Privacy Policy and Turkish Data Protection Notice

1. Controller and contact

The data controller and service provider is Epik Bilgi Teknolojileri ve Elektronik Hizmetleri Ticaret Limited Şirketi. Address: Havuzlar Mahallesi, Hilal Sokak 12 - 2, 59850 Tekirdağ/Tekirdağ, Türkiye. Telephone: +90 532 716 91 88. Support and privacy requests: epikalisverisnoktasi@gmail.com.

This notice covers the public website and player app. Other games operated by the company have their own disclosures; their accounts, purchases and data practices are not incorporated into Sortalio by this notice.

2. Information we process

Version scope: The age-appropriate advertising flow applies to version 1.0.0 (iOS: 19, Android: 19) and relevant later versions. Availability of the optional monthly ad-removal subscription depends on store approval, platform and region; it can be purchased only when offered in the relevant store. The purchase information below also covers data processing in test and review builds that support this feature. Earlier iOS 17 and Android 18 start advertising only in an eligible 18+ flow; those versions do not start ads/UMP for children, teens or players whose age is unspecified. Version 1.0.0 (16) and earlier may have created automatic guest accounts; deletion of those older records can also be requested through the app and web routes below. The relevant updated version must be installed for the new behavior.

Guest account and local play: In version 1.0.0 (24) and later builds containing this feature, connecting creates a guest account on our server using the random Sortalio identity in device secure storage, or revalidates its existing session. No email, real name, telephone number, full date of birth or advertising identifier is requested. During an offline launch, identity and save data are prepared or retained on the device; registration and minimal queued activity synchronize when connectivity returns. This does not guarantee offline gameplay. Pending or completed deletion prevents automatic account creation. Versions 17–23 do not automatically register on ordinary startup; accounts explicitly created for purchases or retained from earlier builds may exist. Progress, coins, boosters and preferences remain on the device; account counting is not automatic cloud backup. Player-facing email linking and developer cloud backup are not enabled. Operating-system backups and device transfer can operate separately.

First-party usage records: Solely to analyze and improve the operation of the game, our server processes random event/session identifiers linked to the guest account, foreground/background transitions, infrequent foreground activity signals, level starts/wins/losses, the relevant level number and timestamps, platform and app version. These activity records do not include individual card moves, free text, real name, email, age band or advertising identifiers. They are not combined with other games or used for ad targeting, marketing or individual behavioral profiles, and are not sent to Google Analytics or a separate analytics SDK. Random identifiers distinguish accounts, so these records are not described as anonymous. Dashboard counts represent accounts rather than verified people or exact store downloads; online presence is an estimate based on activity in the previous two minutes.

Optional purchases and restoration: After an adult task, explicitly initiating either action uses an eligible existing session or creates a randomly identified purchase account scoped only to Sortalio. No email, real name or separate login is requested. A server-issued, app-specific purchase account identifier is supplied to Apple as an app account token or to Google as an obfuscated account identifier. Our server processes the store, product and transaction identifiers, Apple signed transaction proof or Google purchase token, related transaction lineage, and the verified subscription entitlement including expiry, renewal/cancellation and refund or revocation state. These records are associated with the purchase account and are not anonymous merely because they contain no real name.

This purchase data is used only to verify transactions, provide removal of forced ads, restore from the same store, check renewal/expiry and refunds, and prevent false proof or proof belonging to another account. It is not used for ad targeting, marketing or merging profiles from other games. An existing purchase session and entitlement may be revalidated at launch, on returning to the app and during use after a player has previously initiated a purchase action. Revalidation does not create a new account or reopen a deleted one. After reinstallation, an explicit restoration using the same store account may bind the entitlement to a new purchase account; it does not restore the deleted account or game data.

Payment is completed in Apple App Store or Google Play’s own interface and under its terms. This purchase integration does not give us your payment card number, bank account, store password or store account email address. Technical store proof can contain product, transaction and subscription details, including purchase price/currency where supplied. The payment provider’s own account and financial records are separately subject to its disclosures.

Older accounts and deletion: Accounts, sessions, security events and any linked identity or cloud save associated with a guest identity created by an older version may still exist on the server. Although they may not contain a real name, they are not treated as anonymous data. Deletion uses an existing session or an expiring deletion-only code, a random operation ID and a completion time. The app keeps deletion state and the proof needed for safe retries in secure storage. After confirmed deletion, the previous identity and secrets are replaced with a local deleted-state record that prevents automatic recreation of the old account.

