Ironwave Arena Privacy Policy

Last updated: 4 October 2026

This policy explains which personal data is processed when you play Ironwave Arena (iOS and Android), why, and what you can do about it. We don't ask for your name, email address or phone number. But the game does process your device ID, nickname, save, gameplay events and IP address, and Google collects some data for ads. Your progress is stored only on our server, and the game does not work offline. Your nickname is public on the leaderboards. You can delete your data from the game: Settings → SAVE → “Delete all my data”. This policy applies wherever you play. Because the controller is based in Türkiye, the Turkish data protection law (KVKK) applies to all players; players in the European Economic Area (EEA), the UK, Switzerland, the US and Brazil have extra rights, described below.

Data	Why we use it	Legal basis	How long we keep it
Device ID (Android ID or iOS identifierForVendor)	To link your account to your device, find your account when you delete data or set a nickname, and bring your account back when you reinstall the game on the same Android device. identifierForVendor is an ID Apple gives to apps from the same developer. The ID is sent over HTTPS; the server stores only its SHA-256 hash (an irreversible fingerprint of the ID).	Contract: providing the game and cloud save to you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).	As long as your account exists. Removed by “Delete all my data”.
Player code, player number and cloud ID	The player code is the secret key to your account and is used on every request about your account (sign-up, sync, gameplay events, purchase records, nickname, deletion). It is not shown to you, it is stored on your device, and the server keeps only its SHA-256 hash. The player number is an internal ID our server creates. Its first 6 characters are the cloud ID you see in Settings → ACCOUNT; it lets us find you when you contact support.	Contract: providing the game and cloud save to you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).	As long as your account exists. The code on your device stays until you remove the game or use “Delete all my data”.
Nickname	To show you on the leaderboards. You need to choose a nickname to start playing, and your nickname is public (section 7).	Contract: providing the leaderboards (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).	As long as your account exists.
Save and progress score	To run the game and keep your progress: your heroes, gear, Essence, Ember and color credit balances, pets, records, settings (language, sound, ad preference, Ad-free pack status) and your last processed store transaction IDs. The permanent save is kept only on our server.	Contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).	As long as your account exists.
Record summaries	Your best run and Boss Room results, for the leaderboards. Also, to track ad use, how many times you took an ad reward (including those the Ad-free pack gives without an ad) and when the last one was.	Contract for the leaderboards (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)). Legitimate interest for the ad count: tracking ad balance and revenue (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).	As long as your account exists. Kept even after gameplay events are deleted.
Gameplay events (telemetry)	To balance the game, find bugs and purchase problems, and calculate leaderboard records. Examples: run start and end, wave reached, rewards picked, boss results, purchases with in-game gold, ads watched, purchase steps and the store's error message. Each event includes a time.	Run, boss and Daily Challenge results needed for the leaderboards: contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)). Other events: our legitimate interest in keeping the game balanced and free of bugs (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).	About 45 days. Then turned into daily totals that identify no one, and deleted. Deleted at once if you delete your account.
Device model and app version	Support and debugging, seeing which devices and versions are used, and asking you to update when needed. While the game is open, the version is sent about every 30 seconds to check the connection and for updates. This check is not saved in our database; it stays only in the server logs for at most 7 days.	Legitimate interest: keeping the game working on different devices (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).	As long as your account exists; updated on each sync.
Timestamps	When your account was created, when you were last seen and when you played runs: for activity statistics and leaderboards. Your last-seen time can also be read through the leaderboard interface (section 7).	Contract for the leaderboards, legitimate interest for statistics (GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)(c) and (f)).	As long as your account exists. Event times about 45 days.
