Privacy Policy

1. Introduction

This Privacy Policy informs you, in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR), which personal data we process when you play Taso on iOS or Android and when you visit the website playtaso.com, for which purposes and on which legal bases, to whom we disclose it, how long we keep it, and which rights you have. It applies to the Service as defined in section 3.

Work in progress: Taso is not yet available in the App Store or on Google Play. This policy describes the game as it will be released; each note like this one marks a part that is not built yet.

2. Controller and contact

The controller within the meaning of Article 4(7) GDPR is Engin Deniz Usta, who runs EDUsta as a sole proprietorship:

Engin Deniz Usta
Brennerei 2
82024 Taufkirchen
Germany

Email, also for privacy requests: support@edusta.dev

We have not appointed a data protection officer, because the statutory requirements for such an appointment are not met.

3. Definitions

• "We", "us" and "our" refer to Engin Deniz Usta as the controller.
• "Game" means the Taso application for iOS and Android, including its test versions.
• "Website" means the website playtaso.com, including its language versions and the browser demo on it.
• "Service" means the Game and the Website together.
• "Account" means the account the Game creates for you when you first start it, with or without a sign-in with Apple or Google.
• "User ID" means the random identifier of your Account, created by Google Firebase. It is the only identifier under which we keep your data.
• "Discs" (tasos) and "Coins" mean the virtual items of the Game described in the Terms of Service.
• "Personal data", "processing" and "processor" have the meanings in Article 4(1), 4(2) and 4(8) GDPR.
• "TDDDG" means the German Telecommunications Digital Services Data Protection Act.
• "KVKK" means the Turkish Personal Data Protection Law No. 6698.

4. Overview

• You can play Taso without signing in. We do not ask for your name, date of birth, telephone number, contacts, photos or location.
• When you first start the Game, it creates an anonymous Account with a random User ID. Your Discs, Coins, matches and rating are kept under this ID.
• To play against other people, you sign in with Apple or Google. We then receive your email address through our sign-in provider; we never use your name or photo.
• The Game contains no analytics software and no third-party crash reporting software, and we send you no marketing messages. We never sell your data.
• The Game can show ads that you choose to watch in exchange for Coins. Google AdMob, the only ad network in the Game, provides these ads as an independent controller. You receive personalised ads only with your consent, wherever you live: in the European Economic Area, the United Kingdom and Switzerland in Google's own consent form, elsewhere through the choice Ads tailored to you in the Game's privacy settings. Without your consent, and always if you are 13 to 15, you receive only non-personalised ads.
• Taso is not available to children under 13.
• The Website sets no cookies. It counts page views with Vercel Web Analytics, which stores nothing on your device and produces aggregated statistics only.

5. Data we process and why

5.1 Your Account

When you first start the Game, our sign-in provider Google Firebase creates an anonymous Account with a random User ID. We need it to provide the Service, which cannot function without it: every Disc you own, every Coin and every match is recorded under it. Our server also records which kind of sign-in you use (anonymous, Apple or Google), when your Account was created and when it last changed.

As long as you have not signed in with Apple or Google, the Account is tied to this installation of the Game: if you delete the Game, reset your device or change devices, the Game starts over with a new Account, and you cannot get your Discs and Coins back.

5.2 Signing in with Apple or Google

You can link your Account to Sign in with Apple or Sign in with Google, to keep your collection across devices and to play against other people (section 5.4). Your User ID stays the same.

With Apple, our sign-in provider receives an email address only: that of your Apple account or, if you choose to hide it, a forwarding address created by Apple. We do not request your name from Apple. With Google, Google shares your email address, your name and a link to your profile picture with Google Firebase, which stores them on our behalf; we never use the name or the picture. Our server takes from each sign-in only your User ID and which sign-in you used; your email address stays with Google Firebase. We use it only to find your Account when you contact us, and to send you notices about the Service for which the law requires a durable medium.

Work in progress: Sign in with Apple and Sign in with Google are not in the Game yet. Until they are, every Account is anonymous.

5.3 Your collection and Coins

We process the Discs you own (each Disc's character, set, grade and rarity, and when it was made), your Coin balance and a record of every change to it with its reason (for example a match reward, a pack you opened, a purchase, a daily Taso Pro amount or a rewarded ad), and the packs you opened. We need this to provide the Game and to prevent cheating and duplicate grants.

