Privacy Policy and Personal Data Notice

Last Updated: 13 / 05 / 2026

Purpose

Folds Dijital Hizmetler Anonim Şirketi ("Folds" or "Company") aims to process users' personal data within the scope of the mobile application named FoldTrace and all related digital services ("FoldTrace" or "Application") in accordance with applicable data protection legislation, general principles regarding the protection of personal data, and data protection law provisions.

This notice regulates obligations under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the European Union General Data Protection Regulation (GDPR 2016/679), and additional rights granted to data subjects, where applicable.

Personal data you have provided to our Company or obtained by our Company through any external method may be processed by Folds, as the data controller:

In compliance with the law and the principle of good faith,
Accurately and, where necessary, kept up to date,
For specified, explicit, and legitimate purposes,
In a manner that is relevant, limited, and proportionate to the purposes for which they are processed,
For the period stipulated in the relevant legislation or required for the purpose for which they are processed

through automated or non-automated means.

In this context, your personal data may be recorded, stored, preserved, reorganized, transferred to third parties domestically or abroad to the extent permitted by law, and subjected to other processing activities stipulated by legislation.

This Privacy Policy has been prepared to explain which personal data is collected, how and for what purposes this data is processed, how it is protected, with whom and under what conditions it is shared, and the rights of data subjects.

Terms written in capital letters in this document and not otherwise defined have the meanings attributed to them in the FoldTrace Terms of Use.

Collection of Personal Data and Methods

Folds may collect your personal data when you use the FoldTrace application, contact us through the application, create an anonymous account, make in-app purchases, participate in the global leaderboard, or use our services; electronically, through mobile devices, by automated or non-automated methods, directly from you or through third-party platforms.

The collected personal data is classified under the following data categories:

Data Categories and Data Types

Profile Information
Anonymous user identifier (Firebase Authentication UID issued automatically on first launch), optional display name (chosen by you, 2-20 characters, Unicode-aware and sanitized), in-app generated handle derived from the anonymous identifier when no display name is set.

Authentication Information
FoldTrace uses anonymous-first authentication. A pseudonymous identifier is issued by Firebase Authentication on your first launch. The Application does NOT require an email address, phone number, or social account to play. Linking to a permanent provider (Sign in with Apple or Google) is a planned future feature and will be presented with a separate, explicit consent flow at the time of linking. On iOS, the anonymous identifier is stored in the iOS Keychain and, as a property of the operating system, may persist across application uninstalls and reinstalls.

Transaction Security and Application Data
IP address (processed transiently by our backend providers for connectivity and security; not stored by Folds in identifiable form), device name, device model, operating system and version, application version, build number, system locale and language, country code, time zone, log records, usage durations, date and time information, IDFA / IDFV (iOS) and AAID (Android) where explicit consent has been provided through the Apple App Tracking Transparency dialog or system-level personalized advertising preferences.

Game and Engagement Data
Levels played and cleared, stars earned per puzzle, time-to-solve metrics, hints used, current and longest perfect-run streak, daily challenge completion state, leaderboard scores (all-time and weekly), in-game currency balances (lives, hints, coins), unlimited-lives buff status, screen views, button taps, soft-prompt responses, and other gameplay analytics events.

Purchase Data
Transaction identifier, product identifier, purchase date, and post-transaction cryptographic receipt for each successful in-app purchase. FoldTrace does NOT receive, store, or have technical access to your payment card number, bank account information, billing address, or CVV. Payment processing is performed entirely by Apple (App Store) or Google (Play Billing) under their respective terms.

User-Generated Content
Free-text feedback messages you voluntarily submit through the in-app "Send Feedback" form. The text you submit, the submission timestamp, and your anonymous identifier are transmitted to our backend at the moment you tap Send.

FoldTrace does NOT request access to your camera, microphone, gallery, contacts, calendar, photos, precise location, or health/fitness data. The Application does not collect audio recordings, images, or video from you.

Users should not share financial information, health data, information about children, or content considered as special category personal data under legislation through FoldTrace.

Purposes and Legal Bases for Processing Personal Data

Your personal data is processed in accordance with the purposes and legal bases specified below.

