Privacy Policy

Effective date: 27 September 2026

1. Who we are

Gumball Drop (called Sakız Birleştir in Turkish) is a game for iOS and Android published by Mire Bilişim A.Ş., İstanbul, Türkiye (“we”). We are the data controller for the data described on this page. Contact: games@trademire.ai.

No account and no sign-in. We never ask for your email address or phone number.
No advertising identifier and no tracking: the Android app has the advertising-ID permission removed, and the iOS app never asks to track you.
No precise location, contacts, photos, camera or microphone.
Payments are handled entirely by Apple or Google. We never see your card.
Other players can see only the name and picture you choose, your scores, and the replay of a top run.

2. What we process and why

2.1 Player ID

On first launch the app creates a random ID and keeps it on your device. It is not derived from your phone’s hardware or from any advertising identifier. The app sends it with the requests described below so that our server can keep your records apart. Other players never see it: the leaderboard shows a public number derived from it (for example “#1234”).

2.2 Scores and replays

When a run ends and it improves one of your bests, the app sends your Player ID, the score, the platform (iOS or Android), a fingerprint of the game version, and the replay of the run, which includes the game mode and level. The same request carries the name you chose, if any, and our server ignores it there (names reach the leaderboard only as described in 2.3). A replay is the list of moves you made, not a video. We use this to show the monthly and all-time leaderboards and to check top scores against cheating by replaying the run on our server. The replay of a run in the top 100 of a leaderboard is kept so that other players can watch it. The app also sends a short signal with your Player ID, the platform and the play time when a run starts and ends; our server currently discards it without storing it.

2.3 Optional name and picture

You can choose a leaderboard name (3 to 16 characters) and one of the game’s own pictures. Your picture is shown publicly on the leaderboards. Other players see your name only masked: its first and last character with at most four stars between them (for example, “Ahmet” appears as “A***t”). Only your own device shows it to you in full. Our server keeps the full name so that it can check it and act on reports. Names are checked by a filter on your device and again on our server. If you report another player’s name, we store the report together with your public number; a name reported by several players is marked and then removed. “Hide player” is stored on your device only. You can clear your name at any time in the Profile panel.

2.4 Invites

The app gives you an invite code linked to your Player ID, and our server notes when it created the code. If you enter a friend’s code, we store the link between your two IDs, when you entered it, how many runs you had finished by then, and whether you have finished a run since, so that your friend’s reward can be counted; when five friends have counted, we record your ad-free reward. To stop abuse of rewards we also store a salted one-way hash of your IP address, never the address itself.

2.5 Technical data on every request

Like any internet service, our servers receive your IP address, the time, the address requested (which can include your Player ID) and the app’s technical identification with every request. Our web server logs keep this for up to 14 days for security and troubleshooting. Request limits use your IP address in memory only.

2.6 Update checks

When the app starts, it reads a public file from our server to learn whether a newer version is available in the store, and may tell you so. The app can also receive small updates to the game’s own content from our update server. For that it sends the app’s ID and version, the operating system version, the platform and a random identifier created by the update component, along with technical details such as that component’s version and whether the app was installed from the store. We use this only to deliver the update that fits your app version and to count, without identifying you, how many devices received it. These requests reach our servers like any other and fall under the server logs described in 2.5.

2.7 Ads for our own apps

Before a run or after one, the app may show a full-screen card for another app made by us. The list of these ads and their pictures and videos are downloaded from our server. So that it does not advertise an app you already have, the app checks on your device whether that app is installed; the result stays on your device.

You can report any ad, ours or Google’s: tap the Ad tag on the card, or “Report an ad” in the Profile panel. That opens your own email app with a message to games@trademire.ai that names only the ad, the app, its version, your platform and the app’s language. Nothing is sent unless you send that email yourself.

2.8 Rewarded ads (Google AdMob)

The app contains the Google Mobile Ads SDK. A video ad plays only when you choose to watch one, for example to unlock a helper. Every ad request is non-personalized and limited to content suitable for all ages (rated G); your advertising identifier is not used (the app asks for no tracking permission on iOS and carries no advertising-ID permission on Android). To deliver ads, measure them and prevent fraud, Google receives technical data such as your IP address, device and app information, an app-scoped identifier, ad interactions and diagnostic data. Google processes this data under its own policies: How Google uses information from apps that use its services. The reward is granted on your device; we do not record which ads you watch.