5.4 Matches, matchmaking and rating

When you play, our server records the matches you play, against a computer opponent or against another person: the time, the result, how the match ended (for example a win or a disconnection), the Discs each side staked, won and lost, and the Coins awarded. For matches against other people it also records the opponent's User ID, and it keeps a rating (a number with its uncertainty, computed with the Glicko-2 method) and the number of rated matches you played. We use the rating to match you with players of similar strength and to show your rank in the Game.

To play against another person, you join a queue on our server, which pairs you with an opponent and starts the match on a game server we operate. During the match, your device connects to that game server, which processes your IP address to carry the connection; your device never connects directly to your opponent's device. Your opponent sees the match itself, the Discs in play, your rank tier and a generic label in place of a name, but never your rating number, your User ID, your email address or your IP address.

5.5 Purchases: Coins and Taso Pro

You can buy Coins and the Taso Pro subscription in the Game. They are sold by Apple through the App Store or by Google through Google Play, who process the payment; we never receive your card details or your store account. Our service provider RevenueCat manages the purchase status under your User ID: the Game connects to RevenueCat when it starts, so that it can show the correct status and restore a purchase. When you buy something, the store, RevenueCat and our server process the transaction data (product, price, currency, store country, time, transaction numbers, and whether a subscription is active, renewed, cancelled or refunded). Our server credits your Coins and records until when Taso Pro is active, from RevenueCat's notification. While Taso Pro is active, our server adds a daily amount of Coins to your balance. Our server keeps RevenueCat's notifications for 90 days (section 10).

5.6 Rewarded ads

The Game may offer you an ad to watch in exchange for Coins. You only see such an ad if you choose to watch it. The ads come from Google AdMob (Google Ireland Limited). While an ad is loaded and shown, Google's advertising software in the Game processes your IP address, information about your device and the Game (such as the device model, operating system, language and App version), information about the ad and your interaction with it and, on Android, the advertising identifier of your device. On iOS, the Game does not ask for permission to track you, so Google does not receive the advertising identifier (IDFA) of your device.

Google AdMob is the only ad network in the Game. We use no mediation partners, so no other ad network receives data through the Game. We have limited the ads to Google's PG rating (content suitable for most audiences with parental guidance).

Google processes these data as an independent controller, under its own responsibility, to deliver and measure ads, to prevent fraud and, where you have consented, to personalise ads. Google's privacy policy: https://policies.google.com/privacy; how Google uses data from apps that use its services: https://policies.google.com/technologies/partner-sites.

Your consent in the European Economic Area, the United Kingdom and Switzerland. There, before the first ad, the Game shows Google's consent form, which is certified under the IAB Transparency and Consent Framework. In it you decide whether Google may store and read information on your device and personalise ads. You can change your decision at any time in the Game's settings under Privacy options. If you do not consent, Google may still show ads that are not personalised, or limited ads that do not use cookies or the advertising identifier. Rewarded ads work without your consent, and the rest of the Game does not depend on your decision.

Your consent everywhere else. Outside the European Economic Area, the United Kingdom and Switzerland, the Game asks you itself, on its own consent screen, before the first ad. Under Marketing, the choice Ads tailored to you is off until you turn it on. If you turn it on, you consent to Google personalising the ads in the Game and using information on your device for this purpose. You can turn it off again at any time in the Game's settings under Privacy options. Rewarded ads work without your consent, and the rest of the Game does not depend on your decision.

Non-personalised ads. If you have not consented, wherever you live, you receive only non-personalised ads. Google AdMob serves these too and processes the data described above to a limited extent for them, for example to count ads, to limit how often an ad is shown and to prevent fraud. Non-personalised ads are not based on your past behaviour; Google selects them by context, such as the Game and your approximate location (for example your city). We show them to finance the free Game (section 6.2). In the European Economic Area, the United Kingdom and Switzerland, what Google stores on and reads from your device follows your answer in its form.

If you are 13 to 15, wherever you live, the Game shows neither Google's consent form nor the Ads tailored to you choice and offers no personalised ads; it marks every ad request as coming from a person under the age of consent, and you receive only non-personalised ads (section 13).