Network and security information: Opening the site, downloading game artwork, submitting purchase-verification or deletion requests or checking connectivity may cause our server and network providers to process an IP address, request address, time and technical device or browser information. Our request-limiting records use a keyed IP-address digest and request counters.

Support messages: If you email us, we process your email address, message and information you choose to provide. Do not send passwords, session tokens, payment-card details or unnecessary identity documents. Age ranges and age-appropriate advertising are explained below.

3. Collection, purposes and legal grounds

Limited first-party usage measurement to analyze and improve the game is assessed under legitimate interests, provided fundamental rights and freedoms are not harmed (KVKK Article 5/2(f)). This scope does not include personalized advertising, marketing or tracking across other services. Where applicable law requires separate permission for a particular operation, that permission must be obtained before the operation; this notice does not replace it.

Information is obtained through the device app, HTTPS requests, server records and support emails, automatically or when you provide it. Providing the game and acting on your request regarding an existing account, verifying an optional subscription transaction and providing the purchased benefit are assessed under Article 5/2(c) of the Turkish Personal Data Protection Law where necessary to establish or perform the service relationship. Statutory obligations concerning deletion and rights requests also apply.

Request limiting, attack prevention and service security rely on legitimate interests under Article 5(2)(f), subject to your fundamental rights. Support records rely on Article 5(2)(c) where necessary for service performance, or Article 5(2)(e) where necessary to establish, exercise or protect a right. Statutory disclosures and duties fall under Article 5(2)(ç).

Separate consent is required for optional processing that legally requires it. Visiting the site or reading this notice is not blanket consent to advertising, marketing or international transfers. Consent may be withdrawn for consent-based processing; processing supported by another valid legal ground is assessed separately.

4. Advertising and Google services

In build 19, UMP may run for the required privacy flow after a valid age choice is successfully saved on the device and valid publisher configuration is present. Ads may be loaded only when the current UMP flow permits ad requests and required protections are verified. Players choosing under 13, 13–17 or explicitly “prefer not to say” receive the same child-protected advertising treatment. Advertising/UMP does not start before a choice is made or if that choice cannot be safely loaded or saved; such an unresolved state is not treated as an explicit “prefer not to say” choice. Normal gameplay, level rewards, coins and boosters do not require viewing ads.

Only non-personalized ads are requested in every age flow, with a G content limit. Child-directed and under-age-of-consent protections are signalled to the advertising service for children, teens and explicitly unspecified-age players; interest-based ads and remarketing are not requested. As a more protective choice across differing regional ages of consent, the entire 13–17 range receives this treatment without requesting a more detailed age or country. A content limit alone cannot guarantee that every item in an ad is appropriate; inappropriate ads can be reported to our support address.

When advertising services run, Google Mobile Ads and User Messaging Platform (UMP) may process an IP address and approximate location derived from it, technical device information, ad and app interactions and diagnostics, depending on platform and settings. This can include the child, teen and explicitly unspecified-age flows in which protected ads are served. Android advertising-ID, AdServices, phone, Wi-Fi and location permissions are blocked; the iOS app does not request ATT permission. The publisher first-party advertising ID is disabled before the first ad load. On Android, publisher personalization restrictions are applied before SDK initialization; disabling the first-party ID is verified after SDK initialization and before loading ads. These protections do not mean that non-personalized or limited ads process no data.

Where required, privacy choices are managed through Google UMP. Refusing personalization does not necessarily disable every permitted ad: non-personalized or limited ads may be served only where valid privacy signals and provider rules allow them. Consent is not assumed; ads are not loaded if UMP does not allow ad requests, the current flow fails or required protection cannot be verified. Privacy options can be reopened in the app where required, and device settings are also available. Reading this notice does not give advertising consent.

