Pre-release notice: Jelly Tap Match is not yet available in stores. This page describes version 1.0 as it will be released and will be updated if anything changes before release.
This notice has been prepared under Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform. It covers people who play the Jelly Tap Match game, visit the csdigital.games website and write to us by e-mail. Details are on the Privacy Policy page.
1. Data controller
| Trade name | CS MEDYA TICARET VE YAZILIM ANONIM SIRKETI ("CS Digital Games", "we") |
| Address | Bursa, Türkiye |
| support@csmediadigital.com |
2. What personal data we collect, and by what method
The game needs no account and your game save stays only on your device; if you create an optional online profile, the data listed below is processed on our server. The table below shows which data is processed where.
| Data category | Examples | How and where it is processed |
|---|---|---|
| Game and customer transaction data | Progress, coins, items, settings, the name you give your jelly, purchase and reward records (order number, product, time, the store's signature), parental-control settings (the PIN only as a salted hash), consent answers | Only on your device, by the game itself. It is not sent to us; we cannot access this data (except the data in the row below, if you create an online profile). |
| Online profile and game activity data | A random player ID made by the server and a hash of the session key, friend code, nickname, jelly colour and outfit, acceptance of the online terms (version, time), furthest stage, friendships, friend rooms and their results (stage, time, number of moves), name reports, blocks | Only when you tap Create profile and use the online features: sent by the game, by automated means, through Cloudflare to OVHcloud's server in Canada, on our behalf. No advertising ID, device identifier, e-mail or location is sent. Your IP address is used only in the server's memory, for the request limit. |
| Region | Your device's region setting | Only on your device; used to apply the ad and consent rules of your region. The game does not ask your age; if an earlier version of the game stored a month and year of birth on your device, the game deletes them. |
| Transaction security data | A value derived from the device identifier that checks that the save file has not been changed | Only on your device; not sent out. |
| Advertising (marketing) and device data | Advertising ID (Android) or, if you allow it, IDFA (iPhone/iPad), app set ID, IP address and the approximate location derived from it, ad interactions (views, taps), app and SDK diagnostic information, your privacy choices | Sent to Google by automated means, through the Google Mobile Ads and User Messaging Platform software built into the game, when you choose to watch a rewarded video and while the ad infrastructure is being prepared. |
| Crash and error report data | Technical details of the crash or error, game version, language, the open screen and stage number, device model and operating system, memory and storage information, the Crashlytics installation UUID and the Firebase installation ID | Only in the iPhone and iPad version, when the game crashes or runs into an error: sent to Google LLC by automated means, through the Firebase Crashlytics software built into the game. Not sent in the EEA, the UK and Switzerland, or when your region cannot be determined. Your name, an account or user ID and your advertising ID are not sent. |
| Purchase data | Payment method and billing information | Processed only by Google Play or the App Store; we do not see it. To deliver your purchase, the game receives the store's purchase confirmation (above, customer transaction data). |
| Contact data | Your e-mail address, your name (if you give it), your message and attachments | When you write to us by e-mail. |
| Website visit data | IP address, requested page, time, browser information, connection error reports | Automatically, by our hosting provider Cloudflare, when you visit csdigital.games. The website does not use cookies (Cookies). |
We do not process special categories of personal data (health, biometric data, etc.). Duels, leagues, teams, tournaments, cloud save and sign-in with Google or Apple are not part of this version and send no data; if they arrive, this notice will be updated before they are switched on.
3. Purposes of processing and legal bases
| Purpose | Data | Legal basis (KVKK Art. 5) |
|---|---|---|
| Running the game, keeping your progress and what you bought on your device | Game and customer transaction data | Establishment and performance of the contract (Art. 5(2)(c)). This processing takes place on your device, by the game itself. |
| Verifying purchases and delivering each of them once, preventing fake purchases and cheating | Purchase confirmation, transaction security data | Performance of the contract (Art. 5(2)(c)) and our legitimate interest (Art. 5(2)(f)) |
| Applying the ad and consent rules of your region | Region | Our legal obligation (Art. 5(2)(ç)) and our legitimate interest (Art. 5(2)(f)) |
| Showing the rewarded ad you chose to watch, measuring ads and preventing ad fraud (non-personalised ads) | Advertising and device data | Performance of the contract (Art. 5(2)(c): you choose to watch an ad to get the reward) and our legitimate interest (Art. 5(2)(f)). For the transfer of the data abroad for this purpose, see section 4. |
| Personalised (interest-based) ads and the profiling based on them | Advertising and device data | Only with your explicit consent (Art. 5(1)): on Android, when you turn on the Personalised ads switch in Settings → My Account and give the explicit consent shown there (the switch is off at first); on iPhone and iPad, when you choose "Allow" in Apple's tracking prompt. If you do not give explicit consent, you can still play the whole game. See the KVKK Explicit Consent Text. |
| Finding and fixing crashes and errors in the game (iPhone and iPad only) | Crash and error report data | Our legitimate interest (Art. 5(2)(f)). For the transfer of the data abroad for this purpose, see section 4. |
| Answering your questions, handling support requests and personal data applications | Contact data | Performance of the contract (Art. 5(2)(c)), our legal obligation (Art. 5(2)(ç)) and our legitimate interest (Art. 5(2)(f)) |
| Running the ranking, friends and friend room features you chose, keeping them fair (checking wins, limiting invalid finishes and requests) and keeping nicknames appropriate (reporting and blocking) | Online profile and game activity data | Establishment and performance of the contract (Art. 5(2)(c)) and our legitimate interest (Art. 5(2)(f)). For the transfer of the data abroad for this purpose, see section 4. |
| Providing and protecting the website | Website visit data | Our legitimate interest (Art. 5(2)(f)) |