Purchase records	To deliver what you bought, stop the same purchase from being processed twice, for support and for sales statistics. We keep: product ID, the transaction ID or token from the store, the in-game amount granted, your active hero at the time, and the time. We do not keep the price you paid, the currency or your payment details.	Contract for delivery; legitimate interest to prevent double delivery and abuse and to protect our rights in a dispute (GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)(c), (e) and (f)).	As long as your account exists.
Abuse counters (IP address or player number)	To protect the server from mass account creation, event floods and fake purchase records. We count requests that come from the same IP address or the same account in a short time (section 6).	Legitimate interest: security of the service (GDPR Art. 6(1)(f) and Recital 49, which recognises network security as a legitimate interest; KVKK Art. 5(2)(f)).	About 3 days at most. Every night, counters older than 2 days are deleted.
IP address and request details (server logs)	Our hosting provider Supabase and its network provider Cloudflare log every request. To run the service, for security and for debugging.	Legitimate interest: keeping the service secure and running (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).	At most 7 days (Supabase's log retention on our Pro plan).
Ad data (Google AdMob and UMP)	To show rewarded ads, measure them, prevent fraud and, if you allow it, personalise them. Google's SDKs collect directly: advertising ID (on iOS, the IDFA only if you allow tracking), IP address and the approximate location derived from it, device info, performance, crash and diagnostic data, and ad interactions. This data does not come to our server.	Personalised ads and iOS tracking: your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)). Non-personalised ads: our legitimate interest in funding a free game with ads (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)). In the EEA, the UK and Switzerland, Google storing or reading information on your device also depends on your permission in the consent form (ePrivacy Directive Art. 5(3) in the EU, PECR in the UK). If you don't give it, Google shows “limited ads” that don't use the advertising ID or other device identifiers. We are jointly responsible with Google for collecting the data and passing it to Google; Google is responsible for how it uses it afterwards (section 4).	Under Google's rules: https://policies.google.com/technologies/retention
Your ad choices and ad counters	To respect your choice and apply daily ad limits. Your Personalised ads setting is stored in your save. Google's tool stores your consent form choice on your device. The daily ad counter stays only on your device.	Your ad choice: our obligation to demonstrate and respect your consent and its withdrawal (GDPR Art. 6(1)(c) with Art. 7(1); KVKK Art. 5(2)(ç)). Daily ad counter: contract, to apply the game rules (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).	The setting: as long as your account exists. The choice and counter on your device: until you remove the game.
Admin notes and flags	To give support, mark test devices, and deal with inappropriate names and cheating. We may add a short note to your account (60 characters at most, e.g. “test device”), ask you for a new nickname or remove you from the leaderboards. We may also grant in-game items for support.	Legitimate interest: giving support and keeping the game fair (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).	As long as your account exists.
Support emails	To answer you, solve purchase problems, and verify deletion or access requests. We keep: your email address, what you wrote, and any cloud ID or order number you sent.	Contract and legitimate interest to answer you; legal obligation for rights requests (GDPR Art. 6(1)(b), (c) and (f); KVKK Art. 5(2)(c), (ç) and (f)).	12 months after your request is closed; then we delete them. A short record showing that we handled a deletion or access request (cloud ID, request type, date) is kept for 2 years.
Files on your device	The game keeps on your device: your player code, player number and nickname (account link), gameplay events not yet sent (400 at most) and the daily ad counter. The permanent save is not kept on your device.	Contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).	Until you remove the game. “Delete all my data” clears only the account link. On Android these files are not included in device backups. On iPhone and iPad they may be included in iCloud or computer backups; such a backup also contains your player code, and a device restored from it may get your account back.

