LEGALCombo Chain Blast
TR EN
Legal

Privacy Policy

What data we process and why, how long we keep it, and how to exercise your rights.

Last updated: 12 October 2026

01Controller and contact

Data controller
Arda Moustafa
Service address
Istanbul, Türkiye
Privacy/support email
ardamoustafa@hotmail.com
EU/UK representative
Appointed and disclosed here by the publisher where required

This policy covers Combo Chain Blast on iOS and Android. The game does not require registration with a name, email or phone number. It creates a random anonymous Supabase user ID for cloud-save and live-service features.

02Data we process

2.1 On-device game data

The active-board checkpoint, score, moves, upgrades, Chips, relics, daily history, settings, consent choices and pending replay frames are stored in the app sandbox using MMKV/SecureStore. Settings → Reset progress erases them. Store-backed purchase entitlements are retained because they belong to your store account.

2.2 Supabase live services — functionality and security

Launch cloud synchronization, leaderboards, daily play and sharing send: a random user UUID and session token; default display name, score, moves, lines and best chain; daily date/seed/trophy or weekly period; active checkpoint, Chip/upgrade/relic/cosmetic progress, notification preferences, and a random installation ID for conflict resolution (privacy consent/settings and replay frames are excluded from cloud save); up to 240 compressed 8×8 board frames for a shared run; and route, time bucket and count for abuse prevention. These support leaderboards, daily validation, real replay pages, anti-cheat and rate limiting. The legal bases are contract performance (GDPR Art. 6(1)(b)) and legitimate interests in security (Art. 6(1)(f)). Anyone with an unguessable replay link can view that replay for 90 days; no name or email is embedded.

Retention: replays 90 days, leaderboard/daily scores 400 days, rate-limit records 1 day, and ad-verification sessions no longer than 30 days; cloud save remains until account deletion. Settings → Delete my server data immediately removes the anonymous Auth account, cloud save, reward sessions, weekly/daily scores and replays. This does not remove store purchase records or consent-based data held separately by other providers.

2.3 Google AdMob — rewarded advertising

After reading consent state, the AdMob SDK starts at launch. A real rewarded ad loads only after the player presses a reward button, using a short-lived, reward-specific server-verification session. Google may process advertising ID (IDFA/AAID), IP-derived coarse location, device/OS and diagnostic information, and ad interactions for delivery, measurement, frequency capping and fraud prevention. The SSV callback processes the anonymous user UUID, reward session ID and unique ad transaction so a reward can only be claimed once. Watching a rewarded ad is optional. Personalisation requires UMP/ATT consent; otherwise the app requests a non-personalised ad. Google: https://business.safety.google/privacy/

2.4 PostHog analytics — OFF by default

If enabled in Settings, in-game events (run start/end, score, moves, lines, chain, relic, onboarding and session length) and an SDK-generated random analytics ID go to PostHog's EU region. No name/email is assigned, identify() is never called, and screen/session recording is off. The legal basis is consent; switching it off stops collection. PostHog: https://posthog.com/privacy

2.5 Sentry errors/performance — OFF by default

If enabled, stack traces, error context, app/OS version and device model may be sent; performance traces are sampled at 10%. The SDK does not attach a user, cookies, headers, screenshots or view hierarchy (sendDefaultPii: false). Network providers can technically see the connection IP; IP storage must also be disabled in the Sentry project. The legal basis is consent. Sentry: https://sentry.io/privacy/

2.6 Purchases — Apple/Google and RevenueCat

Payment occurs in the store; we never see card data. RevenueCat processes a random app user ID, platform/device data, product and purchase/entitlement history to validate and restore purchases. The legal basis is contract performance. RevenueCat: https://www.revenuecat.com/privacy/

2.7 Notifications — only if you allow them

We do not ask for notification permission when the app opens; the system prompt appears only when you choose to turn notifications on. If you allow them:

  • On-device reminders (daily board, streak, welcome back, season and event dates) are scheduled entirely on your phone; no data is sent to our servers for them.
  • For remote notifications (duel results, "your turn", being passed on the weekly leaderboard, season announcements) we store your device's Expo push token, anonymous user UUID, app language, time zone (so we never notify between 10 PM and 9 AM), app version, platform, notification category choices and last-seen time in Supabase. Notifications are delivered through the Expo push service (Expo, 650 Castro St, Mountain View, USA) to Apple Push Notification service or Firebase Cloud Messaging. Delivery records are kept to enforce frequency limits and prevent duplicates.

Marketing/offer notifications are a separate choice and off by default. You can turn each category off in Settings → Notifications and withdraw the permission entirely in iPhone Settings. The legal basis is consent (GDPR Art. 6(1)(a)). Retention: device registration 180 days after last seen, disabled registrations 30 days, delivery records 30 days. Delete my server data also deletes your push registration and delivery history immediately. Expo: https://expo.dev/privacy

03Sharing, security and international transfers

Data is disclosed only to the providers above for the stated purposes and is not sold. All network traffic uses TLS. The Supabase token is held in SecureStore on iOS/Android and browser local storage on web. Supabase/PostHog should use EU regions; SCC/adequacy safeguards must be assessed for providers transferring data elsewhere.

04Rights and deletion

For GDPR/UK GDPR rights of access, correction, deletion, restriction, portability, objection and consent withdrawal, email ardamoustafa@hotmail.com; requests are answered within 30 days. Anonymous live-service data can be erased directly with Delete my server data. Reset progress erases device data. Ad consent is under Settings → Ads and tracking; analytics/crash consent is under Settings → Privacy. California residents may request disclosure or deletion and opt out of sale/sharing; we do not sell personal information.

05Children

The game is not directed to children under 13. Child-directed ad treatment is off and ad content is capped at G. Data known to belong to a child under 13 is deleted.

06Changes and complaints

Material changes are announced in-app and this date is updated. You may complain to your local data-protection authority (the ICO in the UK).