Verifying the reward. When you finish watching an ad, Google tells our server, together with your User ID, the ad unit and a transaction number, that the reward is due. Our server checks this message with Google's signature, credits the Coins, and records the transaction number, your User ID, the ad unit, the Coins and the time. We use this record to grant each reward exactly once and to limit how many rewards an Account can receive per day.

Work in progress: Rewarded ads, Google's consent form, the Game's own consent screen with the Ads tailored to you choice, the Privacy options entry and the age check are not in the Game yet. Until they are, the Game shows no ads and loads no advertising software.

5.7 Operation, security and error reports

When the Game communicates with our server or our game server, Cloudflare (which protects our server) and our hosting at Google Cloud process your IP address, the time, the request and technical information about the Game, in order to operate the Service, protect it against attacks and misuse, and identify faults. When something fails on our server, it sends an error report to Google Cloud Error Reporting; such a report may contain your User ID.

The Game contains no crash reporting software and sends no error reports from your device. If you have allowed it in your device settings, Apple (for iOS) or Google (for Android, through Google Play) may collect crash reports as an independent controller and make reports concerning Taso available to us, without your User ID: technical details of the error, the device model, and the operating system and Game version. We use them to fix faults.

5.8 Your age, the Terms of Service and your choices

Taso is for people aged 13 and over. When you first start the Game, it asks for your age range: on iOS through Apple's Declared Age Range feature, on Android through the means Google Play provides. It never asks for your date of birth. The Game keeps the result on your device only: whether you are under 13, 13 to 15, or 16 or over. If you are under 13, the Game cannot be used. If you are 13 to 15, the Game asks for no consent and shows only non-personalised ads (section 5.6).

When you start, you accept the Terms of Service. We keep a record that you accepted them, with the versions of the Terms of Service and of this Privacy Policy that you were shown and the time. We also keep a record of each privacy decision you make in the Game: the category, your decision, the version of the text you were shown, the time and where you made it. We do not store your IP address or your device's user agent with these records. They are deleted with your Account.

The Game sorts what it does with your data into three categories: Required (what the Game needs to work, sections 5.1 to 5.7, which needs no consent), Analytics and Marketing. The Game contains no analytics software and we send no marketing messages, so it asks for no consent under Analytics. Under Marketing, outside the European Economic Area, the United Kingdom and Switzerland, it asks only about Ads tailored to you (section 5.6). In the European Economic Area, the United Kingdom and Switzerland, Google's consent for ads is asked separately, in Google's own form. If anything else changes, we will update this policy first and ask for your consent.

Work in progress: The age check, the acceptance of the Terms of Service in the Game and the records of your acceptance and your choices are not built yet.

5.9 The Website

Hosting. When you visit the Website, our hosting provider Vercel processes technical request data (IP address, time, page requested, browser type) in order to deliver the Website and protect it against attacks and misuse.

Web Analytics. We use Vercel Web Analytics to obtain aggregated statistics on the use of the Website. For each page view, the following is transmitted to Vercel: the address of the page, the website you came from if you followed a link, and technical information that Vercel derives from the request, namely country, region and city, operating system, browser and device type. Vercel does not recognise visitors by cookies. Visitors are distinguished by a hash value formed from the request, and a visitor session is discarded after 24 hours. We receive aggregated figures only. Vercel Web Analytics creates no profiles, does not track you across other websites and is not linked to the Game or your User ID.

The browser demo. The demo on the Website runs entirely in your browser, against a computer opponent. It creates no Account, keeps no progress and sends nothing to us.

No cookies and no third-party requests. The Website sets no cookies and loads no resources from third parties: the analytics script is loaded from, and its data are sent to, the Website's own address.

Work in progress: How long Vercel keeps request logs and Web Analytics data, and where it stores them, will be added here.

5.10 When you email us

If you write to us, we process your email address, your message and any attachments in order to answer you. If your message concerns your data, please include your User ID (section 11.4).

6. Legal bases

6.1 Overview

6.2 Our legitimate interests

Where we rely on Article 6(1)(f) GDPR, our legitimate interests are: providing the Game you have chosen to use where a contract has not been validly concluded; selling purchases reliably; financing the free Game with non-personalised ads (personalised ads only with your consent, section 6.1); a secure and stable Service, protection against cheating, attacks and misuse, and the correction of faults; and delivering the Website securely and knowing which pages are read, in order to improve it.