1. Who we are and how to reach us

Ironwave Arena is developed and published by Emirhan Temizyürek, an individual developer based in Türkiye, under the brand EMHA Software. He is the controller of your personal data; when this policy says “we”, it means him.

For any privacy question or request: support@emhasoftware.com. This address reaches the developer directly. We are not required to appoint a data protection officer.

This policy covers only the game. Because the controller is based in Türkiye, the KVKK (Law No. 6698) applies wherever you play. In addition, the GDPR applies in the EEA, the UK GDPR in the UK, the Swiss Federal Act on Data Protection (FADP) in Switzerland, the LGPD in Brazil, and the relevant state laws in the US. Your country-specific rights are in sections 12–15.

2. What we don't collect

The game does not ask for or collect:

Your real name, email address, phone number or postal address. If you email us, we only learn your email address and what you write.
A password. There is no account password in the game.
Your age or date of birth.
Your precise (GPS) location. The game does not ask for location permission, and we don't use your IP address to find your location. However, Google AdMob may derive your approximate location (country or city level) from your IP address.
Your card, bank or store account details. Apple or Google take the payment; these details never reach us.
Your contacts, photos, camera, microphone or files.
Chat or messages. There is no messaging between players in the game.

3. How we collect data

Your data is collected electronically and automatically through the game app. You type your nickname. Google's SDKs in the game send ad data directly to Google. If you email us, you provide what you write.

The first time you open the game, an account is created for you on our server automatically; there is no separate sign-up or login. While the game is open, your save is sent to the server whenever it changes; gameplay events are sent in batches.

We read the device ID only to link your account to this device and to bring your account back when you reinstall the game on Android; we don't use it for ads or tracking. We also read your device model and unsent gameplay events from your device and send them to our server.

We can't provide the game without an internet connection, the device ID and your save, because your progress is stored only on our server. You also need to choose a nickname to start playing. It is shown publicly on the leaderboards, so don't use your real name. Giving consent for ads is entirely optional.

We don't make decisions about you based only on automated means that have legal or similarly significant effects. Nicknames go through an automatic filter and inappropriate names are not accepted. If you allow personalised ads, Google may build a profile based on your interests.

On Android, the game and its SDKs use these permissions: internet, network state, advertising ID, Google Play billing, wake lock, foreground service and basic phone state. The game does not ask for location, camera, microphone, contacts or photo permissions.

4. Who we share data with

We do not sell your personal data for money (for the broad meaning of “sale” under US law, see section 14). Your data goes only to the recipients below.

The third parties we share your data with provide the same or equal protection as described in this policy. Supabase commits to this in its data processing addendum, and Google in the Google Ads Controller-Controller Data Protection Terms for ad data (https://business.safety.google/adscontrollerterms/). Apple and Google Play process payments as independent controllers under their own privacy policies.

Supabase (contracting entity Supabase Pte. Ltd., Singapore): hosts our database and server functions; it is a processor working on our behalf. Data is stored on Amazon Web Services servers in Frankfurt (Germany), and traffic passes through the Cloudflare network. Data processing addendum: https://supabase.com/legal/dpa Sub-processor list: https://supabase.com/legal/customer-resources/subprocessor-list Privacy policy: https://supabase.com/privacy
Google LLC (AdMob and User Messaging Platform): to show and measure ads and to ask for consent. We are jointly responsible with Google for the collection of your data by Google's SDK and its transmission to Google; Google itself is responsible for how it uses the data afterwards. Privacy policy: https://policies.google.com/privacy How Google uses data from partner apps: https://policies.google.com/technologies/partner-sites
Google's ad partners: in the EEA, the UK and Switzerland they are listed in the consent form. You can reach the list again from Settings → ADS → “Your ad choices”.
Apple (App Store) and Google Play: they process purchases and payments themselves and are independent controllers for this. We receive only the product, a transaction ID or token and the purchase status. Apple: https://www.apple.com/legal/privacy/ Google: https://policies.google.com/privacy
Other players: your nickname and leaderboard data are public (section 7).
Our email provider Turhost (Türkiye): hosts the emails you send us.
Public authorities: only when the law requires it.

5. Ads and your consent

The game has only rewarded ads, and watching one is always your choice. Ads are served by Google AdMob. We set the ad content limit to “Teen” (T) at most.

As soon as the game opens, Google's consent tool (UMP) contacts Google to check whether it needs to ask for your consent. This request sends your IP address and basic device info to Google.

EEA, UK and Switzerland: Google's consent form opens; it follows the ad industry's common consent standard (IAB TCF). Ads are personalised only if you allow it. You can change or withdraw your choice at any time from Settings → ADS → “Your ad choices”; withdrawing does not affect processing done before. You don't need to consent to play.

Other countries (including Türkiye and the US): the Settings → ADS → “Personalised ads” switch is off by default. While it is off, every ad request asks Google for non-personalised ads. If you turn it on, you give your explicit consent for Google to use your advertising ID and ad interactions to choose ads based on your interests; this data may be processed abroad, including in the US. You can withdraw your consent at any time by turning the switch off.

