Privacy Policy

1. Who we are

DUET, Türkiye, is the controller of the personal data described in this policy. DUET is the puzzle game we publish for iOS, Android and the web.

For anything about this policy, or to exercise any right in section 11, write to baris@barisdede.com. For everything else, write to baris@barisdede.com.

This version is effective from 2026-08-13.

2. The short version

• You can play without an account. On first launch we create an anonymous account so your progress and your keys can be saved on our servers.
• If you sign in with Apple or Google, we store the identifier they issue, plus the name and email address they release to us.
• Every account has a public username, shown to other players on leaderboards.
• We show ads. On iOS we ask before using your device advertising identifier for personalised ones.
• We do not sell your personal data.
• You can ask us to delete your account and everything attached to it at any time.

3. What we collect

We collect the following, and nothing beyond it.

• Account data — an anonymous account identifier created on first launch; your username; your friend code; and, if you sign in, the identifier issued by Apple or Google together with the email address and display name they release. Apple lets you hide your address, in which case we only ever see a relay address.
• Gameplay data — puzzles started and finished, elapsed times, stars, hints and reveals used, streaks, campaign progress, daily results, achievements, and the play sessions our server opens when you start a puzzle.
• Friends — who you have sent a request to, who has sent one to you, who you have accepted, and who you have blocked.
• Wallet and purchase data — your balance of keys, hints and reveals; an append-only ledger of every change to it; and for purchases the transaction identifier, product identifier, purchase and expiry dates and subscription status passed to us by the app stores through RevenueCat. We never receive your card or bank details.
• Advertising data — when an ad is shown, our advertising partner receives your device advertising identifier where you have permitted its use, your IP address and the coarse location derived from it, device and app information, and how you interacted with the ad.
• Device and technical data — device model, operating system version, app version, language and region, time zone, and IP address. This reaches us as an ordinary part of your device talking to our servers.
• Diagnostics — crash reports and error logs produced by the platform, which can contain device state at the moment of the failure.
• Settings — your interface and puzzle language, theme, and whether the daily reminder is on.
• Notifications — if you allow them, a push token issued by Expo's notification service, an installation identifier generated on your device, and the platform you are on. We use these to send the daily reminder and occasional announcements, and nothing else. Turning notifications off in your device settings stops us being able to reach you; you can also ask us to delete the token.
• Reports you send from inside the app — what you write, plus your app and operating system version, device model and make, whether the app is running on a simulator, your time zone and your locale. Those details are attached so a problem can be reproduced; they are not used for anything else.
• Correspondence — anything you send us by email, kept so we can answer it.

4. What we do not collect

• Precise or background location.
• Contacts, photos, camera, microphone, calendar, health or fitness data.
• Card numbers, bank details or billing addresses. Payment is handled entirely by Apple or Google.
• Special categories of data such as racial or ethnic origin, religion, political opinion, health or sexual orientation. Please do not put anything of that kind in your username.

5. Why we use it, and on what legal basis

Where the GDPR or Turkish Law No. 6698 on the Protection of Personal Data (KVKK) applies, we rely on the following.

• Creating and running your account, saving progress across devices, operating the keys economy and delivering what you buy — performance of our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Running leaderboards and showing usernames — performance of that same contract, since this is a core feature of the game.
• Keeping the game fair and secure: detecting cheating, abusive usernames, fraudulent purchases and abuse of rewarded ads — our legitimate interest in protecting the service and the other players (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Showing and measuring non-personalised advertising — our legitimate interest in funding a free game.
• Showing personalised advertising and using your advertising identifier for it — your consent, given through the App Tracking Transparency prompt on iOS or the consent form we show where one is required, and withdrawable at any time (GDPR Art. 6(1)(a); KVKK Art. 5(1)).
• Sending the daily reminder — your consent, given by turning the setting on.
• Answering support requests — our legitimate interest in replying to you.
• Meeting tax, accounting and other legal duties — compliance with a legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(a)).

6. Advertising and tracking

DUET is funded by advertising supplied by Google AdMob, including the rewarded videos you can choose to watch in exchange for keys.

On iOS we do not use your advertising identifier for personalised advertising unless you allow it through Apple's App Tracking Transparency prompt. If you decline, or never answer, you still see ads, but they are non-personalised. You can change your answer at any time in iOS Settings, under Privacy and Security, then Tracking.

On Android you can reset or delete your Advertising ID and opt out of ad personalisation from the device settings, under Google, then Ads.

Where it is required in the European Economic Area, the United Kingdom and Switzerland, we ask for your consent to personalised advertising before any is shown, and you can change that answer later from the app.

Google publishes its own account of how it uses data in its advertising products at policies.google.com/technologies/partner-sites.

7. Who we share it with

We do not sell personal data. Beyond the advertising described in section 6, we do not share it for cross-context behavioural advertising. We use the following providers, each processing data only for purposes we set.