Processing Purposes

Provision, operation, and improvement of FoldTrace services
Creation and management of anonymous user accounts and (where future linking is enabled) linked accounts
Personalization and improvement of user experience
Conducting customer support, request, and complaint processes
Management of subscription and in-app purchase processes
Operation of the global leaderboard, daily challenge, perfect-daily bonus, and streak tracking features
Ensuring information security, system security, and business continuity
Fulfilling legal obligations and responding to requests from authorized institutions
Detection and prevention of fraud, cheating, abuse of rewarded advertisements, and other prohibited use of the Application
Delivery of rewarded and interstitial advertisements (with applicable consent)
Conducting marketing, analysis, and reporting activities (with explicit consent where required)

Legal Bases

Under KVKK Article 5 and GDPR Article 6, the legal bases for the processing activities above include:

Performance of a contract — for account creation, gameplay synchronization, leaderboard participation, in-app purchase processing, and customer support.
Compliance with a legal obligation — for tax record-keeping of in-app purchases, responses to authorized institutions, and consumer protection requirements.
Establishment, exercise, or defense of legal claims — for retention of transaction records and dispute resolution.
Legitimate interests — for fraud and cheating prevention, security monitoring, crash diagnostics, and aggregate analytics (provided such processing does not override your fundamental rights and freedoms).
Explicit consent — for advertising identifier processing (IDFA / AAID), personalized advertising, and non-essential analytics, where required by legislation.

Cookies and Similar Technologies

FoldTrace is a native mobile application and does not use browser cookies. However, similar identifier-based technologies are used to improve application performance, enhance user experience, and conduct analysis activities:

Local on-device storage (MMKV) for game state, settings, and a cached display name
Apple Identifier for Vendor (IDFV) and Apple Identifier for Advertisers (IDFA) on iOS, where consent is given
Google Advertising Identifier (AAID) on Android, where consent is given
Firebase installation identifier and instance identifier for analytics and crash reporting

These technologies can be managed or disabled through device settings (iOS Settings > Privacy & Security > Tracking / Apple Advertising; Android Settings > Google > Ads).

Push Notifications

FoldTrace may send local notifications, including the optional daily reminder scheduled at 10:00 local time each day to inform you that a new daily set is available. The notification is generated locally on your device and is not delivered through a remote push server; consequently, your push token is not transmitted to us.

Before the operating-system permission dialog is shown, FoldTrace displays an in-app explanation of the reminder feature ("soft prompt") so that you may make an informed decision. You can enable or disable the daily reminder at any time from the in-app Settings screen, or disable all notifications at the operating-system level (iOS Settings > Notifications > FoldTrace; Android Settings > Apps > FoldTrace > Notifications).

Storage of Personal Data

Your personal data is stored for the periods stipulated in the applicable legislation or for as long as required for the processing purpose. When the storage period expires, personal data is deleted, destroyed, or anonymized.

Indicative retention periods:

User profile and leaderboard entries: Retained for the life of your account. Weekly leaderboard entries are retained for the current and previous week, then deleted.
Daily challenge state: Stored only on your device; replaced at local midnight each day (yesterday's state is discarded automatically).
Game progress and settings: Stored on your device. Deleted when you uninstall the Application.
Feedback messages: Retained for up to 24 months after submission, then deleted.
Crash reports: Retained for up to 90 days per Firebase Crashlytics policy.
Analytics events (user-scoped): Retained for up to 14 months on a rolling window.
In-app purchase records: Retained for the period required by applicable tax and consumer protection legislation, generally up to 10 years under Turkish Tax Procedure Law.

Transfer of Personal Data to Third Parties and Abroad

The procedures and principles regarding the transfer of personal data to third parties are regulated in accordance with applicable data protection legislation. Folds Dijital Hizmetler Anonim Şirketi acts in compliance with data protection legislation and regulatory decisions in personal data transfer processes.

Within the scope of the FoldTrace application, servers, data centers, and cloud computing systems located domestically and abroad may be used in accordance with technical infrastructure requirements. In this context, your personal data may be transferred to third-party service providers located domestically or abroad, subject to necessary technical and administrative measures.

Purposes for Transferring Personal Data Abroad

Your personal data may be transferred abroad for the following purposes:

Conducting storage and archiving activities,
Providing and operating information technology infrastructure,
Conducting business activities and ensuring continuity,
Conducting after-sales support services for goods and services,
Conducting customer relationship management (CRM) processes,
Developing technical infrastructure, resolving technical errors and malfunctions,
Measuring, analyzing, and reporting application performance,
Processing and validating in-app purchases,
Detecting and preventing fraud, abuse, and unauthorized use.

Transfer of data abroad is carried out in accordance with applicable data protection laws, including where the data subject has provided explicit consent or where adequate safeguards are in place as required by law (such as Standard Contractual Clauses approved by the European Commission, the EU-US Data Privacy Framework where certified, undertakings under KVKK Article 9, or equivalent mechanisms).