When serving ads, Google and its ad partners may store and read information on your device (for example the advertising ID and the SDK's local storage) and collect information using your IP address. Outside the EEA, the UK and Switzerland this also happens with non-personalised ads: Google may use your IP address, the approximate location derived from it, device info and the advertising ID to show ads, limit how often you see them, measure them and prevent fraud. In the EEA, the UK and Switzerland, if you don't allow information to be stored on and read from your device in the consent form, Google does not use the advertising ID and shows only limited ads.

iPhone and iPad: Google can access your advertising ID (IDFA) only if you allow it in Apple's “Allow to track” prompt. If you allow it, Google may use this ID for ads and measurement across other companies' apps and websites; Apple calls this tracking. A short explanation from Google may appear before Apple's prompt. You can change your choice in iOS Settings → Privacy & Security → Tracking.

Android: you can reset or delete your advertising ID in the Ads or Privacy section of your Android settings.

The Ad-free pack gives you most ad rewards without watching ads, but Google's ad SDK still runs in the game.

6. Your IP address and abuse protection

Because of how the internet works, every request to our server carries your IP address. While the game is open, a small request to check the connection and for updates is sent about every 30 seconds.

Since 3 October 2026, our server counts how many new accounts, gameplay events and purchase records come from the same IP address in a short time. This protects the server from automated attacks, mass fake accounts and fake purchase records. If a limit is exceeded, the server accepts no new records of that kind until the window ends.

IP counters use 1-hour and 1-day windows. The IP address is stored in plain text in the counter, but it is not written to your player record. We don't use it to find your location or to profile you. A nightly job deletes counters older than 2 days, so an IP address stays about 3 days at most. Per-account counters (windows from 1 minute to 1 day) also stay about 3 days at most, and they stay for that time even if you delete your account.

Our hosting provider Supabase and its network provider Cloudflare also log your IP address and request details to run the service and keep it secure. Supabase keeps these logs for at most 7 days.

Our legal basis is legitimate interest: the security of the service and of other players (GDPR Art. 6(1)(f) and Recital 49; KVKK Art. 5(2)(f)). You can object (section 12), but without this protection we cannot run the server safely.

7. Public nickname and leaderboards

You need to choose a nickname to start playing (3–14 characters). While you type, our server checks that the name is allowed and free; what you type during this check is not saved in our database. Don't use your real name or anything that identifies you as your nickname.

On the leaderboards, anyone can see: your nickname, score, best wave, danger tier, hero, Essence, number of runs, Boss Room wins and attempts, win rate and highest step reached, and the times of your best run and Daily Challenge result.

The server interface that supplies leaderboard data also returns your last-seen time, even though the game does not show it. Someone who uses the public API key built into the game can see it.

Players without a nickname, removed from the leaderboards, or asked for a new nickname are not listed.

You can't change your nickname in the game at the moment. To correct it, email us. We may change an inappropriate name, ask you for a new one, or remove you from the leaderboards, for example for cheating. If you delete your account, your nickname and leaderboard entries are deleted too.

8. International transfers

Your game data is stored in the European Union, on servers in Frankfurt, Germany (AWS eu-central-1). Our provider is Supabase Pte. Ltd., based in Singapore. Supabase and its sub-processors in the US (for example Supabase, Inc., Amazon Web Services and Cloudflare) may access the data to provide the service; server logs may also be processed outside the EU. These transfers are covered by the EU Standard Contractual Clauses (2021/914) and the UK and Swiss addenda in Supabase's data processing addendum, which is part of its terms of service: https://supabase.com/legal/dpa

The controller is in Türkiye and manages the database from Türkiye. There is no European Commission adequacy decision for Türkiye. However, under GDPR Art. 3(2) the GDPR applies directly to all of this processing, and you can exercise your rights directly against us.

For KVKK purposes, your data is transferred abroad for hosting: to Germany, and through Supabase to service providers in Singapore and the US.

Google LLC may process ad data in the US and other countries. Google takes part in the EU-US Data Privacy Framework (and its UK and Swiss extensions) and also uses Standard Contractual Clauses: https://policies.google.com/privacy/frameworks

Apple and Google may process purchases on their own systems, also outside your country.

You can email us with questions about these safeguards.

