Privacy Policy

In short#

Who we are (data controller)#

This policy covers Sushi Belt (Turkish title Suşi Bandı; iOS and Android, package id com.sushibelt.game), a mobile game by Zexus Games, and this website.

Data controller under the GDPR and Türkiye's KVKK (Law No. 6698): Zexus Games, Ahmet Budak (sole proprietorship), Akşehir / Konya, Türkiye. Contact: support@zexusgames.com.

What data we process#

The table below shows what the game keeps and where, what we use it for, and the legal basis we rely on (the legal bases are explained below).

We recommend not using your real full name as a nickname. Names pass a simple on-device filter for inappropriate words. Your nickname and avatar are also saved in your cloud profile.

• When is the cloud written to? When the app starts, when a level ends (at most about once a minute) and when you make a purchase.
• Who can see it? Only the developer (a single allowlisted admin account) can read profile data. Players cannot see each other's data.
• Internet connection: The game is free and supported by ads, so levels start while you are online. To check this, the app only asks your device's operating system whether it is connected.
• Store statistics: Apple (App Store Connect) and Google (Play Console) show us their own statistics, such as download numbers and crash reports (from users who chose to share data with developers in their device settings). This is governed by Apple's and Google's own policies.

What we use it for#

• Running the game: keeping your progress, delivering what you bought, applying age-appropriate ad settings.
• Balancing and improving the game: looking at aggregate statistics in a private admin dashboard to find levels that are too hard or dull and to tune the game economy.
• Fixing bugs: using crash reports to find problems.
• Funding a free game: showing ads and processing purchases.
• Security and fraud prevention: blocking fake purchases and abuse.
• Support: answering your questions and requests.

We don't sell your data, and we don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

Legal bases#

We process your data on the following bases under Article 6 of the GDPR (if you are in Europe) and Article 5 of the KVKK:

• Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)): providing the game, keeping your progress, delivering your purchases, answering support requests.
• Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)): balancing the game with aggregate statistics, fixing crashes, preventing fraud, keeping the game free with non-personalised ads. We make sure these don't override your fundamental rights and freedoms, and you have the right to object.
• Consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)): personalised ads, access to the advertising identifier (IDFA) on iOS, and usage analytics where the law requires consent. You can withdraw consent at any time; this doesn't affect processing before you withdrew it.
• Legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)): for example keeping purchase-related records for as long as the law requires and responding to requests from competent authorities.

Ads (Google AdMob)#

Ads in the game are served by Google AdMob (Google LLC / Google Ireland Ltd.). There are two kinds:

• Rewarded ads: always optional; you tap a button labelled “Ad” to watch one for a bonus. Skip them and you lose nothing.
• Interstitial ads: shown only between levels, after a win, and capped; never in the middle of a level. The “No Ads” purchase turns interstitials off.

To serve ads, Google may process information such as your IP address, device and operating system details, approximate location (country/city level), advertising identifier (Android Advertising ID; on iOS the IDFA only if you allow it), ad interactions and diagnostics. We do not see this data; we only see counts such as how many ads were watched. You can read how Google uses it in How Google uses information from sites or apps that use its services and the Google Privacy Policy.

Ad settings by age range

The age range you chose on first launch is applied to every ad request as follows. The age range itself is not added to ad requests; only these settings are passed to Google. Personalised ads are shown only to players aged 16 or over, and only with their consent.

Consent and your choices

• EEA, UK, Switzerland and wherever else the law requires it: Google's consent form (UMP) is shown. If you don't consent, you only get non-personalised ads. In these regions you can change your choice later via the privacy options in the game's settings.
• iOS: Apple's App Tracking Transparency (ATT) prompt asks before the advertising identifier (IDFA) is used. If you tap “Ask App Not to Track”, the IDFA is not used. You can change this under Settings > Privacy & Security > Tracking.
• Android: you can delete or reset your advertising ID under Settings > Google > Ads (or Privacy > Ads).
• Non-personalised ads may still use context (such as device language and approximate location) and process data for frequency capping and fraud prevention.
• You can also manage Google's ad settings in My Ad Center.

If we ever add an ad partner other than AdMob, we will update this policy first.

In-app purchases#

• Purchases are made entirely through the Apple App Store or Google Play and follow their terms. Apple and Google process the payment; your card number, billing address and store account details never reach us or RevenueCat.
• To verify purchases, deliver items and manage subscriptions we use RevenueCat (RevenueCat, Inc., USA). RevenueCat processes the store receipt and transaction data, the product, price, currency, purchase date and a random, anonymous app user id (this may be your anonymous Firebase player id).
• The app also keeps the purchase record on your device; the number of purchases and the amount reported by the store are added to your cloud profile for statistics.
• Subscriptions such as the “Sushi Club” are managed and cancelled in your store account.
• You can turn off purchases completely in your device settings (iOS: Screen Time > Content & Privacy Restrictions; Android: Play Store > Settings > Authentication).

Notifications#

• The game only uses local notifications: reminders are scheduled on your device. We have no notification server, and your device's push token is never sent anywhere.
• Permission is requested after you pass level 3: first with the game's own short question, then with the operating system's dialog. If you don't allow it, no notifications arrive.
• At most one reminder a day, never between 22:00 and 09:00. You can switch each kind off in the game's settings, or all of them in your device settings.

Sharing, invites and ratings#

• Share buttons open your operating system's own share sheet with a short text and a store link. We don't see what you share, with whom, or through which app.
• Invite a friend works only with codes that players pass to each other themselves. We never access your contacts.
• When the game asks for a rating, Apple's or Google's own review dialog is used; your review goes to the store.

