Privacy Policy

Effective date: 30 October 2026

The short version

• No name, no email

  You play as a guest with a nickname. We never ask for your real name, email address, phone number or location.

• Game data only

  We keep what the game needs: your profile, scores, friends, bluffs, purchases and safety reports.

• Ads by Google

  Free players see ads from Google AdMob. Where the law requires it, you choose whether ads may use your data, and you can change that under Ad privacy choices.

• Delete any time

  Settings → Delete account removes your data straight away. Only anonymous purchase records stay, because tax law requires them.

This policy explains how Halmob ("we", "us") handles personal data when you use the Bluff mobile app and the website livetrivia.app (together, "Bluff"). Halmob is the data controller (under Turkey's KVKK, the veri sorumlusu). You can reach us at support@livetrivia.app. We have not appointed a data protection officer; please send all privacy requests to that address.

Contents

1. What we collect
2. How we use it and our legal bases
3. Advertising and your choices
4. Who we share it with
5. International transfers
6. How long we keep it
7. Deleting your account
8. Your rights
9. Turkey (KVKK)
10. EEA, UK and Switzerland (GDPR)
11. United States (CCPA/CPRA and other state laws)
12. Children
13. Security
14. Changes and contact

1. What we collect

Account identifiers. On first launch the app creates a random identifier and stores it on your device. We call it the device ID. It is not your phone's hardware ID or advertising ID. We link it to a random user ID on our servers, and that link is your guest account. If you sign in with Apple or Google (once the app offers it), we receive and store only the account identifier that provider gives us. We do not receive or store your email address or name from Apple or Google.

Profile. Your nickname, the avatar mask you pick, your language, level and experience points, and badges. If Bluff offers an adult mode, we also store whether you have confirmed you are 18 or older.

Gameplay. The rooms you create or join, the fake answers ("bluffs") you write each round, the answers you pick, scores, rankings, game results and statistics shown on your profile and on leaderboards.

Social features. Your friends, friend requests, nudges and in-app notifications. We also record when you were last active and which room you are in, so friends can see whether you are online. Other players can find you by searching for your nickname.

Safety. Reports you send or receive. A report includes the reason, the player, and a copy of the reported nickname or bluff at the time of the report. We also store the players you block, and the time an offensive nickname was reset.

Wallet and purchases. Your coins, gems and energy, daily-reward streak, room passes and rewarded-ad grants, and your Bluff+ status. For purchases we store the store's transaction ID, the product, the platform (App Store or Google Play) and the date. Payments are handled entirely by Apple or Google. We never see your card or bank details.

Advertising data. Google AdMob, which runs inside the app, collects data such as your device's advertising ID, IP address, device and app information, and how you interact with ads. Google's consent tool stores your ad privacy choice on your device. When you earn a reward from an ad, Google confirms the view to our server.

Technical data. Your device sends its IP address and basic request data (such as the time and the address requested) whenever it talks to our servers. We use your IP address only briefly, to deliver the request and to rate-limit abuse, and we do not store it in our database. Our host, Cloudflare, processes it to deliver and protect the service.

Support messages. If you email us, we receive your email address, your message and anything you attach. That includes any details the app adds to the email so we can find your account, such as your user ID, device ID, app version and device model.

What we do not collect. Bluff has no private messages and no voice chat. It does not use your contacts, photos, camera, microphone or precise location. It has no analytics or crash-reporting tools.

2. How we use it and our legal bases

• Running the game: your account, rooms, scoring, leaderboards, friends, notifications, rewards and your wallet. Legal basis: performance of our contract with you (our Terms).
• Purchases and Bluff+: delivering what you bought, restoring purchases and handling refunds. Legal basis: contract. Keeping purchase records: legal obligation (tax and accounting law).
• Safety and moderation: word filters, reports, blocks, resetting offensive nicknames, and enforcing our Terms. Legal basis: our legitimate interest in a safe, fair game, and contract.
• Security and abuse prevention: rate limits and preventing fraud, cheating and reward abuse. Legal basis: legitimate interests.
• Ads that use personal data (personalised ads and ad measurement): consent where the law requires it, otherwise legitimate interests. See Advertising.
• Age confirmation for an adult mode, if offered: legal obligation and legitimate interests.
• Support: answering your messages. Legal basis: contract and legitimate interests.