• Supabase — database, authentication and server functions. Holds your account, progress, friends and wallet.
• Google AdMob (Google Ireland Limited and Google LLC) — serving and measuring advertising.
• RevenueCat, Inc. — validating purchase receipts and subscription status on our behalf.
• Apple Inc. and Google LLC — as operators of the App Store and Google Play, they process your purchase and, if you use their sign-in, your authentication. They also carry push notifications to your device.
• Expo / EAS — build and update infrastructure for the app itself, and the notification service that delivers our push messages.

We also disclose data where the law requires it, where it is necessary to establish, exercise or defend a legal claim, or to protect the rights and safety of our players. If the business is sold or merged, account data may pass to the acquirer under the same protections.

8. Where it is held

Our servers and our providers are located in the European Union and the United States. Where data leaves the European Economic Area, the United Kingdom or Türkiye, it is transferred under the European Commission's Standard Contractual Clauses or another lawful mechanism, and under Art. 9 KVKK where that applies.

9. How long we keep it

• Account, progress and wallet data — while your account exists. An anonymous account that is never signed into is deleted after 24 months without activity.
• The wallet ledger and purchase records — up to 10 years, where tax and accounting law requires it.
• Leaderboard entries — 12 months.
• Diagnostics and server logs — up to 90 days.
• Support correspondence — up to 24 months after the request is closed.
• After deletion, backups containing your data are overwritten within 30 days.

10. What other players can see

Your username is shown to other players on leaderboards and is visible to anyone using the app. Do not use your real name, your email address, or anything you would not want published. You can change it in Settings.

Usernames are checked against a list of blocked words. We may reset a username that breaches the rules in our Terms of Use.

Other players can find you by searching your username, or by entering your friend code if you have shared it. A search shows your username and nothing else — not your email, not your scores, not who your friends are.

A friend request has to be accepted before anything follows from it. Once you accept, you and that player can each see the other's username and daily times on the friends leaderboard. Nothing else is shared: not your email address, not your real name, not your purchases, and not the rest of your friends list.

You can remove a friend or block a player at any time, from the Friends screen. Removing ends the connection; blocking also stops any further request from that player. A blocked player is not told that they have been blocked.

Deleting your account deletes your friendships along with everything else, on both sides.

11. Your rights

Depending on where you live you have some or all of the following rights.

• Access — to be told whether we hold data about you, and to receive a copy.
• Rectification — to have inaccurate data corrected.
• Erasure — to have your account and its data deleted.
• Restriction and objection — to limit or object to processing based on our legitimate interests, including profiling for advertising.
• Portability — to receive your data in a structured, machine-readable format.
• Withdrawal of consent — at any time, without affecting processing already carried out.
• Complaint — to your supervisory authority. In Türkiye this is the Personal Data Protection Authority (KVKK); in the EU it is the authority where you live.
• If you are a California resident — to know, delete and correct your information, and to opt out of its sale or sharing. We do not sell personal information, and we will not treat you differently for exercising any of these rights.

To exercise any of them, write to baris@barisdede.com, where possible from the address linked to your account, or from within the app so we can identify the account. We answer within 30 days.

12. Deleting your account

You can delete your account from inside the app, under Settings, then Delete account. Deletion is immediate and removes your profile, username, progress, wallet balance and leaderboard entries. If you would rather we did it for you, write to baris@barisdede.com.

It cannot be undone. Unspent keys, hints and reveals and any unused portion of a purchase are lost. Records we are legally required to keep for tax or fraud prevention are retained for the periods in section 9, with your account identifier removed from them.

Deleting your account does not cancel a subscription. Cancel that in your App Store or Google Play account settings.

Deleting your account does not by itself erase your purchase history at RevenueCat, the processor named in section 7. Write to baris@barisdede.com if you want that erased as well and we will pass the request on.

13. Children

DUET is not directed at children under 13 and we do not knowingly collect their personal data. If you believe a child has given us data, write to baris@barisdede.com and we will delete the account.

Where the GDPR applies and local law sets a higher age for consent to information society services — up to 16 — that higher age applies instead.

14. Security

Data is encrypted in transit with TLS and at rest by our hosting provider. Access to production data is limited to the people who need it. The keys economy is owned by our servers: balances, purchases and rewards are validated server-side and written to an append-only ledger, so a modified app cannot grant itself anything.

No system is perfectly secure, and we cannot promise absolute security.

15. Storage on your device

The app keeps your settings, a cache of your progress and your session token on your device. The web version uses browser local storage for the same purpose. These are necessary for the app to work and are not used for advertising.

16. Changes

We may update this policy. The current text and its effective date are always shown here, and the version number changes when the substance does. Where a change materially affects you, we will tell you in the app before it takes effect.

17. Contact

DUET, Türkiye.

Privacy: baris@barisdede.com. Support: baris@barisdede.com.