Consent before the first ad. Before the app requests any ad, it asks Google’s consent tool (the User Messaging Platform) whether you must be asked for consent where you are; for that, the tool receives technical data such as your IP address and device and app information. Where the law requires consent – in particular in the EU, the EEA, the UK and Switzerland – the app then shows Google’s consent message over its main menu, never during a run, and requests no ad until you have answered it. Your answer decides what Google may do on your device: if you consent, Google may store and read information on your device (for example to limit how often you see the same ad, and to measure ads) to show non-personalized ads; if you do not, Google shows only limited ads that use no identifier stored on your device, or none. If ads cannot be requested, the game works as usual and simply offers no ad to watch. Your answer is stored on your device by the consent tool and sent with each ad request. It never makes the ads personalized: every request stays non-personalized, whatever you answer. You can change or withdraw your answer at any time with Ad privacy options in the Profile panel or at the bottom of How to play; the entry is there wherever Google’s consent message applies. If you have Remove Ads, or ad-free play earned through invites, the app shows no Google ads and asks for no consent.

2.9 Purchases

“Remove Ads” is sold through the App Store or Google Play, which process the payment. We receive no card or billing details. The app asks the store only whether you own the item and what it costs in your store’s country.

2.10 Kept on your device only

Your settings, language and sound choices, coins, goals and crowns, jar skins, the players you hid and an unfinished run are stored only on your device. They are deleted when you delete the app; a backup of your phone that includes the app (such as iCloud or Google backup) keeps its own copy, and Android may restore it when you reinstall.

2.11 Sharing and links

When you share a run video, a picture or an invite, it is made on your device and handed to your phone’s share sheet; you choose where it goes. If you choose to save it to your photos, your iPhone asks your permission to add it there; the app never reads your photo library. Links to our social media pages open in their own apps or in your browser.

3. Legal bases

For users in Türkiye (Law No. 6698 on the Protection of Personal Data, “KVKK”, article 5) and in the EU, EEA and UK (GDPR, article 6):

providing the features you use, such as leaderboards, invites, purchases and updates: KVKK art. 5(2)(c), GDPR art. 6(1)(b);
our legitimate interest in running a fair and secure game (checking scores, limiting abuse, server logs, update counts): KVKK art. 5(2)(f), GDPR art. 6(1)(f);
your own choice to show a name and picture, which you can undo at any time;
rewarded ads, which you choose to watch: where Google’s consent message asks for it, your consent, GDPR art. 6(1)(a), which you can withdraw at any time with Ad privacy options (see 2.8); in Türkiye, providing the reward you ask for when you choose to watch an ad, KVKK art. 5(2)(c).

4. Who receives data

Other players: your chosen name and picture, your scores, and the replay of a top run.
Our hosting provider: our servers are rented from Contabo GmbH and located in the European Union. As we are based in Türkiye, this means your data is transferred abroad. The servers run only our own services and are administered by us.
Google for ads, as described in 2.8, and Apple and Google for app distribution and purchases.

We do not sell your data, and we do not share it for personalized advertising.

5. How long we keep it

Scores, name and picture, and invite records: while the game’s online service runs, or until you ask us to delete them.
Replays: only for runs in the top 100 of a leaderboard; monthly replays are removed after the following month.
Name reports: while the game’s online service runs, or until you ask us to delete them; the reports on a name we give back after review are deleted.
Web server logs: up to 14 days.

6. Children

Gumball Drop is a casual game for a general audience. It is not directed at children under 13, and we do not knowingly collect personal information from them. The game asks for no personal information: the leaderboard name is optional and filtered, and every ad request is non-personalized and limited to ads suitable for all ages. If you believe a child has entered personal information as a leaderboard name, write to us and we will delete it.

7. Your rights and deleting your data

Under KVKK article 11 and the GDPR you can ask whether we process your data and for a copy of it, have it corrected or deleted, object to its processing, and learn who received it. You can also complain to the Turkish Personal Data Protection Authority (KVKK) or to your local data protection authority.

Write to games@trademire.ai and include your invite code (shown in the game’s Invite panel) or your leaderboard name and number, so that we can find your records. We answer within 30 days. Because there is no account, deleting the app does not delete what is on our server: ask us, and we delete your scores, replays, name, picture, invite records and the reports you made. You can remove your name yourself at any time in the Profile panel.

What is not deleted on request: the web server logs, which expire on their own within 14 days (section 5), and what Apple or Google keep about a purchase, which is theirs to delete. Deleting the app removes everything that is kept on your device only (2.10).

8. Security

All connections between the app and our servers use HTTPS (TLS). Your Player ID is never shown to other players, and our leaderboard service records only your public number in its own logs.

9. Changes

If this policy changes, we will update this page and its effective date.