6.3 Storage on and access to your device

Game. The Game stores on your device, and reads back, only what is strictly necessary to provide the Service you requested: your sign-in, the purchase status, your settings, your privacy choices and the result of the age check (§ 25(2) no. 2 TDDDG). In the EEA, the UK and Switzerland, Google's advertising software stores and reads information on your device only as Google's consent form allows (section 5.6). Elsewhere, it uses information on your device to personalise ads only if you have turned on Ads tailored to you (section 5.6). Without that, it still reads limited information from your device for non-personalised ads, for example to count ads, limit how often an ad is shown and prevent fraud (section 5.6).

Website. Vercel Web Analytics sets no cookies and stores no information on your device. We therefore assume that no information is stored on or read from your device within the meaning of § 25(1) TDDDG, and we do not ask for consent.

6.4 Your consent and how to withdraw it

Where processing rests on your consent, you can withdraw it at any time, as easily as you gave it, with effect for the future (Article 7(3) GDPR). For ads, change your decision in the Game's settings under Privacy options (section 5.6). There you change your answer in Google's form in the EEA, the UK and Switzerland, or turn off Ads tailored to you elsewhere.

6.5 Your right to object

Where we rely on legitimate interests, you may object at any time, on grounds relating to your particular situation (Article 21 GDPR). Write to support@edusta.dev with your User ID.

6.6 Whether you must provide data

You are not obliged by law or by contract to provide personal data. The User ID, the game data and the request data described in sections 5.1, 5.3, 5.4 and 5.7 are, however, necessary to provide the Game; without them, the Game cannot be used. Signing in with Apple or Google, watching ads, purchases and emails are voluntary.

7. Automated decision-making

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR). Your rating only determines whom you are matched with and which rank the Game shows. Our server automatically refuses rewards and purchases it cannot verify, and limits rewards per day; this protects the Game against cheating and does not otherwise affect you.

8. Recipients

We do not sell or rent personal data. We do not share it with advertisers; Google AdMob, our only ad network, processes it as its own controller only as described in section 5.6. The following service providers process personal data on our behalf and under our instructions as processors (Article 28 GDPR):

• Google Cloud (Belgium): operates our server and our game servers, logs and error reports.
• Supabase (European Union): hosts our database.
• Google Firebase (United States): accounts and sign-in.
• RevenueCat (United States): purchase status.
• Cloudflare (United States): protects the connections to our server and game servers, and DNS for playtaso.com.
• Vercel (United States): hosts the Website and provides Web Analytics.

Apple (App Store, payment, Sign in with Apple, crash reports) and Google (Google Play, payment, Sign in with Google, crash reports, and AdMob for ads, section 5.6) act as independent controllers under their own terms and privacy policies. We may disclose data where we are legally obliged to do so, for example to a court or an authority.

9. Transfers outside the European Economic Area

Our server, our game servers and our database are located in the European Union (Google Cloud in Belgium, region europe-west1, and Supabase in the European Union). Google Firebase processes account data in the United States, and RevenueCat, Cloudflare and Vercel are based there; our other providers may also access data from outside the European Economic Area. For such transfers we rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, for certified companies, or on the Standard Contractual Clauses adopted by the European Commission (Articles 45 and 46(2)(c) GDPR).

10. Retention

We keep personal data only for as long as it is required for the purposes set out above, unless the law requires us to keep it longer.

• Account, collection, Coins and their history, matches, rating: until you delete them or ask us to delete them (section 11).
• Records of rewarded ads: as long as your Account exists; when it is deleted, we remove your User ID from them and keep only the transaction number, ad unit, Coins and time, so that a reward cannot be granted twice.
• Your acceptance of the Terms of Service and your privacy choices: as long as your Account exists; they are deleted with it.
• Your age group: only on your device, until you delete the Game.
• Purchase status and records: as long as your Account exists, unless tax law requires us to keep a record for the statutory period. Our tax records are the sales reports of Apple and Google, which contain no data about individual buyers.
• Your record at RevenueCat: deleted together with your Account.
• RevenueCat's notifications about your purchases: 90 days; then we delete their content.
• Server logs and error reports: 30 days.
• Database backups: 7 days. We make one backup a day, so deleted data leaves the backups after 7 days.
• Website request logs and Web Analytics data: work in progress, see section 5.9.
• Emails: as long as needed to handle your request, unless the law requires us to keep them.