9. How long we keep data

Summary of retention periods:

Your account (device ID hash, player code hash, nickname, save, device model, version, timestamps, admin notes), record summaries and purchase records: until you delete your account or we delete it. We do not delete inactive accounts automatically at the moment. If you stop playing, use “Delete all my data”; for an old account left behind after reinstalling on iOS, email us.
Gameplay events: about 45 days. A nightly job turns older events into daily totals that identify no one (for example, how many runs were played that day) and deletes them. These totals are kept with no time limit.
Abuse counters (IP address or player number): about 3 days at most.
Server logs (including IP address and request details): at most 7 days. Database backups are taken daily and kept for 7 days; data we delete drops out of the backups within 7 days at the latest. Details: https://supabase.com/docs/guides/platform/backups
Support emails: 12 months after your request is closed. Short record of rights requests we handled: 2 years.
Files on your device: until you remove the game. If they were included in an iPhone or iPad backup, they also stay in that backup for as long as it exists.
Google's ad data: under Google's rules (https://policies.google.com/technologies/retention). Purchase records at Apple and Google: under their rules.

10. Deleting your Ironwave Arena account and data (EMHA Software)

In the game: on the main menu, Settings → SAVE → “Delete all my data”. The game asks you to confirm twice. Deleting needs an internet connection. If you are connected, your account on our server is deleted at once and for good: your nickname, save, device ID and player code hashes, device model, admin notes, record summaries, purchase records and gameplay events. The screen shows “Your data was deleted”.

If the screen shows “Server unreachable — your local save was deleted”, your data on the server was not deleted. Try again with the internet on, or email us.

If you open the game again on the same device, a new empty account is created automatically, because the game cannot run without one. If you don't want that, remove the game from your device after deleting.

“Reset save” and “Reset this character” do not delete your data. To delete it, use only “Delete all my data” or email.

By email: write to support@emhasoftware.com with the 6-character ID from Settings → ACCOUNT → “Your cloud id”. You don't need to reinstall the game for this. If you don't know your cloud ID, your nickname alone is not enough because it is public; send what else you have (for example your device model, and the product and date of a purchase), but we may not always be able to find your account. We answer within 30 days at the latest.

The Ad-free pack is tied to your Apple or Google account, so it comes back from the store even after deletion. Your Essence, Ember and Color Change (color credit) balances are deleted with your save and cannot be restored.

What remains after deletion:

Daily totals that identify no one.
Abuse counters: about 3 days at most.
Supabase's server logs and database backups: 7 days at most.
On your device, the queue of unsent gameplay events and the daily ad counter: until you remove the game. If you don't remove it, old queued events may be sent to your new account.
Google's ad data and the consent choice on your device: under Google's rules. On Android you can delete your advertising ID to break the link.
Your purchase history at Apple and Google: their responsibility; contact them about it.
Emails you sent us: deleted 12 months after your request is closed, or earlier if you ask.

11. Reinstalling, new phone and restoring purchases

Your progress is stored only on our server. The game finds your account through the account link it keeps on your device (the player code) and through the device ID. The game has no recovery code you can enter and no way to move an account to another device at the moment. On Android, game data is not included in device backups.

Android, same device: if you delete the game and install it again on the same device, your account usually comes back automatically thanks to the device ID (“Your account came back from this device”). After a factory reset this match no longer works.

iPhone and iPad: when you delete and reinstall the game, iOS gives it a new device ID unless another app from the same developer is still installed, and a new empty account is created. If you use iOS “Offload App” instead of deleting, your data stays on the device and your account comes back. When a new account is created, your old account, with its nickname, stays on our server; email us if you want it deleted.

New phone: on Android a new device always gets a new empty account. If you set up your new iPhone or iPad from your old device's iCloud or computer backup, or with Quick Start, the account link may move too and your account may come back; otherwise a new empty account is created. If you email us with your old cloud ID, we will try to help by hand, but we cannot promise that everything comes back. So write down your cloud ID (Settings → ACCOUNT).

“Restore purchases” (Settings → ADS) brings back only the Ad-free pack, because it is a permanent product. The Ad-free pack usually also comes back by itself when you open the game. Essence, Ember and Color Change are consumable: when you buy them they are added to your save and stay with that save. The store's restore function does not bring them back.

12. Your rights and how to use them

Wherever you live, you can send the requests below to support@emhasoftware.com. In the EEA, the UK and Switzerland these are your legal rights under the GDPR, the UK GDPR and the Swiss FADP respectively.

