peaky numbers

Privacy Policy

Last updated: 25 October 2026 · This English translation is for information; the Turkish text is the official version.

This Privacy Policy explains how your personal data is processed when you use the Peaky Numbers mobile game and this website. The statutory notice for users in Türkiye is also available as the Personal Data Notice (KVKK).

1. Data controller

Seven's Design (Ayşenur Seven, sole proprietorship), Türkiye. Email: developer@sevensdesign.com

2. In short

  • We only process the data needed to run the game, manage your account, verify your subscription and prevent cheating.
  • No ads, analytics or tracking tools. We do not use the advertising ID.
  • We do not sell your data.
  • Your email address and unique username are never shown to other players.
  • Your card or bank details never reach us; Google Play takes the payment.
  • You can delete your account and data in the app at any time.

3. What data we process

Account data (Sign in with Google)

Your Google account email address, your Google account ID and the random user ID (UID) created for your account. When you sign in with Google, Google also passes the name and profile photo link of your Google account to the sign-in record (Firebase Authentication); we do not show them in the game or use them for anything else.

Guest account (once available)

You can play as a guest without linking a Google or Apple account. No email or name is collected for a guest account; Firebase Authentication creates a random user ID (UID) and your game data is stored under it. A guest account is tied to the app on that device: if you uninstall the app or change device without linking, you cannot access your data again. If you later link your account with Google (or Apple on iOS), the same ID is kept and the account data below is added. To prevent abuse, coins earned as a guest collect in a capped "piggy bank" and are credited when you link your account; starting and referral rewards are only given to linked accounts.

Sign in with Apple (once available with the iOS version)

If you sign in with Apple, we process the user ID issued by Apple, your email address or the relay address Apple creates with "Hide My Email", and your name if you choose to share it at first sign-in. The relay address is also personal data; Apple forwards emails sent to it to you.

Profile data

The display name and unique username you choose, your invite setting, who referred you, your friends list, how many times you changed your name and, if you are a Premium member, the profile photo you upload.

Game data

Your guesses, match and daily puzzle results, times, points, weekly points, coins, streaks and statistics, badges, leaderboard positions, and the invites you send and receive.

Quick messages and emotes (once available)

Once a feature becomes available that lets you send your opponent messages or emotes chosen only from a predefined list during matches, we process the sender's and recipient's user IDs, the match ID, the ID of the chosen message and the time it was sent. Free text cannot be entered, so the content is always one of the predefined phrases.

Report and block records

When you report a player in the app: your user ID and the reported player's user ID, the reason (name, profile photo or other), a copy of the reported player's display name and profile photo link at that moment (so it can be reviewed even if it changes later) and the date. When you block a player: the blocked player's ID, a copy of their display name (to show in your block list) and the date. The reported player is never told who reported them.

Subscription data

If you buy Peaky Premium or (once available) a coin pack: the purchase token issued by Google Play, order number, product, subscription status and expiry date. During the purchase your random user ID (UID) is passed to Google Play so that the subscription is linked to the right account. We never see card, bank or billing details.

Technical data

When the app connects to our servers, the Google infrastructure that runs the service processes your IP address, app/SDK version information (user agent), request times and error logs for security, abuse prevention and debugging. When you visit this website, the hosting service also processes your IP address to deliver the page (Hostinger for sevensdesign.com/peakynumbers, Firebase Hosting for peaky-numbers.web.app).

App integrity check

To make sure requests to our servers only come from the genuine, unmodified Peaky Numbers app installed from Google Play, the app uses Firebase App Check with Google Play Integrity to verify the integrity of the app and device. During this check, app and device integrity information and the user agent (app, SDK and operating system version) are sent to Google; we only receive a short-lived verification token. Your account details and device ID are not used for this check. Legal basis: our legitimate interest in keeping the system secure and preventing abuse.

Data that stays on your device (local storage)

Your language, theme, sound, colour-blind mode, animation and auto-submit preferences, an unfinished solo game and your solo average are stored only on your device and are not sent to us. They are removed when you uninstall the app.

What we do not collect

Location, contacts, your photo library as a whole, microphone, camera recordings, advertising ID, device identifiers, browsing history or card details. The photo picker opens only when you choose to upload a profile photo, and only the photo you pick is uploaded. Neither the app nor this website uses cookies.

4. Why we process data and on what legal basis

  • Creating your account, running the game, showing leaderboards and statistics, providing invites and Premium benefits: performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
  • Delivering and showing quick messages (once available) to your opponent: performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)). Rate-limiting these messages, preventing annoying use and reviewing reports: our legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
  • Verifying the subscription with Google Play, handling renewals and refunds: performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
  • Reviewing reports, removing content that breaks the rules and applying your block choices: our legitimate interests and players' safety (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)); applying a block is performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
  • Providing guest accounts, linking them later and preventing reward farming with guest accounts (once available): performance of a contract and our legitimate interests (KVKK Art. 5(2)(c), (f); GDPR Art. 6(1)(b), (f)).
  • Flagging unusual daily puzzle results (for example, solving on the first guess) for review as suspected cheating: our legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)). The flag is set automatically but never leads to a sanction on its own; a person reviews it and decides, and you can appeal.
  • Preventing cheating, reward farming with fake accounts and abuse, keeping systems secure, debugging: our legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)), namely offering fair competition and a secure service.
  • Legal obligations (for example tax records, requests from competent authorities): legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)).
  • Defending our rights in disputes: establishment, exercise or defence of legal claims (KVKK Art. 5(2)(e); GDPR Art. 6(1)(f)).