On the first launch of build 19, the age choice is requested again with the new explanation; a choice from the previous version is not reused automatically. In builds 19–31, every cold launch requests the adult choice again with no preselected option; successfully saved protected choices may be remembered. In version 1.0.0 (32) and later builds containing this feature, every successfully saved coarse age band, including the adult choice, is remembered on later launches. Because the birth year is not stored, the band does not automatically change over time; it can be changed in Settings after the adult task. If the age choice changes to a different band after advertising services have started, new ad requests and presentations stop; the app must be fully closed and reopened to continue with the new age settings. Declining or closing a rewarded ad early does not remove normal gameplay access; only the associated ad reward depends on the provider’s genuine completion event.

5. Website cookies and infrastructure

The website and game services use hosting infrastructure and Cloudflare. Cloudflare may process connection information to route requests, deliver content and provide security; enabled protections may use security cookies. Performance measurements may also be processed on enabled infrastructure pages.

The homepage’s own language menu uses no cookies or local storage. To retry the same request after an uncertain network result, the web deletion form stores only a SHA-256 digest of the deletion code, a random operation ID and a 30-day expiry in this browser’s localStorage. The code itself is not written to that store or the URL; it is submitted over HTTPS in the deletion request. The retry record is removed on success. Its validity is limited to 30 days; you can clear browser data to remove a remaining local record, but doing so removes the proof for retrying an unfinished request.

This does not mean that the entire site, infrastructure or advertising SDK flow uses no cookies or processes no data. Cookies and local storage can be managed in browser settings; security features and safe retries of unfinished deletion requests may be affected.

6. Recipients and international processing

Information needed for the relevant activity may be processed by hosting and security infrastructure providers, Cloudflare, Apple and Google store/payment verification services, Google's advertising services and the email provider delivering support messages. Information is disclosed to public authorities only under a valid legal duty or lawful request.

Global services such as Cloudflare, Apple and Google can involve processing outside Türkiye. Such processing is subject to provider terms and applicable data protection and transfer rules. Required transfer conditions must be met separately; this notice itself is neither a transfer agreement nor consent. Providers' own retention and request information can be reviewed through the links below.

7. Retention and security

Player activity retention: Detailed events and per-account daily counts are limited to the latest 30 days; expired records are removed through bounded cleanup and are excluded from reports outside that window. First/last-seen timestamps and cumulative session/level counts can remain while the account exists; permanent account deletion removes its events, daily counts and activity summary within the same deletion operation. The device queue holds at most 200 events for seven days and is cleared during identity changes or deletion. These limits are not a guarantee about provider access logs or backups.

Device game data may remain until in-app deletion completes, app data is cleared or the operating system removes the relevant records. iOS secure storage may survive uninstalling. In-app deletion removes this device’s main and recovery saves, progress, coins, boosters, language/age preferences and local result-delivery records after any required server result has been verified. A minimal deleted-state record remains to prevent the old account from reopening automatically; a new game starts only through your explicit choice.

Purchase proofs, raw transaction identifiers and stored entitlement snapshots are encrypted on the server; app-specific keyed digests support lookup and association. Necessary technical fields such as product, validity time and verified state are also stored in the database. These records are retained to verify subscription entitlement, restore purchases and protect transactions. Once permanent account deletion completes, all of our purchase records, transaction-lineage associations, encrypted proofs and entitlement records bound to that account are removed from the application database in the same deletion operation; this feature does not retain a separate purchase record. Cached purchase entitlement and identity information on the device are also removed by local deletion. Apple/Google’s own transaction records and the infrastructure/backup records discussed separately below are outside that database deletion.

A deletion code is valid for 30 days. The server keeps an unused code’s digest, target-account association and expiry; a completed request retains only a minimal retry receipt containing code/operation digests, completion time and expiry. The completion receipt verifies the result of the same request for 30 days and contains no account, email, profile or session secret. Expired records become invalid and are removed by bounded periodic cleanup; physical removal at precisely day 30 is not guaranteed.

To prevent reuse of a deleted guest identity from recreating the account, a one-way server-keyed digest of that identity is retained for security for as long as the relevant guest-identity protocol remains in use. This narrowly scoped deny record contains no original guest/account ID, account association, profile, email, bearer token or IP address. The need for it is reassessed when the protocol is retired or changed.

Support messages, account-independent security/request counters, server access logs, backups and provider records are managed separately from this application-database deletion. Retention assessments consider completion of your request, abuse investigations, legal obligations and protection of rights; applicable deletion duties apply when processing conditions end. No unverified fixed retention period or instant removal is promised for provider records or backups.

