Document 1 of 2
Privacy Policy
Last updated: October 9, 2026 · Loyalty (Android and iOS)
We collect the data Loyalty needs to run, we don't sell it, and you can delete it together with your account at any time. This page explains what we process, why, and who we share it with.
- App
- Loyalty
- Data controller
- Buğra Han Baran (trading as BHB Studio), Istanbul, Türkiye
1
Data we collect
| Data | Why |
|---|
| Username, password, session ID | To create your account and keep sign-in secure. We never see your password; our authentication provider stores it hashed. The session ID keeps your account signed in on only one device at a time. |
| Recovery email optional | To send verification and password reset codes so you can get back into your account. |
| Game progress | Streak, total days, longest streak, Gold, hourly income, achievements, Bottomless Cave floor, HP, sword/armor and village building levels, potion stock, the heroes you own and select, your chosen profile photo, and your Last Breath runs and record — so nothing is lost when you change devices. |
| Mailbox | Gift and reward messages the game sends you, and friend requests. When you send someone a friend request, it arrives in their mailbox with your username and profile photo. |
| Purchase records | Which item you bought and the purchase/transaction ID from Google Play or the Apple App Store, to grant it once and restore purchases. Your card details never reach us; payment is handled by Google or Apple. |
| Promo code use | To make sure each player redeems a code once and to prevent guessing abuse. |
| Friends list | For the friends system and friends leaderboard. |
| Guild membership | Which guild you're in and your role in it (leader or member). If you created a guild, its name, tag and emblem are linked to your account. |
| Guild contributions | Your daily guild check-in, the damage you deal to the weekly guild boss, the hidden rewards you find in the guild region, and the day each of these happened — to calculate your guild's points and level and to grant daily rewards once. |
| Guild applications and invites | When you apply to a guild, your username is shown to that guild's leader; when someone invites you, the invite arrives in your mailbox with the guild's name. |
| Guild activity log | Events such as joining, leaving, being removed or attacking the boss are written to the guild's own log and are visible to that guild's members. |
| Battle session | When you start a battle, the server-generated parameters of that battle are stored temporarily to verify the result and prevent cheating, then replaced by your next battle. |
| Reports and blocks | When you report a player or a guild, your report (who reported whom, for what reason and on which day), and the list of players you have blocked — to keep the community safe and to stop blocked players from sending you requests. The person you report is never shown who you are. |
| Feedback messages | So we can read your suggestions and bug reports. Your username is not stored with the message. |
| Age information | To apply our age limit and the right settings for under-18s. We don't store your date of birth; if you're under 18 we keep only the date you turn 18, and for adults we keep no date at all. |
| Google Play age signal Android only · some regions | Where the law requires it (e.g. Brazil, some US states), the age range and parental supervision status reported by Google Play, used to apply age rules. |
| Cheat and abuse records | Logs of suspicious value changes, and counters for daily limits on some actions (friend requests, feedback, promo code attempts), to protect the game economy and other players. |
| Security records | Failed sign-in and password reset attempts are kept briefly together with your IP address. This blocks password guessing and stops someone from locking you out of your account on your own device. |
| Technical data | Information such as your IP address is logged as a normal part of server requests, for security and debugging. Your device's time zone is never read. |
| Advertising ID | Android: Google's advertising ID is processed by Google AdMob only when you choose to watch a rewarded ad. iOS: Apple's advertising identifier (IDFA) is passed to AdMob only if you grant tracking permission (App Tracking Transparency); if you don't, it isn't shared and ads are still shown, with limited personalization. On both platforms, so the reward goes to the right account, your random in-game account ID is sent to Google with the rewarded ad request (see section 3). |
| Approximate location | A city or country level location that Google AdMob derives from your IP address when serving ads. Your device's GPS or precise location is never read; the app holds no location permission (see section 3). |
A save file is also kept on your device, and reminder notifications are scheduled locally on your device. You can turn notification permission off in your device settings at any time. If you are under 18, streak and "we miss you" reminders are off by default; you can turn them on in Settings.
