of data processed with consent, information about sharing and about the possibility and consequences of refusing consent, and withdrawal of consent. You can complain to the ANPD. We give a full copy within 15 days.
• Contact: we have not appointed a data protection officer (encarregado) or a legal representative in Brazil. Send any request or question directly to support@csmediadigital.com; you may write in Portuguese.
• Transfers: see "Transfers to other countries".
• Children and adolescents (ECA Digital, Law 15.211/2025): in Brazil ads are never personalised for anyone, nothing that can be bought contains random rewards, purchases are always off under 13 and off for 13 to 17 year olds until a parent turns them on, and parental controls (purchases, daily play-time limit, break reminders) are built in. Information for parents.

Canada

We handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Québec residents, the Act respecting the protection of personal information in the private sector (Law 25). The person in charge of the protection of personal information is the person with the highest authority in our company, reachable at support@csmediadigital.com. Personal information may be processed outside Canada and Québec, as described under "Transfers to other countries", where the laws of those countries apply. You can access and correct your personal information and withdraw consent; you can turn off ad personalisation as described in the table in section 3.

Australia

We handle personal information in line with the Australian Privacy Principles of the Privacy Act 1988. This policy describes the kinds of personal information collected, how it is collected and held, the purposes, and how you can access and correct it. Personal information is likely to be disclosed to recipients in the United States, Ireland and other countries where Google and Apple operate. To complain, write to us first; we answer within 30 days. If you are not satisfied, you can contact the OAIC.

Japan

We handle personal information in line with the Act on the Protection of Personal Information (APPI).

• Business operator: CS MEDYA TICARET VE YAZILIM ANONIM SIRKETI, Bursa 16200, Türkiye. The name of our representative and our full address are disclosed without delay upon request to the e-mail address above.
• Purposes of use: answering your enquiries and requests (for e-mails), and the purposes in section 3 for what Google's software processes.
• External transmission (information sent from your device to third parties): Google's ad software sends the information listed in section 3 (IP address, device identifiers, ad interactions, diagnostics, ad choices) to Google LLC (United States) for delivering, measuring and protecting ads and, where allowed, personalising them. How to stop it: see "Your choices".
• Countries and their systems: we handle your personal information in Türkiye, which has a comprehensive data protection law (Law No. 6698) and a supervisory authority. Our e-mail is stored by Google, mainly in the United States, which has no comprehensive federal privacy law but has state laws such as the CCPA; information on foreign systems is published by the Personal Information Protection Commission.
• Security control measures: we take organisational, human, physical and technical measures to protect the personal information we hold and check that our providers apply appropriate security. Details are given without delay upon request.
• Requests: you can ask us to notify you of the purposes of use, disclose, correct, add to or delete, stop using or erase, or stop providing to third parties the retained personal data we hold (in practice, your e-mails). Write to the address above; we do not charge a fee.

South Korea

• Items processed, purposes and retention: as described in the sections above and the summary table. When a retention period ends, electronic records are deleted so that they cannot be restored.
• Entrustment of processing: Google LLC (Google Workspace, e-mail hosting); Cloudflare, Inc. (website hosting).
• Overseas transfer: recipient Google LLC (contact: Google privacy help); country: United States; time and method: over the network whenever the game prepares or shows an ad; items: advertising ID, app set ID or IDFA, IP address, ad interactions and diagnostics; purpose: ad delivery, measurement and fraud prevention and, where allowed, personalisation; retention: according to Google's policy. You can refuse personalised ads by deleting your advertising ID or by not allowing tracking; if you refuse all ad processing, you can still play but cannot watch reward videos.
• Children: players under 14 get the child-directed ad treatment and cannot make purchases; their age answer stays on the device.
• Automatic collection devices: the game itself does not use cookies; Google's ad software uses device identifiers as described in section 3, which you can refuse as described under "Your choices".
• Privacy officer: the person with the highest authority in our company, reachable at support@csmediadigital.com. You can request access, correction, deletion or suspension of processing; we answer within 10 days. For remedies you can also contact the Personal Information Dispute Mediation Committee (kopico.go.kr), the privacy infringement report center of KISA (118) or the cyber bureau of the National Police Agency (182).

India

Where the Digital Personal Data Protection Act, 2023 and its rules apply, this policy is our notice: it lists the personal data processed and the purposes above. You can withdraw consent as easily as you gave it, access a summary of your data, ask for correction, completion or erasure, nominate another person to exercise your rights, and raise a grievance with us at support@csmediadigital.com. If we do not resolve it, you can complain to the Data Protection Board of India. Players under 18 do not get personalised ads, and we do not track or monitor the behaviour of children for advertising.

Indonesia

Where Law No. 27 of 2022 on Personal Data Protection applies, this policy informs you of the legal basis, purposes, types of data, retention periods and your rights. You can request access, correction, deletion, restriction of processing and withdrawal of consent by writing to us. If a breach affects your personal data, we notify you and the authority within the deadline the law sets (3 × 24 hours).

Saudi Arabia

Where the Personal Data Protection Law applies, this policy informs you of the purposes and legal basis of processing, the data collected, how it is collected and stored, who receives it, transfers outside the Kingdom and your rights to be informed, to access, to obtain a copy, to correction and to deletion. Write to us to exercise them; we answer within 30 days.

Other regions

If you live elsewhere, you have the rights your local law gives you, and you can exercise them through the e-mail address above.

Account and data deletion

Version 1.0 has no account. You can delete all data the game keeps on your device in the game (Settings → My Account → Delete game data on this device), and ask us to delete anything we hold by e-mail, without reinstalling the game. When online features arrive, you will also be able to delete your online account in the game (Settings → My Account → Delete online account) or by e-mail. Step-by-step instructions, what is deleted and how long it takes: Data & account deletion.

Online features (not active in version 1.0)

Duels, leagues, teams, cloud save and sign-in with Google or Apple are being prepared but are switched off in version 1.0: the game shows them as "coming soon" and sends no data for them. When they arrive, they will be optional, and they will use a server operated for us in Germany (Hetzner Online GmbH) behind Cloudflare. Before any online profile is created, we will update this policy, show you what is processed and let you decide.

Changes to this policy

We update this policy when the game or the law changes how personal data is handled. The date at the top shows the current version. We announce material changes in the game or on its store page before they take effect and ask for your consent again where the law requires it.

Language

This policy is written in English and Turkish. Translations into other languages are provided for convenience; if a translation differs from the English version, the English version prevails, except that for consumers in Türkiye the Turkish version applies.

Contact

support@csmediadigital.com · CS MEDYA TICARET VE YAZILIM ANONIM SIRKETI, Bursa 16200, Türkiye

Publisher

CS Digital Games
CS MEDYA TICARET VE YAZILIM ANONIM SIRKETI
Address: Bursa 16200, Türkiye

Company information