Privacy Policy

Data controller

The data controller is Okan Can Bolayır. For privacy questions and requests write to privacy@lootmastergame.com.

Playing on your device and online features

The game needs an internet connection: it does not start without one, and your account and progress are kept on our game server. Your device keeps only a copy and your settings.

To run the game and its online features (your account, guilds and chat, the Arena, leaderboards, purchases and the Premium subscription), the data below is processed on our game server.

Data we process

Account and device ID

• What: your account number, a random device ID created by the game on your device, a one-way hash of the device secret, and the times your account was created and last signed in. We do not use the advertising ID (IDFA or GAID).
• Why: to sign you in and link your account to your device. Legal basis: performance of our contract with you (KVKK art. 5/2-c, GDPR art. 6/1-b).

Game data

• What: your progress, items, currencies and in-game mail, your age group, your privacy choices, and your monthly spending total (used for the spending limit for players under 18).
• Why: to run the game and to protect younger players. Legal basis: performance of our contract and compliance with our legal obligations (KVKK art. 5/2-c and 5/2-ç, GDPR art. 6/1-b and 6/1-c).

Game activity log

• What: the game actions you take (for example opening a chest) and their results and times.
• Why: to prevent cheating and abuse, find errors and help you when you contact support. Legal basis: our legitimate interests (KVKK art. 5/2-f, GDPR art. 6/1-f).

Guilds and chat

• What: guild names and descriptions, guild membership and contributions, chat messages (guild, World and Server chat) with the name or tag shown next to them, reports you send, the players you block, and moderation actions such as a chat mute.
• Who sees it: anyone can see guild names and descriptions. Guild chat is seen by your guild members, World chat by players on every server, and Server chat by players on your server. System messages in chat may show your name (or your tag) when you find a rare item. There are no private messages. Messages pass through a word filter. Players under 13, and players who have not chosen an age group, cannot write in chat. World and Server chat open for writing a little after you start playing, to keep out spam.
• Why: to provide guilds and chat and to keep chat safe (handling reports, stopping harassment). Legal basis: performance of our contract and our legitimate interests (KVKK art. 5/2-c and 5/2-f, GDPR art. 6/1-b and 6/1-f).

Arena and leaderboards

• What: a player tag made from your account (not your real name), your Arena rating, wins and losses, Power, highest stage and your defending hero's equipment. Other players can see these.
• Why: to match you with opponents and show rankings. Legal basis: performance of our contract (KVKK art. 5/2-c, GDPR art. 6/1-b).

Purchases

• What: the store (Apple or Google), transaction number, product, reference price, date and refund status. Your payment details (such as your card) stay with Apple or Google and never reach us.
• Why: to deliver what you bought, handle refunds and keep the records that tax law requires. Legal basis: performance of our contract and compliance with our legal obligations (KVKK art. 5/2-c and 5/2-ç, GDPR art. 6/1-b and 6/1-c).

Connection data

• What: your IP address and the time and address of each request to our server.
• Why: to keep the server secure and running and to limit abuse. Legal basis: our legitimate interests (KVKK art. 5/2-f, GDPR art. 6/1-f). We do not work out your location from your IP address.

Error reports

• What: when the game runs into an error, it sends us the type of error, where it happened in the game's code, the game version, the platform and the operating system version. Reports do not contain your account, your device ID or anything you typed, and we do not store your IP address with them.
• Why: to find and fix errors and crashes. Legal basis: our legitimate interests (KVKK art. 5/2-f, GDPR art. 6/1-f).

Premium subscription

• What: if you subscribe to Premium, the store (Apple or Google), the subscription's transaction number (on Google Play also its purchase token), the product, the subscription status (for example active, in a grace period, expired, refunded or paused), the end of the current period, whether it renews automatically and when its status last changed. Apple and Google tell us about renewals, cancellations and refunds, and we ask them for the current status. Other players can see that you have Premium (a name frame and a badge). Your payment details stay with Apple or Google.
• Why: to turn Premium on and off at the right time, handle renewals, cancellations and refunds and keep the records that tax law requires. Legal basis: performance of our contract and compliance with our legal obligations (KVKK art. 5/2-c and 5/2-ç, GDPR art. 6/1-b and 6/1-c).

Cheat protection and device check

• What: our server compares your game actions with limits that honest play cannot exceed (for example how many chests are opened or how much gold is earned in an hour). If an account goes over a limit we record the time, the kind of check, the measured value and the limit, and mark the account. The game also asks Apple (App Attest) or Google (Play Integrity) to confirm that it is the unmodified game on a genuine device: on iOS we keep a key ID and a public key that your device created for the game and a counter, and on Android our server asks Google to read the result. We keep only the result and the time of the last successful check. We do not scan your device or the apps on it.
• Why: to keep play fair and protect the game and its rankings. A marked account can keep playing: it is left out of the Arena, leaderboards and the Power League until we check it, and only an action that is clearly impossible is refused. If you think your account was marked by mistake, write to privacy@lootmastergame.com and a person will review it. Legal basis: our legitimate interests (KVKK art. 5/2-f, GDPR art. 6/1-f).