To check that a request is about your account, we ask for the cloud ID from Settings → ACCOUNT, and we may ask for more information. Don't share your cloud ID with others. Requests are free and we answer within 30 days at the latest. If you are in the UK, you can also send a data protection complaint to the same address; we confirm receipt within 30 days, look into it without undue delay and tell you the outcome.

Access: find out which data we process about you and get a copy by email.
Correction: ask us to correct wrong data, for example your nickname.
Deletion: “Delete all my data” in the game, or email (section 10).
Restriction: ask us to pause processing your data in certain cases.
Objection: object to processing based on legitimate interest (gameplay events, device model, security). The game has no setting to turn off gameplay events at the moment; we review your objection and tell you the outcome.
Portability: get your save and account data in a machine-readable format (JSON).
Withdrawing consent: at any time with “Your ad choices”, the “Personalised ads” switch or the iOS tracking setting.
Complaint: you can complain to the data protection authority in the EEA country where you live, work or where the issue happened (list: https://www.edpb.europa.eu/about-edpb/our-members_en), in the UK to the ICO (https://ico.org.uk), and in Switzerland to the FDPIC (https://www.edoeb.admin.ch). You don't have to contact us first, but if you do, we can usually solve the problem faster.

13. KVKK information notice (for all players)

This section is the information notice under Article 10 of Türkiye's Personal Data Protection Law No. 6698 (KVKK). Because the controller is in Türkiye, it applies wherever you play.

Controller: Emirhan Temizyürek (EMHA Software), Türkiye. Contact: support@emhasoftware.com. There is no controller's representative.
Purposes: providing the game and cloud save; showing leaderboards; delivering purchases and preventing double delivery; balancing the game and fixing bugs; protecting the server from abuse; showing rewarded ads and, if you allow it, personalising them; answering support requests; handling rights requests.
Recipients and purposes: Supabase Pte. Ltd. and its sub-processors for hosting (abroad: Germany, Singapore, US); Google LLC for ads (it collects ad data directly through its own SDKs); Apple and Google for payments; our email provider Turhost (Türkiye) for support emails; other players for leaderboards (nickname and scores); authorised public bodies when the law requires. Details: sections 4 and 8.
Collection method: electronically and automatically through the game app. You type your nickname; Google's SDKs collect ad data; if you email us, you provide the content.
Legal ground, performance of a contract (Art. 5(2)(c)): account, save, leaderboards, delivery of purchases.
Legal ground, legal obligation (Art. 5(2)(ç)): answering rights requests and respecting your ad choice.
Legal ground, establishing, exercising or protecting a right (Art. 5(2)(e)): purchase disputes.
Legal ground, legitimate interest (Art. 5(2)(f)): gameplay events, device model, IP-based security, non-personalised ads.
Legal ground, explicit consent (Art. 5(1)): turning on the “Personalised ads” switch or allowing tracking on iOS.
Your rights (Art. 11): To learn whether your personal data is processed. To request information if it is. To learn the purpose and whether it is used for that purpose. To know the third parties it is transferred to in Türkiye or abroad. To ask for correction if it is incomplete or wrong. To ask for deletion or destruction under the conditions of Art. 7. To ask that corrections and deletions be notified to those third parties. To object to a result against you that comes only from automated analysis. To claim compensation if you suffer damage from unlawful processing.
How to apply: send your request by email to support@emhasoftware.com (signed with a secure electronic signature or mobile signature if you wish), or, for deletion, use the in-game “Delete all my data” tool. Include the cloud ID from Settings → ACCOUNT so we can find your account. If you want to apply by another method set by law, such as a written letter or KEP (registered electronic mail), email us first and we will send you our address for applications. We handle your application free of charge within 30 days at the latest.
Complaint to the Board: if your application is rejected, you find our answer insufficient, or we don't answer within 30 days, you can complain to the Personal Data Protection Board (https://www.kvkk.gov.tr) within 30 days of learning our answer, and in any case within 60 days of your application. You must apply to us before complaining to the Board.

14. United States and California

We do not sell your personal information for money. However, if you turn on the “Personalised ads” switch or allow tracking on iOS, the advertising ID, IP address and activity data that go to Google may count as a “sale” under California's broad definition, or as “sharing” for cross-context behavioral advertising (ads chosen based on what you do in other apps and websites); under some other state laws it may count as targeted advertising. The switch is off by default.

