Document 1 of 2
Privacy Policy
Last updated: September 18, 2026 · Loyalty (Android)
We collect the data Loyalty needs to run, we don't sell it, and you can delete it together with your account at any time. This page explains what we process, why, and who we share it with.
- App
- Loyalty
- Developer (data controller)
- BHB Studio
1
Data we collect
| Data | Why |
|---|
| Username, password, session ID | To create your account and keep sign-in secure. We never see your password; our authentication provider stores it hashed. The session ID keeps your account signed in on only one device at a time. |
| Recovery email optional | To send verification and password reset codes so you can get back into your account. |
| Game progress | Streak, total days, longest streak, Gold, hourly income, achievements, Bottomless Cave floor, HP, sword/armor and village building levels, potion stock, the heroes you own and select, your chosen profile photo, and your Last Breath runs and record — so nothing is lost when you change devices. |
| Mailbox | Gift and reward messages the game sends you, and friend requests. When you send someone a friend request, it arrives in their mailbox with your username and profile photo. |
| Purchase records | Which item you bought and Google Play's purchase ID, to grant it once and restore purchases. Your card details never reach us. |
| Promo code use | To make sure each player redeems a code once and to prevent guessing abuse. |
| Friends list | For the friends system and friends leaderboard. |
| Feedback messages | So we can read your suggestions and bug reports. Your username is not stored with the message. |
| Age information | To apply our age limit and the right settings for under-18s. We don't store your date of birth; if you're under 18 we keep only the date you turn 18, and for adults we keep no date at all. |
| Google Play age signal some regions | Where the law requires it (e.g. Brazil, some US states), the age range and parental supervision status reported by Google Play, used to apply age rules. |
| Cheat and abuse records | Logs of suspicious value changes, and counters for daily limits on some actions (friend requests, feedback, promo code attempts), to protect the game economy and other players. |
| Security records | Failed sign-in and password reset attempts are kept briefly together with your IP address. This blocks password guessing and stops someone from locking you out of your account on your own device. |
| Technical data | Information such as your IP address is logged as a normal part of server requests, for security and debugging. Your device's time zone is never read. |
| Advertising ID | Processed by Google AdMob only when you choose to watch a rewarded ad (see section 3). |
A save file is also kept on your device, and reminder notifications are scheduled locally on your device. You can turn notification permission off in your device settings at any time.
Public information: your username, profile photo (the portrait of a hero you picked), streak, Gold, Bottomless Cave floor and Last Breath record are visible to other players on leaderboards. Anyone you send a friend request to sees your username and profile photo. Your age, email and purchases are never shown.
2
Legal bases
- Performance of a contract: running your account and the game, and delivering what you buy.
- Legitimate interests: security, preventing cheating and abuse, debugging.
- Legal obligation: applying age rules.
- Consent: personalized ads (where required) and the optional recovery email.
3
Ads
Loyalty never forces ads on you. Every ad is rewarded and only opens when you tap a button. Ads are served by Google AdMob, which may process your advertising ID, IP address, device information and ad interactions to show and measure ads; this data goes directly to Google.
If you're in the European Economic Area, the United Kingdom or Switzerland, Google's consent form appears before any ad so you can choose whether to allow personalized ads.
If you are under 18, you only see non-personalized ads, wherever you live.
You can reset or delete your advertising ID on Android under Settings → Privacy → Ads.
4
Age limit and children
Loyalty is for ages 13 and up and is not directed at children. We ask for your month and year of birth when you sign up. If you're under 13, no account is created and no data is collected from you.
If you're 13–17, you should use the game with a parent's or guardian's permission, and you only see non-personalized ads. Where the law requires it, we also use Google Play's age and parental supervision information; actions that need parental approval go through Google Play's own approval flow.
If you believe a child under 13 has created an account, contact us and we'll delete it.
5
Who we share data with
We don't sell your data. We share it only with these service providers, to run the game:
| Provider | Purpose | Location |
|---|
| Supabase | Accounts, database, authentication and server functions | Germany (EU) |
| Resend | Sending verification and password reset emails | USA |
| Google AdMob | Rewarded ads and the ad consent form | USA |
| Google Play | Purchases (Billing), the in-app review prompt, age signals | USA |
| Netlify | Hosting this website; your IP address and browser details are processed when you open it | USA |
The Discord, Instagram and X links in Settings take you out of the game to those sites, where their own policies apply.
We share data only as far as necessary when legally required, for example at the request of a competent authority.
6
International transfers
Your data is processed outside Türkiye: game data in Germany (Supabase), and email, ad, Google Play and website data in the USA. We make these transfers under Article 9 of Türkiye's Personal Data Protection Law (KVKK) and the GDPR's international transfer rules, relying on the data processing and standard contractual terms our providers offer. Contact us to find out which safeguard applies.
7
How long we keep data
- Account and game data: for as long as your account exists; deleted immediately when you delete your account.
- Accounts that never chose a username: hold no game progress on our servers and are deleted automatically after 30 days of inactivity.
- Mailbox: unclaimed mail is deleted when it expires, claimed mail 30 days after you claim it. Friend requests are deleted once answered.
- Security records (including IP addresses): kept briefly and deleted regularly, usually within a few days.
- Feedback messages and cheat records: unlinked from you when your account is deleted and kept anonymously, so they can no longer be tied to you.
- Server technical logs: deleted automatically under our infrastructure provider's short retention policy.