In-game offers

• What: when the game shows you an offer (for example the Weekly Deal or a welcome-back pack), we record that it was shown, whether you tapped it and whether you bought it, with the offer, its reference price, your day in the game and your Vault level. Offers are chosen by the game's rules from your progress in the game, not from information about you from outside the game.
• Why: to see how well our offers work and improve the shop, and to help you when you ask about an offer. This analysis runs only on our own server and is not shared with advertising or analytics companies. Legal basis: our legitimate interests (KVKK art. 5/2-f, GDPR art. 6/1-f).

Data that stays on your device

• Your save, its backups and your settings are kept on your device.
• Only if you allow it (players aged 16 and over), the game keeps a log of game events on your device to help us balance the game. This log is not sent to us. You can withdraw your permission at any time in Settings » Privacy choices.

Support messages

• If you email us, we process your email address and your message to answer you. Legal basis: our legitimate interests and, for requests about your rights, our legal obligations.

Data we do not collect

• Your name, phone number or postal address, or your email address unless you write to us.
• Your location, contacts, photos, camera or microphone.
• The advertising ID. We use no advertising tools and no third-party analytics, tracking or crash reporting tools, and we do not track you across other apps or websites. Error reports (see above) go only to our own server.
• Your payment card details.

Who we share data with

• Our hosting provider, DigitalOcean, LLC, which runs our servers in Germany (Frankfurt). It acts as a data processor and only on our instructions.
• Cloudflare, Inc.: runs the DNS of our domain and hosts our web pages, protects connections to the game server against attacks (it processes your IP address to do this) and forwards emails you send us to our inbox. It acts as a data processor.
• Apple and Google: we ask their stores to confirm your purchases and the status of your Premium subscription, and their stores notify us when a subscription renews, ends or is refunded. On Android we ask Google to read the result of the Play Integrity check. Their own privacy policies apply to the payments and checks they process.
• Other players: guild names and descriptions, your chat messages (to your guild, or to the players in World and Server chat), and your Arena tag and results.
• Authorities, when the law requires it.

We do not sell your data and we do not use it for advertising.

International transfers

Our servers are in Germany (Frankfurt). If this is outside Türkiye, your data is transferred under the safeguards of KVKK art. 9, such as the standard contracts announced by the Personal Data Protection Board. For players in the EU, transfers rely on the safeguards in Chapter V of the GDPR.

How long we keep data

• Account, game data, activity log, guild and Arena data: until you delete your account.
• Chat: the game shows only the latest messages. Our moderation copy of chat messages is kept for 90 days, or until you delete your account if that comes first. A reported message stays in the report record until the report is closed, and its text is removed if the sender deletes their account.
• Purchase records: when you delete your account they are separated from it, made anonymous and kept for the period required by tax and accounting law.
• Premium subscription records: like purchase records, they are separated from your account when you delete it, made anonymous and kept for the period required by tax and accounting law.
• Cheat protection records, device check keys and in-game offer records: until you delete your account.
• Server access logs (IP address): up to 14 days.
• Error reports: grouped by error, kept for up to 90 days after the error was last seen.
• Backups: deleted data drops out of our backups within 14 days at the latest.
• A record that an account was deleted (the account number and the time) is kept to prove the deletion.

Deleting your account and data

You can delete your data at any time in the game: Settings » Account » Delete my data. If you have an online account, it is deleted from our server too. If you cannot open the game, follow the steps on Delete your account.

Children

When it first starts, the game asks for your age group, with no answer selected in advance. For players under 13, writing in chat and the optional event log are off and a monthly spending limit applies. Players under 18 also have a monthly spending limit. Players under 16 are not asked for optional permissions.

If you are a parent and want information about your child's data or want it deleted, write to privacy@lootmastergame.com.

Your rights

Under KVKK art. 11 and the GDPR you have the right to know whether your data is processed, to get information about it and a copy of it, to have it corrected or deleted, to object to or restrict its processing, to data portability and to withdraw your consent.

Send your request to privacy@lootmastergame.com. So that we can find your account, include the Player ID shown in Settings. We answer within 30 days at the latest.

You can also complain to the Personal Data Protection Board in Türkiye or to the data protection authority of your country in the EU.

Security

The connection between the game and our server is encrypted (HTTPS and WSS). The device secret is stored on the server only as a one-way hash. Administrative access is limited and logged. If a data breach happens, we notify the authority and the affected players within the legal time limits.

Changes to this policy

If we change this policy, we publish the new version with a new effective date on this page and announce important changes in the game.

Contact

Okan Can Bolayır. Email: privacy@lootmastergame.com. For help with the game see Support.