| Protecting our rights in legal disputes, meeting the requests of competent authorities | The relevant data, to the extent necessary | Establishment, exercise or protection of a right (Art. 5(2)(e)) and legal obligation (Art. 5(2)(ç)) |
4. Who personal data is transferred to, and for what purpose
| Recipient | What for | Where |
|---|---|---|
| Google LLC and Google Ireland Limited (Google AdMob, User Messaging Platform) | Serving and measuring rewarded ads, preventing fraud; personalising them if you have given explicit consent. Google also processes this data for its own purposes as an independent data controller (Google Privacy Policy). | The United States, Ireland and other countries with Google data centres |
| Google (Google Play) and Apple Inc. (App Store) | Handling purchases and subscriptions; payment data is held only by the store; the stores are independent data controllers | The stores' servers (abroad) |
| Google (Google Workspace e-mail service) | Receiving and storing support e-mails | Google's servers (abroad) |
| Google LLC (Firebase Crashlytics) | Processing the crash and error reports of the iPhone and iPad version on our behalf (data processor) | The United States and other countries with Google data centres |
| Hébergement OVH Inc. (OVH Hosting Inc.), Montréal (OVHcloud) | Hosting the game's online server on our behalf (data processor) | Canada (Beauharnois, Québec) |
| Cloudflare, Inc. | Providing and protecting the website and the game's online server (proxy; sees IP addresses to deliver traffic) | The United States and Cloudflare's global network |
| Competent public authorities and institutions, courts; our lawyers and accountants | Meeting legal obligations, protecting our rights | Türkiye |
Transfers abroad. The servers of the service providers above are abroad. Online feature data is stored on the OVHcloud server in Canada; the basis for this transfer is the transfer mechanisms described below under Article 9 of the KVKK. We transfer personal data abroad only in accordance with Article 9 of the KVKK: with the standard contracts announced by the Personal Data Protection Board (notified to the Board within 5 business days of signing) or with other appropriate safeguards permitted by the Board; where these are not available, only under one of the incidental transfer cases in KVKK Art. 9(6), for example on the basis of the explicit consent you give after being informed of the possible risks. You can find out which safeguard is used for which recipient by writing to us.
5. Retention periods
- Game data on your device: stays on your device until you delete the game or clear its storage; we cannot access it.
- Google's ad data: under Google's own retention policies (how Google retains data).
- Crash and error reports (iPhone and iPad): 90 days, under Firebase's rules.
- Online profile (player ID, hash of the session key, friend code, nickname, jelly, outfit, terms acceptance, furthest stage, friendships): until you delete your online account; deletion is immediate, and the data of a deleted account drops out of backups within 30 days at the latest.
- Friend rooms and their results: 30 days after the room closes. Name reports: 180 days from the report, then deleted automatically. Blocks: until you remove them or delete the account.
- IP addresses at the online server: only in memory for the duration of the request limit; not stored.
- Server logs (errors and security): kept for at most 4 weeks; no game content or identity information is written to these logs.
- Support correspondence: at most 2 years after the last exchange; if there is a dispute or a legal retention obligation, until that period ends.
- Website logs: under Cloudflare's short-term log policy.
Data whose period has ended is deleted or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
6. Children
Jelly Tap Match is made for a general audience and is not directed at children under 13. The game does not ask for age, and we do not knowingly collect personal data from children. Minors should play the game with the permission of their parents or guardians. If you think your child has given us personal data, write to us; we will delete that data. The game has optional parental controls that everyone can use: Information for parents.
7. Your rights under KVKK Art. 11
By applying to the data controller, you have the right to:
- learn whether your personal data is processed,
- request information about it if it has been processed,
- learn the purpose of the processing and whether the data is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom it is transferred,
- ask for it to be corrected if it is incomplete or inaccurate,
- ask for it to be deleted or destroyed under the conditions in KVKK Art. 7,
- ask for the correction, deletion and destruction to be notified to the third parties to whom the data has been transferred,
- object to a result to your detriment arising from the analysis of the processed data exclusively by automated systems,
- claim compensation for the damage if you suffer damage because of unlawful processing.
You can withdraw your explicit consent at any time by turning off the Personalised ads switch in Settings → My Account in the game (on iPhone and iPad, by stopping tracking in the iOS settings opened from the Settings → My Account → Tracking permission row) or by writing to us; withdrawal takes effect for the future.
8. How to apply
You can send your application in Turkish, in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller:
- signed with a secure electronic signature or a mobile signature, to support@csmediadigital.com,
- from the e-mail address you have previously given us and that is registered in our system, to support@csmediadigital.com, or
- in writing (with a handwritten signature) by post; if you ask us by e-mail for our postal address for a written application, we will give it to you without delay.
The application must include your name and surname, your signature (if in writing), your Turkish identity number (if you are a foreign national, your nationality and your passport or identity number), your address for notifications, your e-mail address or telephone number if you have one, and the subject of your request. Do not send a copy of an identity document; if necessary, we ask only for a proportionate verification.
We conclude your application free of charge within 30 days at the latest. If the action requires an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If your application is rejected, if you find the answer insufficient or if no answer is given in time, you can complain to the Personal Data Protection Board within 30 days from the date you learn of the answer, and in any case within 60 days from the date of your application.
9. Changes
We update this notice when the way we process data changes; the date at the top shows the latest version. We announce material changes in the game or on the store page.
Publisher
CS Digital Games
CS MEDYA TICARET VE YAZILIM ANONIM SIRKETI
Address: Bursa, Türkiye