Privacy Policy
Effective {{EFFECTIVE_DATE}} · Version 1.0
We collect what IDOL CLUB needs to run a live social game: your account, progress, creations, chats and technical data. We never sell it, we keep children's data to a minimum, and you can see, download and delete your data at any time.
1. Who is responsible
The data controller is {{OPERATOR}}, an individual developer residing in Türkiye, {{ADDRESS}}. Contact: {{PRIVACY_EMAIL}}. Our representative in the European Union is {{EU_REP}} and in the United Kingdom {{UK_REP}}. Players in Türkiye should also read the KVKK Aydınlatma Metni.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Player ID, email address, password (stored only as a secure hash), @handle, stage name, the country you choose, language | You |
| Age | Birth month and year, or the age range your app store shares | You, your app store |
| Game and profile | Idol look, idol, group and fandom names, logos, rooms, items, Cash and Star Gems balances, progress, songs, choreographies, chart results | Your play |
| Social | Room chat, group chat, direct messages, Quick Chat, guestbook entries, BUZZ posts, friends, invites, blocks, reports you make or receive | Your play, other players |
| Usage events | Sessions started, screens viewed, rewards claimed | Your play |
| Speaker, when available | Who broadcast, in which room, when, for how long, track title and length from the file, an audio fingerprint. Never the audio itself | Your device, when you use the speaker |
| Purchases, when available | Store transaction ID, product, price, currency, date. Never card details | Apple, Google |
| Device and technical | Platform, app version, time zone, push token, IP address and live-room connection data, online status, last-seen time; crash reports Apple or Google share with us if you allow it on your device | Your device, Apple, Google |
| Ads, when available | Whether you finished a rewarded ad; advertising ID only if you allow it | Ad networks, your device |
| Support | Messages you send us | You |
| Closed alpha sign-up (website) | Email address, language, country (worked out from your connection), sign-up time and the version of the notice you agreed to | You |
The speaker reads only the file you pick, on your device. We do not access any other files, photos, contacts, microphone or precise location.
Our website uses no cookies, analytics or trackers. If you sign up there for the closed alpha, we keep only the details listed above, in a separate database hosted by Cloudflare that is not connected to the game. To stop abuse of the sign-up form we also keep a one-way hash of your IP address for 24 hours.
3. Why we use it
| Purpose | Data used | Legal basis (EU, UK, Türkiye) |
|---|---|---|
| Run the game, your account, rooms and visits | Account, game, social, technical | Performance of our contract with you |
| Deliver purchases and handle refunds | Purchases, account | Contract; legal obligation for tax records |
| Apply age rules and Junior mode | Age, country | Legal obligation; legitimate interest in protecting minors |
| Keep players safe: filters, moderation, reports, appeals | Social, speaker, game, technical | Legitimate interest; legal obligation |
| Handle copyright and trademark claims | Speaker, names, logos | Legitimate interest; legal obligation |
| Stop cheating, fraud and attacks | Technical, purchases, game | Legitimate interest |
| Fix bugs and improve IDOL CLUB | Technical, game (aggregated where possible) | Legitimate interest |
| Push notifications | Push token, game events | Consent, which you can withdraw in Settings |
| Personalised ads | Advertising ID, ad interactions | Consent; never for Junior mode or under-18s |
| Answer you | Support | Contract; legitimate interest |
| Invite you to the closed alpha, plan where we test, and tell you when IDOL CLUB launches | Closed alpha sign-up | Consent, which you can withdraw at any time |
We do not make decisions with legal or similarly significant effects about you by automated means alone. Automated filters can hide a message or name; a person reviews any appeal.
4. What other players see
Other players can see your idol, player, idol, group and fandom names, logos, room when they visit it, chart results with your country flag, and messages you send where they are present. They cannot see your email, age, birth date, IP address or purchases. Junior mode shows less; see the Children & Parents Notice.
5. Who we share it with
We never sell personal data. We share it only with:
- Service providers that work on our instructions: Supabase (database, sign-in and server functions, hosted in Ireland, EU), Cloudflare (live-room relay, network, our website and the closed alpha list) and Google Firebase Cloud Messaging (push notifications).
- Apple and Google, for app distribution, purchases and crash reports.
- Ad networks, only if IDOL CLUB shows ads. We will list them here ({{AD_NETWORKS}}) before they start, and use personalised ads only with your consent.
- Authorities, when the law requires it, or to protect someone's safety, including reports of child exploitation.
- A future owner, if IDOL CLUB moves to a company or another operator. We will tell you first.
6. International transfers
Our database is hosted by Supabase in Ireland (EU). Cloudflare and Google may process data in other countries, including the United States. We rely on adequacy decisions, the EU Standard Contractual Clauses, the UK Addendum and, for data from Türkiye, the standard contracts approved by the Personal Data Protection Authority, which we notify to the Authority as required.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account, game and profile | While your account exists; deleted within 30 days after you delete it |
| Room chat | 7 days |
| Group chat and direct messages | 180 days |
| Reports and moderation decisions | 12 months after the case closes; longer if needed for a legal claim |
| Speaker logs | 12 months, so strikes can be counted |
| Usage events | 13 months |
| Push tokens | Deleted after 60 days without use |
| Connection logs (IP address, time) | For the period Türkiye's internet law sets for hosting providers (1 to 2 years) |
| Purchase records | As long as tax and accounting law requires |
| Inactive Junior mode accounts | Deleted after 24 months without use |
| Closed alpha sign-up list | Until IDOL CLUB launches, or until you ask us to delete it |
| Backups | Overwritten within 35 days |
8. Security
We use encrypted connections, access controls on our database, signed tickets for live rooms and the least access needed for each service. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the authorities as the law requires.
9. Your rights
Depending on where you live, you can ask to access, correct, delete or download your data, object to or restrict its use, and withdraw consent at any time. Use Settings › Privacy in the game or write to {{PRIVACY_EMAIL}}. We answer within 30 days and may ask you to prove the account is yours. You can also complain to your data protection authority: in Türkiye the Kişisel Verileri Koruma Kurulu, in the EU your national authority, in the UK the ICO.
10. Children
Players under 13, or under the digital-consent age in their country, use Junior mode. The Children & Parents Notice explains what we collect from them and how parents can review or delete it. Players aged 13 to 17 get private-by-default settings and never see personalised ads.
11. Your choices
- Push notifications: switch them off in Settings or in your device settings.
- Personalised ads: say no when asked, or change it later in Settings. On iOS we ask through Apple's tracking prompt. On Android you can reset or delete your advertising ID.
- Speaker: mute room audio at any time; if you never use the speaker, we keep no speaker log about you as a broadcaster.
12. United States residents
In the past 12 months we collected the categories listed in section 2 for the purposes in section 3. We do not sell personal information or share it for cross-context behavioural advertising of minors. Residents of California and other states with privacy laws can exercise the rights in section 9 and will not be treated differently for doing so.
13. Changes
We will post changes here and tell you in the game before important changes apply.
14. Contact
{{OPERATOR}} · {{ADDRESS}} · {{PRIVACY_EMAIL}}