MindoraX Privacy Policy

Explains how account, game, security, notification and purchase data are processed in MindoraX; the AI coach and family feature; with whom data is shared, how it is retained and your rights.

Effective date: 2026-10-19

1. Data Controller and Contact

MindoraX is a mobile game for Android and iOS. The controller of your personal data is Parantik Yazılım LTD ŞTİ, located in Türkiye. You can write to [email protected] with privacy, personal data rights and support requests. Our website: https://mindoraxgame.com

2. What Data Do We Process?

• Account and sign-in: Username, email address, display name, avatar, language, registration time and last sign-in time. If you use a password, it is stored in hashed form. Email and password sign-in takes place through Firebase Authentication; verification and password reset emails are sent as part of this process. Sign-in with Google Play Games and Apple Game Center may also be used.
• Sessions and security: The IP address and device user-agent information for each session. You can view your active sessions in the app.
• Game: Game sessions and results, levels and experience points, streaks, quests, training programs, tournaments, leaderboards, multiplayer rooms, invitations, in-game wallet (coins and diamonds) and inventory.
• Preferences: Sound, music, vibration, language, theme, notification on/off setting and daily reminder time.
• Device and notifications: Firebase Cloud Messaging push notification token, platform, language, time zone and in-app notification inbox. You can manage notifications through app settings and operating system permissions. We do not send marketing messages.
• Purchases: The Apple or Google store transaction ID and product ID, and the purchase event received from RevenueCat (type, currency, amount and environment). The RevenueCat user ID is your MindoraX account ID. We do not process your payment card data.
• Family feature: Family name, description, icon and color; members' display names, parent/child roles and invitations. Family members can see one another's levels and stars.
• Crash reports: Technical crash data collected through Firebase Crashlytics in published versions of the app. There is no in-app option to turn this off.

When you use the AI coach, your message text is sent to the Google Cloud Vertex AI (Gemini) service to generate a response; we do not store the message text. We keep only the daily request count. The limit is 20 messages per day and 1,000 characters per message. Adding a summary of your game performance from the last 30 days to the coach is optional and off by default. The coach's responses are not medical or psychological professional advice.

We do not collect dates of birth or verify age. We do not use an advertising SDK or analytics SDK (including Firebase Analytics); we do not sell your data or engage in cross-app advertising tracking or profiling for advertising purposes.

3. Purposes and Legal Bases for Processing

We process the data necessary to create and manage accounts, provide sign-in, and deliver game features and purchased content for the performance of the contract. We process relevant data on the basis of legitimate interests to maintain session security, prevent fraud, understand technical failures and improve the service. Where an applicable legal obligation exists, we process the relevant data to meet that obligation.

Adding your 30-day game performance summary to the coach depends on your explicit consent. Your explicit consent to push notifications is obtained through the operating system's permission dialog; you can withdraw this consent at any time in the app settings or device settings.

4. With Whom Do We Share Data?

To provide the relevant parts of the service, data may be shared with or processed through the following parties:

• Google LLC: Firebase Authentication, Firebase Cloud Messaging and Firebase Crashlytics.
• Google Cloud Vertex AI (Gemini): AI coach; the EU region is used.
• RevenueCat: Subscription and purchase management.
• Apple App Store and Google Play: Payments and sign-in through Game Center / Play Games, respectively.
• Cloudflare: DNS, security, proxy and content delivery.
• The hosting provider for our application servers and database.

Because some of these providers may process data outside Türkiye, international transfers may take place. These transfers rely on appropriate safeguards under KVKK (Law No. 6698) and GDPR.

5. Retention and Account Deletion

You can request deletion of your account through the Profile/Settings section of the app or at https://mindoraxgame.com/account/delete/. After a deletion request, sessions are ended immediately; data is deleted at the end of a 30-day waiting period. During this period, you can contact the support team to cancel the request.

During deletion, your account, sessions, settings, devices, game progress, wallet, purchase records and family/invitation data belonging to you are deleted. Your Firebase account is also deleted. Audit records are pseudonymized; game results remain only as anonymous aggregate statistics.

Administrator audit records are kept for up to 730 days, and server logs for up to 90 days. Backup is currently disabled.

6. Your Rights

Under Article 11 of KVKK (Law No. 6698) and, where applicable, GDPR, you can request information about the processing of your data and its recipients; request access to, correction or deletion of your data; request restriction of processing; or object to processing. You can send your requests to [email protected]. The app has no direct data export option; export requests are handled by email.

You can lodge a complaint with the Kişisel Verileri Koruma Kurumu (Turkish Personal Data Protection Authority) in Türkiye, or with the competent data protection authority where you are located in the EU.

7. Age Limit

MindoraX is designed for users aged 13 and over; it is not intended for children under 13. Users under 18 should use it with the permission of their parent or guardian. We do not verify age.