To opt out: keep Settings → ADS → “Personalised ads” off; on iOS, turn tracking off in Settings → Privacy & Security → Tracking; on Android, delete your advertising ID. Global Privacy Control and Do Not Track signals from browsers don't reach the game; use these settings instead.

Categories we collected in the last 12 months (with their names in California law):

Identifiers: device ID hash, player code, player number, nickname, IP address; advertising ID through Google.
Commercial information: purchase records (product, transaction ID, time).
Internet or other electronic network activity: gameplay events; ad interactions through Google.
Approximate geolocation: only Google, from your IP address.
Inferences: only Google, an ad profile if you allow personalised ads.
Sensitive personal information: your player code is a credential that gives access to your account and may count as sensitive personal information under California law. We use it only to run your account, never to infer anything about you. We collect no other sensitive personal information.
Sources: you, your device and Google's SDKs. Purposes and retention: the table above and section 9. Disclosed to: our service provider Supabase, our advertising partner Google, the payment platforms Apple and Google, and other players on the leaderboards.
Your rights: to know and access the information we collected, delete it and correct it; to opt out of sale, sharing, targeted ads and profiling; and not to be treated differently for using these rights. You can also apply through an authorised agent.
How to apply: support@emhasoftware.com or “Delete all my data” in the game. If we refuse your request, you can appeal by writing to the same address; we review the appeal and tell you the result and the reasons. If you are still not satisfied, you can contact your state attorney general.
We do not sell the personal information of people we know are under 16, or share it for cross-context behavioral advertising.

15. Brazil

If you play in Brazil, the LGPD also applies. Our legal bases: performance of a contract (Art. 7 V), legitimate interest (Art. 7 IX) and consent for personalised ads (Art. 7 I).

Under LGPD Art. 18 you can ask for: confirmation that processing exists, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed with consent, information about who we share data with, information about the consequences of not giving consent, and withdrawal of consent. Our contact channel for any LGPD request is support@emhasoftware.com. You can also contact the National Data Protection Authority (ANPD): https://www.gov.br/anpd

We are responsible for the processing as controller (controlador). Supabase is a processor (operador) acting only on our instructions. We are jointly responsible with Google for the data collection by Google's SDK (section 4); Google, Apple and Google Play are responsible for their own processing. Your data is transferred to Germany, Singapore and the US for hosting (section 8).

If you don't consent, ads are shown without personalisation and the rest of the game works the same.

16. Children

Ironwave Arena is a game for a general audience and is not directed at children under 13. The game does not ask your age, and we do not knowingly collect personal data from children under 13.

If we learn that a child under 13 plays the game and their data is processed, we delete the account. Parents can request deletion by emailing support@emhasoftware.com with the child's cloud ID.

Personalised ads are off by default; in the EEA, the UK and Switzerland they are turned on only if consent is given in the consent form. In these countries the digital age of consent is between 13 and 16, depending on the country; if you are under it, do not allow personalised ads in the form unless your parent agrees. The ad content limit is set to “Teen” (T), and the game does not ask for location permission.

17. Security

No system is perfect, but we take the measures below to protect your data. If a breach puts your data at risk, we will notify the authorities as the law requires and, as far as we can reach you, notify you too.

All connections between the game and our server are encrypted with HTTPS.
The device ID and player code are stored on the server only as SHA-256 hashes.
The public API key built into the game cannot access database tables directly; the game reaches data only through limited server functions.
Only the developer manages the server; the management account is protected by two-step login and the admin panel by a secret access token.
Request limits protect the server from abuse (section 6).
Your payment details never reach us.

18. Changes to this policy

When we change this policy, we update the date at the top. If we add a new purpose or make an important change, we also mention it in the store release notes. If new processing needs your consent, we ask for it before we start. We review this policy at least once a year.

Main changes in this version: added the IP-based abuse counters in use since 3 October 2026 (section 6); corrected the information on reinstalling, restoring purchases and location; added legal bases, retention periods, international transfers and the full list of your rights.

For the KVKK information notice, the Turkish text prevails. The other language versions carry the same content; if you notice a translation error, please tell us.