Who is responsible?
PAZIL is developed and provided by Yadasoft (yadasoft.io). “We” in this policy means Yadasoft. Write to info@yadasoft.io with any question about your personal data.
If you live in Turkey, our KVKK data notice applies as well. This website uses no cookies or tracking tools; it only keeps your theme and language choice in your own browser.
What we collect
Account data. Your player name, avatar, colour, friend code and, depending on how you sign in, your e-mail address or the account ID that Apple or Google gives us. If you hide your e-mail with Sign in with Apple, we receive Apple’s relay address. With Sign in with Apple we also keep the token Apple gives us, so we can revoke your Apple sign-in when you delete your account. Passwords are stored only as a hash. E-mail accounts confirm their address with a code we send.
Game data. Match history, the boards and words of your matches, scores, trophies and league in each language, hidden skill rating, level, quests, achievements, statistics, inventory (coins, gems, power cards, cosmetics), season pass progress, private leagues, your friends list, sent and received requests, players you blocked, reports you send, and your settings.
Purchase data. The transaction ID, product, date and subscription status that the App Store or Google Play gives us. We never see card or payment details; the store takes the payment.
Device and technical data. An installation ID (used to keep your account signed in on one device at a time), device model, operating system, app version, language and region, push token (Firebase Cloud Messaging, which also delivers to iPhones through Apple’s push service) and session data. Our server uses your IP address only briefly to limit abusive traffic and does not store it. From the IP address, our network provider Cloudflare tells our server which country you connect from; we keep the country of your first and of your latest visit with your account, to see where our players come from and how well the game runs there.
Usage and diagnostics data. In-app events such as which screens you open, matches, purchases, ads, sharing and settings changes (Firebase Analytics), and crash reports (Firebase Crashlytics). These reports carry your player ID but not your name or e-mail. Analytics stays off until the ad consent check allows it; crash reports are collected so we can fix crashes.
Advertising data. Ad impressions and interactions, approximate location (country or city level from the IP address) and, if you allow it, your device’s advertising ID (IDFA on iOS, advertising ID on Android). Ads are served by Google AdMob. When you watch a rewarded ad, your player ID goes to Google so that our server can verify the reward.
Ad measurement data. Once the ad consent check allows analytics, the app uses Meta’s SDK (Meta App Events) to tell Meta that the app was installed and opened and that you finished the tutorial. With these events Meta receives device information (model, operating system, app version), your IP address and, if you allow it, your device’s advertising ID. We use this only to measure our ads on Instagram and Facebook. We do not send your name, e-mail or player ID to Meta.
Support messages. Support opens your own e-mail app with a message to info@yadasoft.io. We receive what you send: your e-mail address, your message, the topic, and the friend code and app version the app adds.
Why we use it
| Purpose | Data | Legal basis |
|---|---|---|
| Create your account and verify sign-in | Account data, installation ID | Performance of the contract |
| Match you with rivals, run duels, rankings, leagues and rewards | Account and game data | Performance of the contract |
| Verify purchases and deliver them to your account | Purchase data | Performance of the contract, legal obligation |
| Send friend invites, challenges, reminders and match notifications | Push token, game data | Performance of the contract; notification permission stays in your hands on your device |
| Prevent cheating and abuse, review reports, keep the service secure | Technical and game data, reports | Legitimate interest |
| Fix crashes | Crash reports | Legitimate interest |
| Measure, balance and improve the game | Usage data | Consent where the law requires it, otherwise legitimate interest |
| Show ads and grant rewards for rewarded ads | Advertising data | Legitimate interest; consent for personalised ads and tracking |
| Measure our ads on Instagram and Facebook | Ad measurement data | Consent where the law requires it, otherwise legitimate interest |
| Answer support requests | Support messages | Legitimate interest |
We do not send promotional e-mails. If we start, we will ask for your consent first.
Matchmaking and bots
Matchmaking uses your language, hidden skill rating, league and waiting time. It avoids a rival you played in the last few minutes and never pairs you with a player either of you blocked. If no rival is found within a few seconds, you play a computer-controlled opponent (bot) with a player-like profile. Bot matches count like other matches. We make no decisions with legal effect about you based solely on automated processing.
What other players see
Anyone who opens your profile (rivals, friends, private league members, players who have your code) sees your player name, friend code, avatar, colour and frame, level, trophies and league in each language, statistics, achievements you show, private league wins, whether you are online or in a match, your head-to-head score against them and whether you are friends.
- Leaderboards. The top players of each language and the players around you are visible to all players.
- Private leagues. Members see each other’s profiles, rank, weekly points and results.
- After a match. Both players see the word map: the boards and every word each player found.
- Sharing. When you share a moment, the link carries your player name, friend code, level, trophies, equipped cosmetics and the match details shown on the card. Anyone with the link can open that page.
In Profile > Settings, under Privacy, you can hide your online status, choose who can send you friend requests and block players. Your e-mail address is never shown to other players.
Who we share it with
We do not sell your data. We share it only with the service providers needed to run the game, and only as much as their job requires:
- Game server hosting. Account, match, friend and inventory data live on the game server we operate.
- E-mail delivery service. Sends sign-in verification and password reset codes.
- Google (Firebase). Analytics, Crashlytics and Cloud Messaging. Firebase privacy information
- Google AdMob. Ad serving and measurement, rewarded ad verification, and consent management (UMP) in the EEA, UK and Switzerland. How Google uses data from partner apps
- Meta Platforms (Meta App Events). Measuring our ads on Instagram and Facebook: app installs, app opens and finished tutorials. Meta privacy policy
- Apple and Google. Sign-in (Sign in with Apple, Google Sign-In), in-app purchases and push notifications.
Tracking. If you allow tracking on iPhone, or personalised ads, Google may link your advertising ID, ad interactions and in-app activity with data from other companies’ apps and websites to personalise and measure ads. If you don’t allow it, your advertising ID is not shared and you see general ads. In the same way, if you allow tracking, Meta may link the events above and your advertising ID with your activity on Instagram and Facebook to measure our ads; if you don’t, your advertising ID is not shared with Meta.
We may also share data with authorities when the law requires it.
International transfers
Google’s, Apple’s and Meta’s servers may be outside Turkey and the European Economic Area, for example in the United States. These transfers rely on safeguards such as standard contractual clauses under Article 9 of the KVKK and the GDPR.
How long we keep it
- Account and game data are kept while your account is open.
- When you delete your account, a 30-day grace period starts. During it you can sign in and cancel the deletion; after it, your account and game data are deleted for good and your Sign in with Apple authorisation is revoked. Details: Delete your account.
- Some records stay after deletion: purchase records for the period that tax and commercial law requires; reports, which are kept for moderation; and your name in other players’ match history.
- Crash reports are kept for 90 days, analytics data for up to 14 months.
- Support messages are kept for 2 years after the request is closed.
Children
PAZIL is designed for players aged 13 and over. We do not knowingly collect data from children under 13. If you notice such an account, write to us and we will delete it.
Your rights
You have the right to access, correct, delete and port your data, to object to processing, and to withdraw consent you gave. In Turkey the rights in Article 11 of the KVKK apply; in the EU and UK the rights under the GDPR apply. Send your request from the e-mail address linked to your account to info@yadasoft.io; we answer within 30 days. If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Authority or to the data protection authority in your country.
How to change your settings: see Privacy choices.
Security
All traffic between the app and the server is encrypted with TLS. Session keys are kept in secure storage on your device (iOS Keychain, Android Keystore). Access to the server is limited to authorised people.
Changes
If we change this policy, we update the date at the top. We also announce important changes in the app.