Our API connections use HTTPS. Sensitive session and deletion proofs are protected in the device’s secure storage, and the server checks authorization and app scope. No internet service can guarantee absolute security. Security reports can be sent to our contact address.

8. Your rights and deletion requests

Under KVKK Article 11, rights include learning whether data is processed, requesting information about its purposes and use, learning recipients, requesting correction or qualifying erasure and notification to recipients, objecting to adverse results from exclusively automated analysis, and seeking compensation for unlawful processing. Other applicable data protection rights in your location remain available.

Email epikalisverisnoktasi@gmail.com or write to the company address above. Use the subject 'Sortalio data request', describe your request and provide a reply address. Proportionate identity or account-ownership checks may be needed to meet statutory request requirements and protect other people's data. Do not share passwords or session secrets.

Valid statutory requests are answered as soon as appropriate to their nature and, under KVKK, within 30 days, subject to applicable statutory exceptions and fee rules. You may complain to the competent data protection authority where requests are refused or not adequately addressed.

In-app route: Settings → Account and save → Delete account and data. Read the permanent-deletion scope and confirm separately. For offline local play not yet registered on the server, only device data is removed. If server registration has occurred, the authorized server-deletion result is verified first; guest/session records, activity, daily counts and any purchase records associated with that account are removed before device data and pending activity are cleared. An interrupted connection is not shown as success; the same operation can be retried while account operations remain stopped.

Outside the app: https://sortalio.com/en/delete-account.html or https://sortalio.com/tr/delete-account.html. A player with a server account can create and copy a deletion-only code valid for 30 days from the app’s account area. Creating a code does not delete the account. The web form requires the code and a separate permanent-deletion confirmation. Do not share the code. If you have no code, it has expired or you cannot access your account, email support; the request is assessed after necessary, proportionate proof of account ownership. Knowing a public account ID alone does not authorize deletion.

Web deletion removes the server account and associated application records; it cannot remotely clear local game data on other devices, offline devices or operating-system backups. Use in-app deletion or operating-system app-data controls on those devices. Signing out or uninstalling alone does not delete the server account. Any store subscription cancellation and requests concerning provider data are handled separately through the relevant providers.

9. Children and parents

The random guest identity and limited first-party usage records in this version are used only to support internal game operations, including for children and unspecified-age players. They do not create real-world identity records, a server age profile, marketing audiences or cross-game tracking. Children’s data is not used to create personalized advertising or behavioral profiles. Parents can use the same account-deletion and request channels below.

The game is a card puzzle that children may also use. In version 1.0.0 (32) and later builds containing this feature, if no valid age choice is saved, you can select a birth year with no preselected value or choose prefer not to say. The year is used transiently on the device only to derive an appropriate protection band; it is not written to persistent settings or activity records and is not sent to our server or an advertising provider. No full date of birth, day/month, exact age or country is requested. Because the birthday is unknown, calendar-year differences of 13 and 18 remain in the more protected band. Only the resulting coarse age band or prefer-not-to-say choice is stored on the device; this declaration is not identity or age verification. The age screen in builds 19–31 directly offers under 13, 13–17, 18 or older, or prefer not to say. No age profile is sent to our own game server. However, when advertising services run, child-protected treatment and under-age-of-consent signals are sent to Google services; it would be incorrect to say that no age-protection signal leaves the device. Children, teens and explicitly unspecified-age players receive the same protected, non-personalized advertising treatment. Ads do not start before a choice, safe saving/loading and required privacy permission have been verified. Game artwork and connectivity checks may generate the technical network information described above even when ads are not shown.

The app requires an adult task for opening the subscription screen, purchases/restoration, sensitive external links and age-preference changes. This task is not verified parental consent or identity/age verification; it does not replace any guardian permission required by law. A full restart must be performed when required after an age-preference change.

Parents or guardians can use our contact channels to request information, correction or deletion concerning their child’s data. Necessary information may be requested to safely establish the relationship to the child and relevant guest or purchase account. Please do not include unnecessary sensitive information about a child in support messages.

10. Updates

The current notice is published at this address. Material processing changes are reflected in the notice and update date; additional notices and permissions are provided where required. A policy update does not replace consent that has not been given.