Where we rely on legitimate interests, we have balanced them against your rights. You can object at any time (see Your rights). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Nicknames are reset automatically only after several separate player reports, and you can ask us to review a reset.

3. Advertising and your choices

Bluff is free and is paid for by ads from Google AdMob, including optional rewarded ads that you can choose to watch for in-game rewards. Bluff+ subscribers do not see ads.

In the EEA, the UK and Switzerland, and wherever else the law requires it, the app shows Google's consent message (User Messaging Platform) before ads use personal data. You can change your choice at any time under Settings → Ad privacy choices. If you decline, you may still see non-personalised ads, which use only limited data such as your general location from your IP address and the app you are using.

In US states with privacy laws, using your data for personalised ads may count as "sharing" or "targeted advertising". You can opt out under Settings → Ad privacy choices where the app shows it, or by emailing us. You can also reset or delete your advertising ID, or limit ad tracking, in your phone's settings. Learn more about how Google uses data in ads.

4. Who we share it with

We share data only with these service providers, each under a contract that limits how they may use it:

• Cloudflare, Inc.: hosting, database and network security for our servers and this website.
• Google LLC / Google Ireland Ltd: AdMob ads and the consent tool, Google Play billing, and Sign in with Google if you use it. For personalised ads, Google acts as an independent controller under its own privacy policy.
• Apple Inc. / Apple Distribution International: App Store billing and Sign in with Apple if you use it.
• Our email provider: to receive and answer support emails.

Other players see your nickname, mask, level, badges, game statistics and, in a room, your bluffs and scores. Friends also see your online status. We may disclose data if the law requires it, to protect players or the service, or as part of a merger or sale of the business, in which case this policy continues to apply. We do not sell your personal data.

5. International transfers

Halmob is based in Turkey. Cloudflare and Google process data in the United States and other countries. We transfer it on these bases:

• From the EEA: the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.
• From the UK: the UK International Data Transfer Addendum.
• From Switzerland: the Swiss equivalents.
• From Turkey: standard contracts under KVKK Article 9, notified to the Personal Data Protection Authority as required.

You can ask us for a copy of the relevant safeguards.

6. How long we keep it

• Account, profile, game results, friends, wallet and blocks: until you delete your account, then deleted straight away (see below).
• Bluffs stored with each round: 12 months, then deleted automatically. A bluff that a report still points to is kept as long as that report, so the report can be reviewed.
• Reports: 2 years from the report, then deleted automatically. They are deleted sooner if either player deletes their account.
• Notifications: unread notifications stay until you read them or delete your account. Read notifications are deleted automatically 6 months after they were sent.
• Purchase records (transaction ID, product, platform, date): kept while your account exists. After account deletion they are kept with the link to you removed, for tax, accounting, refund and fraud purposes, and deleted automatically 10 years after the purchase.
• Database backups: deleted data can remain in our database's point-in-time backups for up to 30 days, until they are overwritten.
• IP addresses: not stored by us. Cloudflare keeps short-lived security and request logs under its own policies.
• Support emails: up to 2 years after the conversation ends, unless we need them longer to handle a legal claim.
• Data held by Google or Apple (ads, billing, sign-in) is kept under their own policies.