Third-Party Service Providers and Transfer Purposes

Folds may transfer your personal data to the third-party service providers specified below, in a limited and proportionate manner, for the purpose of providing the FoldTrace application safely, effectively, and without interruption:

a) Firebase Authentication (Google LLC)
Used for issuing anonymous user identifiers on first launch, enabling gameplay synchronization and leaderboard participation without requiring email or social login. Data shared: anonymous UID. Reference: https://firebase.google.com/support/privacy

b) Cloud Firestore (Google LLC)
Used as the backend database for user profile records, leaderboard entries (all-time and weekly), device information synchronization, and feedback messages. Data shared: anonymous UID, display name (if provided), score statistics, device metadata, feedback text, and submission timestamp. Reference: https://cloud.google.com/firestore

c) Firebase Analytics (Google LLC)
Used for measuring aggregate engagement, retention, and feature adoption. Data shared: pseudonymous Firebase instance identifier, gameplay event names and parameters, device model, OS version, language, country code, and advertising identifier where consent is given. Reference: https://firebase.google.com/support/privacy

d) Firebase Crashlytics (Google LLC)
Used for crash and exception reporting to enable diagnosis and resolution of defects. Data shared: stack traces, exception details, breadcrumb logs of recent events that preceded the crash, device characteristics, application version. Reference: https://firebase.google.com/support/privacy

e) Google Mobile Ads / AdMob (Google LLC)
Used for delivery of rewarded advertisements (initiated by you in exchange for in-game currency) and interstitial advertisements (shown between gameplay sessions). Data shared: advertising identifier (IDFA on iOS / AAID on Android) where consent has been provided, IP address, device model, OS, and app context. Reference: https://policies.google.com/technologies/ads

f) Adapty (Adapty Inc.)
Used for in-app purchase orchestration, paywall configuration, receipt validation, and fraud prevention across iOS and Android. Data shared: anonymous UID (mapped to the Adapty customer identifier), product identifiers, transaction identifiers, purchase timestamps, store receipts, and device metadata. Adapty does not receive payment instrument information. Reference: https://adapty.io/privacy

g) Notifee (Notifee Limited)
Used for local scheduling of the optional daily reminder notification. The library operates entirely on your device; no data is transmitted to the Notifee provider.

h) Apple Inc. (App Store) and Google LLC (Play Billing)
Used for application distribution and payment processing. We receive only post-transaction metadata (product identifier, transaction identifier, purchase date, cryptographic receipt). We do not receive payment instrument information. References: https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy

Transfer to Third-Party Service Providers and Authorized Institutions

Folds may also transfer your personal data to our Company's service providers and the third-party services embedded in the FoldTrace service (such as those listed above) for the following purposes:

Sharing identity, communication, and transaction security information with authorized public institutions and organizations for conducting activities in compliance with legislation, monitoring and conducting legal affairs, and informing authorized persons, institutions, and organizations,
Sharing identity and communication information for conducting after-sales support services, carrying out business activities, and managing customer relationship management processes.

Security Measures Taken in Transfers

During the transfer of personal data to third parties and abroad:

The principle of data minimization is followed,
Transferred data is kept limited to the processing purpose,
Data processing and confidentiality agreements are concluded with relevant service providers,
Necessary technical and administrative security measures are taken,
Where transfers occur outside the EEA/UK or Türkiye, Standard Contractual Clauses, KVKK Article 9 undertakings, or equivalent safeguards are relied upon.

Technical and Administrative Measures

Folds takes all necessary technical and administrative measures to ensure the confidentiality and security of personal data, including encryption in transit (HTTPS / TLS), encryption at rest for backend storage, access authorization controls, audit logging, regular backups, penetration testing, information security incident management procedures, employee training, and routine review of subprocessor security postures.

Additionally, FoldTrace applies the following application-level safeguards:

Anonymous-first authentication, minimizing personal data collection by design,
Screenshot and screen-recording prevention on the gameplay screen, so that in-progress puzzle state cannot be casually leaked,
Sanitization and validation of display names and feedback messages to mitigate cross-site scripting and injection risks,
Crash-safe wrappers around all native bridges to prevent inadvertent data leakage through error messages.

Age Restriction

FoldTrace is rated for all ages on the Apple App Store (4+) and Google Play (PEGI 3 / ESRB Everyone). However, certain features (such as participation in the global leaderboard, in-app purchases, and personalized advertising identifiers) are not intended for use by persons under the age of 16 without parental supervision.

Users under the age of 16 in the European Economic Area (or the equivalent age threshold in their jurisdiction, including 13 in the United States under the Children's Online Privacy Protection Act, and 18 under Turkish law where parental consent is required) should obtain the consent of their parent or legal representative before using the Application or making any in-app purchase.

Folds does not knowingly collect personal data from children below the applicable age threshold. If you believe a child has provided personal information through FoldTrace without verifiable parental consent, please contact us at the address below and we will delete the information within a reasonable time.