We do not rely on your consent to process your data, and we do no marketing, profiling or automated decision-making. Game results and matchmaking are calculated by the game rules on the server; this is not an automated decision producing legal effects concerning you.

5. What other players can see

  • Everyone (signed-in players): your display name, points, weekly points, number of wins and matches, Premium/VIP status, your profile photo if you are a Premium member, and your daily puzzle results (number of guesses, time).
  • Your opponent in a match: your name in the match and the score; in Adrenaline mode and sudden death, the order of your guesses and their +/− results. Your opponent never sees the digits you guess or your secret number. Once the quick-message feature is available, your opponent also sees the quick messages you send during the match; you can hide opponents' messages in Settings.
  • Your unique username is not shown, but anyone who knows it can send you an invite. You can turn this off in Settings › Receive in-game invites.
  • Your email address is never shown to any player.

6. Who we share data with

  • Google (service provider / processor): the game runs on Google Firebase and Google Cloud services (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Firebase Hosting, Cloud Logging). Google processes this data only on our behalf and on our instructions, under Google's data processing terms. All data, including profile photos, is stored in data centres in the European Union (Belgium, europe-west1 region).
  • Google Play (independent controller): purchases and payments are handled by Google Play under the Google Privacy Policy. We only query Google Play for the purchase status to verify your subscription.
  • Apple (independent controller, with the iOS version): Apple's authentication and "Hide My Email" relay service for Sign in with Apple, under the Apple Privacy Policy.
  • Competent public authorities: only where required by law and upon a request from a competent authority.

We do not share your data with anyone else, and we do not sell it.

7. International transfers

Because our service provider Google stores data outside Türkiye (in the EU), your data is transferred abroad. As the Turkish Board has not yet issued an adequacy decision for EU countries, this transfer relies on the standard contract announced by the Turkish Personal Data Protection Board, one of the appropriate safeguards in Article 9 of Law No. 6698: the Turkish standard contractual clauses that Google offers to customers in Türkiye under its Google Cloud Data Processing Addendum apply, and the contract is notified to the Board within the period required by law. For users in the EU, data is processed within the EU; any access by Google from outside the EU for support and maintenance is covered by Google's EU Standard Contractual Clauses and its certification under the EU–US Data Privacy Framework. Once Sign in with Apple is available, sign-in data processed by Apple is processed on Apple's servers in various countries, including the US.

8. How long we keep data

  • Account, profile, game and subscription data: until you delete your account. It is deleted immediately when you delete your account (details).
  • Guest accounts (once available): unlinked guest accounts that are not used for 30 days are deleted automatically with their data.
  • Daily puzzle sessions and leaderboards: deleted automatically after 30 days.
  • Quick-message records (once available): up to 30 days from sending; the messages you sent are deleted when you delete your account.
  • Report records: up to 90 days; after that they are deleted regardless of review status. If you delete your account, records in which you are the reporter or the reported player are deleted immediately.
  • Block records: until you unblock the player or delete your account. When your account is deleted, copies of your name in other players' block lists are deleted too.
  • Match records: when you delete your account, your guesses are deleted and your name is changed to "Deleted player"; the match result stays in this form for your opponents' history.
  • Email hash of a deleted account: a one-way hash (SHA-256) of the email address and the deletion date are kept to prevent abuse.
  • Technical logs: up to 30 days.
  • Tax and accounting records (Google Play earnings reports): for the period required by tax law (generally 5 years).

9. Security

All connections are encrypted (HTTPS/TLS). Game logic runs on the server; the app cannot write to the database directly, and each player can only read their own data or public information. Secret numbers and private data are never sent to the app. Data is accessed only by authorised persons and only when needed to operate the service. If a data breach occurs, we will notify the authorities and affected users as required by law.

10. Your rights

Under KVKK Article 11 and, if you are in the EU, the GDPR, you have the right to know whether your data is processed, to request information and a copy, to rectification, erasure, restriction of processing and objection, to receive your data in a structured format (portability), to know the third parties it is transferred to, to object to an adverse outcome resulting from analysis by automated systems, and to claim compensation for damage caused by unlawful processing.

  • How to apply: write to developer@sevensdesign.com from the email address linked to your account. We will respond free of charge within 30 days at the latest. Guest accounts have no email, so we cannot verify your identity by email; you can delete a guest account in the app or write to us quoting the account ID shown in Settings.
  • You can also delete your account and data yourself in the app.
  • If your request is rejected, if you find our answer insufficient or if we do not answer in time, you can complain to the Turkish Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of your application. If you live in the EU, you can also lodge a complaint with the data protection authority in your country.

11. Children

The game is not directed at children under 13, and we do not allow children under 13 to create an account. If we learn that we are processing data of a child under 13, we will delete the account and its data. Parents can contact us at developer@sevensdesign.com. Users under 18 should use the game with the knowledge and permission of a parent or guardian. Users creating a guest account give the same age confirmation and confirm they have read the KVKK notice.

12. Changes

When we update this policy, we publish the new version on this page and change the "Last updated" date. We announce important changes in advance in the game or by email.

13. Contact

Seven's Design (Ayşenur Seven) · developer@sevensdesign.com