7. Deleting your account

Open Settings → Delete account and confirm twice. We immediately and permanently delete the following:

• your account and the link to your device ID or Apple or Google identifier
• your profile, badges, game results, the bluffs stored with each round, and rewarded-ad grants
• friends, friend requests and notifications in both directions
• reports you made or received, and blocks in both directions
• your wallet

In any room that is still open, you are shown as "Deleted player". The only thing we keep is the purchase records described above, with the link to you removed. Deleting your account does not cancel a Bluff+ subscription; cancel it in your App Store or Google Play settings. Uninstalling the app does not delete your account, because the data stays on our servers. If you no longer have the app, email us from any address with your nickname, and we will verify the request and delete the account for you.

8. Your rights

Depending on where you live, you may have the right to:

• access your data or get a copy of it
• correct it
• delete it
• receive it in a portable format
• object to or restrict some processing
• withdraw consent at any time, without affecting earlier processing
• opt out of targeted advertising
• not be treated differently for using these rights

You can change your nickname and mask, your ad choices, and delete your account yourself in the app. For anything else, email support@livetrivia.app. We may ask for details that link you to the account, such as your nickname or the user ID shown in the app, and we reply within one month (30 days under KVKK, 45 days under US state laws). An authorised agent may make a request for you with your signed permission.

9. Turkey (KVKK)

Under Law No. 6698 on the Protection of Personal Data, we process the data in section 1 for the purposes in section 2, on these grounds in Article 5:

• the performance of a contract
• compliance with legal obligations
• our legitimate interests
• your explicit consent, for personalised ads where required

We collect it automatically through the app. Under Article 11 you may:

• learn whether we process your data, and request information about it
• learn the purpose and whether data is used for that purpose
• know the recipients in Turkey and abroad
• request correction or deletion, and notification of this to recipients
• object to a result against you arising solely from automated analysis
• claim compensation for damage caused by unlawful processing

Send applications to support@livetrivia.app. If you are not satisfied with our answer, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

10. EEA, UK and Switzerland (GDPR)

Our legal bases for each purpose are listed in section 2, and the rights in section 8 apply in full. You can lodge a complaint with the data protection authority where you live or work, or where an alleged infringement took place. In the UK this is the Information Commissioner's Office, and in Switzerland the FDPIC. We would appreciate the chance to resolve your concern first.

11. United States (CCPA/CPRA and other state laws)

In the last 12 months we collected these categories of personal information:

• Identifiers: user ID, device ID, Apple or Google account identifier, IP address, and the advertising ID, which AdMob collects.
• Commercial information: purchase records and Bluff+ status.
• Internet or other electronic activity: gameplay, social and ad interactions.
• Profile information: nickname, mask, language and age confirmation.

The sources, purposes, recipients and retention periods are described in sections 1, 2, 4 and 6. We do not collect sensitive personal information, and we do not sell personal information.

We disclose identifiers and activity data to Google for personalised advertising. This may count as "sharing" for cross-context behavioural advertising, or as "targeted advertising". You can opt out as described in section 3. We disclose the categories above to our service providers for business purposes: hosting, billing and support. We do not knowingly sell or share the personal information of consumers under 16.

You have the right to:

• know what we collect and how we use it
• access, delete and correct your data
• opt out of sale, sharing and targeted advertising
• not be discriminated against for using these rights

If your request is denied, you can appeal by replying to our answer. If the appeal is denied, you can contact your state attorney general.

12. Children

Bluff is not directed to children under 13. To use Bluff you must be at least 13, or older where the law of your country sets a higher age for consenting to online services. In some EEA countries that age is up to 16. If Bluff offers an adult mode, it is only for people aged 18 or over.

We do not knowingly collect personal data from children under these ages. If we learn that we have, we delete the account. Parents or guardians who believe a child is using Bluff can contact us, and we will delete the account.

13. Security

All traffic between the app and our servers is encrypted (HTTPS). Access to the production systems is limited, and purchase receipts are verified with Apple and Google. No system is perfectly secure. If a breach affects you, we will notify you and the authorities as the law requires.

14. Changes and contact

We will update this policy when Bluff changes and update the effective date above. For important changes, we will also tell you in the app before they take effect. Questions or requests: support@livetrivia.app.