- Data held by Google (purchase history, ad data): governed by Google's own policies; we can't delete it.
8
Delete your account and data
In the app
- In Loyalty, tap Settings on the home screen.
- Tap Permanently Delete My Account at the bottom of the list.
- Enter your password and confirm. Your account and its data are deleted immediately; this can't be undone.
Without the app
Even if you've uninstalled the app or can't sign in, you can request deletion: email loyalty.idle@gmail.com with the subject "Account deletion" and include your username. After confirming the account is yours, we delete it within 30 days and let you know. Details: account deletion page.
Deleted: username, password, recovery email, all game progress, heroes, purchase records, promo code use, mailbox, friendships and friend requests, Last Breath runs, age information.
Kept: anonymized feedback messages and cheat records, short-lived security records (section 7), providers' short-lived technical logs, and purchase and ad data held by Google. Deleting only some of your data without deleting your account is not currently supported.
9
Your rights
Türkiye (KVKK)
Under Article 11 of KVKK you can learn whether your data is processed, request information, learn the purpose and recipients, ask for correction or deletion and for recipients to be notified, object, and claim compensation. You can complain to the Personal Data Protection Board.
European Union and United Kingdom (GDPR, UK GDPR)
You have the rights of access, rectification, erasure, restriction, portability and objection, and you can withdraw consent at any time where processing relies on it. You can complain to your local data protection authority (the ICO in the UK).
California (CCPA/CPRA)
You can learn what we collect, ask us to delete or correct it, and opt out of sale or sharing. We don't sell your data. AdMob's processing of your advertising ID may count as "sharing" under some readings; you can stop it in your device's ad settings or by contacting us. Exercising your rights won't lead to different treatment.
Other countries
If your local law (e.g. Brazil's LGPD, Japan's APPI, South Korea's PIPA, India's DPDP) gives you additional rights, this policy does not limit them.
For any request: loyalty.idle@gmail.com. We respond within 30 days.
10
Security
We use encrypted connections, hashed password storage, row-level access controls, server-side value checks, IP-based attempt limits and daily usage quotas. No method over the internet is perfect; we make reasonable efforts but can't guarantee absolute security.
11
Changes and contact
We may update this policy; for significant changes the date above changes and, where appropriate, we tell you in the app. Questions: loyalty.idle@gmail.com.
Document 2 of 2
Terms of Use
Last updated: September 18, 2026 · Loyalty (Android)
By downloading Loyalty and creating an account, you agree to these terms. We've tried to keep them short.
1
The service
Loyalty is an idle mobile game built around an ever-growing number. In-game Gold is entirely virtual and has no real-world monetary value.
2
Age and your account
You must be at least 13 to use Loyalty. If you're under 18, you should use the game and make purchases with a parent's or guardian's permission, and they are deemed to accept these terms on your behalf.
You're responsible for your username and password; don't share your password. Usernames appear on public leaderboards; we may refuse or remove offensive or impersonating usernames.
3
Acceptable use
You agree not to:
- Use cheats, bots, automation or anything that manipulates the game economy
- Try to access another player's account without permission
- Harass or spam others through friend requests, usernames or feedback
- Impersonate another player or Loyalty
- Ask other players for passwords or personal information
- Reverse engineer the game or our servers
- Use Gold, heroes or progress for gambling, betting or real-money trading
- Abuse the service in ways that harm our servers or other players
To prevent abuse, we apply daily or hourly limits to some actions (friend requests, feedback, promo codes, sign-in and password reset attempts). We may suspend or delete accounts that break these rules without notice.
4
Virtual items and purchases
Gold, heroes and other in-game items are valid only in Loyalty; they can't be exchanged for money or transferred to another player. Real-money purchases are processed by Google Play and are subject to Google Play's refund policy and applicable consumer law. Digital content is delivered as soon as you buy it.
Free gifts and rewards sent to your mailbox expire; anything not claimed in time is deleted. The mailbox has limited space, and when it's full, new free gifts may not arrive.
If you're the parent or guardian of a user under 18 and believe a purchase was made without permission, you can request a refund through Google Play or contact us.
The day counter and streak, earned only by signing in each day, can never be bought.
5
Promo codes
Promo codes only grant in-game rewards, can be redeemed once per player, and can't be sold or transferred. Their duration, number of uses and rewards may change or be cancelled without notice.
6
Your feedback
Suggestions and bug reports you send remain yours; you allow us a limited, non-exclusive right to use them to improve the game, without payment or royalties.
7
Intellectual property
Loyalty's name, design, artwork and code belong to us. Apart from personal, non-commercial use (such as sharing a screenshot), they may not be copied or distributed without permission.
8
Changes to and end of the service
Loyalty is actively developed; features may be added, changed or removed. If we shut the service down entirely, we'll try to give reasonable notice. You can close your account at any time via Settings → Permanently Delete My Account.
9
Limitation of liability
Loyalty is provided "as is". We don't guarantee uninterrupted or error-free operation. To the extent permitted by law, we're not liable for interruptions or indirect losses caused by things outside our control. This section doesn't limit your statutory rights as a consumer.
10
Governing law
These terms are governed by the laws of the Republic of Türkiye. Consumer Arbitration Committees and Consumer Courts at your place of residence have jurisdiction. If you live in another country, the mandatory consumer protection rules of your country continue to apply.
11
Changes and contact
We may update these terms; for significant changes the date above changes. If any section is found invalid, the rest remain in effect. Contact: loyalty.idle@gmail.com