11. Your rights

11.1 Your rights under the GDPR

You have the right to access your personal data and to receive a copy of it (Article 15 GDPR), to have it rectified (Article 16), erased (Article 17) or its processing restricted (Article 18), to receive it in a structured, commonly used and machine-readable format (Article 20), and to object to its processing (Article 21, section 6.5). Where processing rests on your consent, you may withdraw it at any time (section 6.4).

11.2 In the Game

In the Game's settings, Export my data downloads a file with everything our database holds about you. Delete account deletes your Account, including a sign-in with Apple or Google, and everything we hold under your User ID, and has RevenueCat delete its record of you; the Game then starts over with a new Account. Deletion is final, so the Game asks you to confirm it first. Deleting the Game alone deletes nothing on our server. Our account deletion page describes the steps.

Work in progress: Export my data and Delete account are not in the Game yet. Until they are, write to us (section 11.4) and we export or delete your data for you.

11.3 What remains

Settings kept only on your device are removed when you delete the Game. Logs and backups are not edited, but expire as set out in section 10. A purchase remains with your Apple or Google account; deleting your Account does not cancel a Taso Pro subscription, which you cancel in your App Store or Google Play subscriptions. Discs you lost to other players in matches are part of their collections. In other players' records of matches, ratings and stakes, your User ID is replaced by a placeholder for a deleted player that identifies no one; the other player's own result stays.

11.4 By email

You may also write to support@edusta.dev. If you signed in with Apple or Google, write from that account's email address (if you hid your address from Apple, tell us the forwarding address Apple created). If you play without signing in, we can only find your data with your User ID, which the Game shows in its settings. If we cannot identify your Account, we will tell you (Article 11 GDPR). We answer within one month; for complex requests this period may be extended by two further months, in which case we will inform you.

Work in progress: The Game does not show your User ID yet.

11.5 Users in Türkiye

Users in Türkiye also have the rights under Article 11 of the KVKK. The Turkish version of this Privacy Policy sets them out in full.

11.6 Users in California

We do not sell personal information for money. We share personal information for cross-context behavioural advertising only with your consent: you receive personalised ads from Google (section 5.6), which may count as such sharing under California law, only if you have turned on Ads tailored to you in the Game. Otherwise, and always if you are under 16, we do not share personal information for this purpose. You can withdraw your consent at any time by turning the choice off in the Game's settings under Privacy options. You may request to know and to delete the personal information we hold about you, as described above, and we will not discriminate against you for exercising these rights.

12. Complaints

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence or place of work (Article 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de.

Users in Türkiye may also lodge a complaint with the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), https://www.kvkk.gov.tr.

13. Children

Taso is intended for persons aged 13 and over and is not directed at children under 13. The Game checks your age range to make sure of this (section 5.8).

Almost all of the processing described in this Privacy Policy rests on the performance of the contract, on our legitimate interests or on a legal obligation, not on consent. The exception is personalised ads (section 5.6). In Germany, a person can give such consent themselves only from the age of 16 (Article 8 GDPR), and we apply this age everywhere: if you are 13 to 15, the Game asks for no consent and you receive only non-personalised ads.

Young people can exercise the rights in section 11 themselves; a parent or guardian can also exercise them on their behalf. If we learn that a child under 13 is using Taso, we delete the data under that User ID as soon as we can identify it.

14. Security

We protect personal data with appropriate technical and organisational measures (Article 32 GDPR). Data is transmitted in encrypted form. Our database is hosted in the European Union with encrypted storage, restricted access and backups. Our server accepts only requests carrying a valid sign-in, and it alone decides your Coins, Discs and purchases. Only Engin Deniz Usta can view an individual player's data. If a personal data breach is likely to result in a risk to you, we will notify the supervisory authority within 72 hours and inform you as the GDPR requires (Articles 33 and 34 GDPR).

15. Changes to this Privacy Policy

We update this Privacy Policy when the Service changes, and before any new kind of processing begins. The date at the top shows the current version. We will point out significant changes in the Game or in the update notes before they take effect.

16. Contact

For any questions about this Privacy Policy or about the processing of your personal data, please contact us:

• Email: support@edusta.dev
• Post: Engin Deniz Usta, Brennerei 2, 82024 Taufkirchen, Germany