Service providers and third parties#

We work with the following service providers to run the game. We share your data with them only for the purposes described in this policy and only as much as needed. Each has its own privacy policy:

• Google Firebase (Google LLC / Google Ireland Ltd.): Anonymous Authentication, Cloud Firestore, Google Analytics for Firebase, Crashlytics. Firebase privacy and security · Google Privacy Policy
• Google AdMob (Google LLC / Google Ireland Ltd.): ads and the consent form (UMP). How Google uses information from apps that use its services
• RevenueCat (RevenueCat, Inc., USA): in-app purchase and subscription management. RevenueCat privacy policy
• Apple (App Store, payments, ATT, App Store Connect statistics). Apple privacy policy
• Google Play (payments, Play Console statistics). Google Privacy Policy

Apart from these, we only share your data when the law requires it (for example at the request of a competent authority).

International transfers#

Google and RevenueCat may process data on servers in the United States, the European Union and other countries. This means your data is transferred outside Türkiye (and outside the EU, if you live there).

We aim to base these transfers on the safeguards set out in Article 9 of the KVKK and Chapter V of the GDPR, such as standard contracts / standard contractual clauses and the commitments in our providers' data processing terms. Write to us if you want to know which safeguard applies.

Retention#

• Data on your device: as long as the app is installed.
• Cloud player profile (Firestore): kept while you use the game and deleted on request. We also plan to delete profiles automatically after a long period of inactivity (e.g. 12 months).
• Usage analytics: kept according to our Google Analytics retention setting (e.g. 14 months), then deleted by Google.
• Crash reports: kept by Firebase Crashlytics for about 90 days.
• Anonymous aggregate counters: may be kept indefinitely, as they identify no one.
• Purchase records: as long as needed to manage purchases and subscriptions, and for as long as the law requires.
• Support e-mails: deleted within a reasonable time after your request is resolved.

Deleting your data#

• Data on your device: uninstall the app. On Android you can also use Settings > Apps > Sushi Belt > Storage > Clear data. Device backups (iCloud, Google backup) may contain a copy of app data; these are managed in your Apple/Google account.
• Cloud profile and analytics data: write “Please delete my data” to support@zexusgames.com. If the game's settings show your player id, include it; if not, tell us your nickname, platform (iOS / Android) and roughly when you installed the game so we can find your profile.
• What we do: within 30 days we delete your profile from Firestore and request deletion of your data in Google Analytics. Records we must keep by law (e.g. purchase records) may be kept until that period ends.
• Deleted progress cannot be recovered. One-time purchases (e.g. “No Ads”) can be restored with the same store account via Restore purchases in the game's settings.
• For data processed by the ad partner, use Google's tools (e.g. resetting your advertising ID, My Ad Center).

Children's privacy#

Sushi Belt has content suitable for all ages, but it is not specifically marketed to children. The game is open to everyone and no features are restricted for any age group.

• The age question is neutral; no option is pre-selected. Until it is answered, the game treats the player as under 13.
• For players under 13 (and those who haven't answered yet) usage analytics (Google Analytics) is switched off completely.
• For these players, ad requests are tagged as child-directed; only non-personalised, general-audience (G) ads are requested, and the advertising identifier is not used for ad personalisation.
• To be clear: an anonymous player profile is also created for players under 13, and the nickname, avatar, age range, progress and counters are saved to Firestore for statistics. Crash reports are collected from all players. This data contains no e-mail, real name or contact details.
• Purchases require the store's password / Face ID / Play authentication. Parents can turn purchases off in the device settings.
• Parents can ask us to delete their child's data using the steps above. If you believe a child has sent us personal information by e-mail, contact us and we will delete it.

Your rights (GDPR, KVKK and others)#

Under Article 11 of Türkiye's Personal Data Protection Law No. 6698 (KVKK) you have the right to:

• learn whether your personal data is processed,
• request information about it if it is,
• learn the purpose of processing and whether it is used for that purpose,
• know the third parties in Türkiye or abroad to whom it is transferred,
• ask for it to be corrected if it is incomplete or inaccurate,
• ask for it to be erased or destroyed under the conditions of Article 7 of the KVKK,
• ask for corrections and deletions to be notified to the third parties it was transferred to,
• object to an outcome against you that results solely from automated analysis of your data,
• claim compensation if you suffer damage because of unlawful processing.

If you are in the European Economic Area or the United Kingdom, under the GDPR you also have the right to access, correct and erase your data, to restrict processing, to data portability, to object to processing (especially processing based on legitimate interests) and to withdraw your consent at any time. Depending on where you live (for example under US state laws), you may have similar rights.

Write to support@zexusgames.com with your request; we will reply within 30 days at the latest. We may ask for extra information, such as your player id, to verify your identity. If you are not satisfied with our answer, you can complain to Türkiye's Personal Data Protection Authority (KVKK) or the data protection authority in your country.

This website#

This site uses no cookies and no analytics or tracking tools. Fonts are served from this site too, so no request goes to a third party. Your light/dark theme and interface sound choices are stored only in your browser. The contact form and the "Tell me at launch" button send and store nothing: they only open your mail app with a ready-made text; e-mails you send us are handled as described above. The hosting provider may keep standard server logs (IP address, requested page, time) for security and operations.

Changes#

When we add a new service provider to the game or a new field to the data we process, we update this policy beforehand. The 19 October 2026 update added Firebase (anonymous id, cloud profile, usage analytics, crash reports), Google AdMob ads and RevenueCat. We announce important changes in the game or on this page. The “Effective date” at the top shows the latest update.

Contact#