Your Rights as a Data Subject

As a data subject, you have the following rights regarding your personal data by applying to Folds Dijital Hizmetler Anonim Şirketi:

To learn whether your personal data is being processed,
To request information about the processing if your personal data has been processed,
To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
To know the third parties to whom your personal data is transferred domestically or abroad,
To request correction of your personal data if it has been processed incompletely or inaccurately and to request that this correction be notified to third parties to whom personal data has been transferred,
To request deletion, destruction, or anonymization of your personal data if the reasons for processing have ceased to exist in accordance with applicable legislation and to request that these operations be notified to third parties to whom personal data has been transferred,
To object to any result that is against you arising from the analysis of processed data exclusively by automated systems,
To claim compensation for damages if you suffer damage due to unlawful processing of your personal data.

Data Subject Rights Under KVKK

The rights listed above are granted to you as a data subject under Article 11 of the Turkish Personal Data Protection Law No. 6698 ("KVKK"). Applications may be submitted in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller.

Data Subject Rights Under GDPR

Where the General Data Protection Regulation (GDPR) applies, data subjects also have the following rights in addition to the above:

Right of access: To learn whether your personal data is being processed, and if so, to access your personal data and detailed information about its processing,
Right to rectification: To request rectification or completion of your personal data that you believe is incorrect or incomplete,
Right to erasure (Right to be forgotten): To request erasure of your personal data where the conditions stipulated in the GDPR are met,
Right to restriction of processing: To request restriction of processing of your personal data under the conditions stipulated in the GDPR,
Right to object to processing: To object to data processing activities based on legitimate interests,
Right to data portability: To request that your personal data processed by us be transmitted to you in a structured, commonly used, and machine-readable format, or to request transfer to another data controller where technically feasible,
Right to object to profiling and automated decision-making: To object to any result against you arising from data processing activities carried out exclusively through automated systems, including profiling.

Application Procedure

If you wish to exercise your rights as a data subject specified above:

Your request should be clear, understandable, and clearly express the requested right,
If the request relates to you or if you are acting on behalf of another person, you should document this,
Because FoldTrace does not require an email address or other contact information to play, you should be prepared to provide your in-app display name, your anonymous Firebase Authentication UID (visible in the in-app Settings screen), your approximate first-use date, and any other information that will help us verify that the request comes from the legitimate account holder,
You should attach information and documents verifying your identity and submit it to us.

Applications can be made via the email address support@folds.co or through the "Data Subject Application Form" to be provided by our Company. Your applications will be concluded free of charge within 30 (thirty) days at the latest, depending on the nature of the request. If the request is rejected, the reason for rejection will be communicated to you in writing or electronically.

If you believe that your rights regarding the processing of your personal data have been violated, you have the right to lodge a complaint with the Turkish Personal Data Protection Authority (KVKK) or, where applicable, with the competent data protection supervisory authority in your jurisdiction.

Account Deletion

In compliance with applicable platform requirements (Apple App Store guideline 5.1.1(v) and Google Play developer program policies), FoldTrace supports account deletion. When you request deletion of your account, the following will occur:

Your user profile record in our backend database is deleted,
Your all-time and weekly leaderboard entries are deleted,
Your display name and any feedback messages are deleted,
Your anonymous Firebase Authentication identifier is invalidated,
Crash reports and analytics events older than their standard retention period are already removed; remaining records tied to your identifier will be marked for deletion at the next retention cycle,
Purchase records that are legally required to be retained (for tax and audit purposes) will be retained for the period mandated by applicable legislation, with personally identifying fields minimized to the extent permitted by law.

Local game state stored on your device (lives, hints, coins, stars) is not automatically removed. To clear it, you must uninstall the Application. Please note that on iOS, the anonymous Firebase Authentication identifier may persist in the iOS Keychain across uninstall and reinstall as a property of the operating system. To obtain a fresh identifier on iOS, you must erase your device or use Apple's Keychain-clearing controls. Refunds for in-app purchases are governed by Apple App Store and Google Play policies, and should be requested directly from those stores.

To request account deletion, contact us at support@folds.co with the verification information described above.

Scope and Limitations of the Privacy Policy

This Privacy Policy and Personal Data Notice regulates only the procedures and principles regarding the collection, processing, storage, transfer, and protection of personal data within the scope of the FoldTrace application.

This document does not regulate:

General terms regarding the use of the FoldTrace application,
The scope of services provided,
The liability regime regarding gameplay outcomes, in-app purchases, or leaderboard rankings,
Refund policies for in-app purchases (governed by Apple App Store and Google Play store policies),
Mutual obligations of the parties

and these matters are addressed in a separate "User Agreement / Terms of Use" document.

All activities related to the processing of personal data shall be evaluated only within the framework of applicable data protection legislation and the provisions of this Privacy Policy.

Updates

This Privacy Policy may be unilaterally updated by Folds Dijital Hizmetler Anonim Şirketi when deemed necessary due to legislative changes, application updates, or Company policies. The updated text shall enter into force on the date it is published through the FoldTrace application. The User's continued use of FoldTrace after the update means acceptance of the updated text.