Public information: your username, profile photo (the portrait of a hero you picked), streak, Gold, Bottomless Cave floor and Last Breath record are visible to other players on leaderboards. Anyone you send a friend request to sees your username and profile photo. If you are in a guild, its name, tag and emblem appear on your profile and on leaderboards; your guild's points, level and member count are public on the guild leaderboard. Your guildmates can see your in-guild activity (joining, leaving, daily check-ins, boss damage) in the guild log. Your age, email and purchases are never shown to, or readable by, other players.
2
Legal bases
- Performance of a contract: running your account and the game, and delivering what you buy.
- Legitimate interests: security, preventing cheating and abuse, debugging.
- Legal obligation: applying age rules.
- Consent: personalized ads (where required) and the optional recovery email.
3
Ads
Loyalty never forces ads on you. Every ad is rewarded and only opens when you tap a button. Ads are served by Google AdMob, which may process your advertising ID, IP address, device information and ad interactions, as well as diagnostic and performance data (e.g. crash and load-time information), to show and measure ads; this data goes directly to Google.
To show and measure ads, AdMob may derive an approximate, city or country level location from your IP address. We never access your device's GPS or precise location; the app does not even hold a location permission.
If you're in the European Economic Area, the United Kingdom or Switzerland, Google's consent form appears before any ad so you can choose whether to allow personalized ads.
If you are under 18, you only see non-personalized ads, wherever you live. If your age hasn't been confirmed yet, or you are under 13, the ad system isn't started at all.
On iPhone and iPad: before the ad system starts, the game shows Apple's tracking permission prompt (App Tracking Transparency), only to players who have stated they are 18 or older. If you allow it, AdMob may use Apple's advertising identifier (IDFA) to personalize and measure ads; if you don't, the IDFA isn't shared. Players under 18 never see this prompt and only get non-personalized ads. Google's consent form for Europe appears on iOS in the same way.
To change your choice later: on Android, reset or delete your advertising ID under Settings → Privacy → Ads. On iPhone/iPad, go to Settings → Privacy & Security → Tracking and turn off Loyalty's permission or "Allow Apps to Request to Track". If you're in Europe, you can also change your consent choice in the game under Settings → Ad Privacy Options.
4
Age limit and children
Loyalty is for ages 13 and up and is not directed at children. We ask for your month and year of birth when you sign up. If you're under 13, no account is created, the game stays locked and no ads are shown. Apart from a temporary anonymous ID created when the game first opens (it contains no personal details such as your name or contact information) and the technical logs that are a normal part of server requests (such as your IP address), no data is kept; the anonymous ID is deleted automatically within 30 days. A block record stays on your device so the age check isn't bypassed.
If you're 13–17, you should use the game with a parent's or guardian's permission, and you only see non-personalized ads. On Android, where the law requires it, we also use Google Play's age and parental supervision information; actions that need parental approval go through Google Play's own approval flow. On iPhone and iPad, your age is set by the game's own date-of-birth question, and parental approval for purchases goes through Apple's "Ask to Buy" (Family Sharing).
If you believe a child under 13 has created an account, contact us and we'll delete it.
5
Who we share data with
We don't sell your data. We share it only with these service providers, to run the game:
| Provider | Purpose | Location |
|---|
| Supabase | Accounts, database, authentication and server functions | Germany (EU) |
| Resend | Sending verification and password reset emails | USA |
| Google AdMob | Rewarded ads and the ad consent form | USA |
| Google Play Android only | Purchases (Billing), the in-app review prompt, age signals | USA |
| Apple iOS only | App Store purchases and restoring purchases, the in-app review prompt, TestFlight beta distribution. Apple's own privacy policy applies. | USA |
| Netlify | Hosting this website; your IP address and browser details are processed when you open it | USA |
The Discord, Instagram and X links in Settings take you out of the game to those sites, where their own policies apply.
We share data only as far as necessary when legally required, for example at the request of a competent authority.
6
International transfers
Your data is processed outside Türkiye: game data in Germany (Supabase), and email, ad, Google Play, Apple purchase and website data in the USA. For transfers from Türkiye we rely on the appropriate safeguards in Article 9 of Türkiye's Personal Data Protection Law (KVKK), namely the standard contracts published by the Personal Data Protection Board; for transfers from the EU we rely on the GDPR's international transfer rules and our providers' data processing and standard contractual terms. Contact us to find out which safeguard applies.
7
How long we keep data
- Account and game data: for as long as your account exists; deleted immediately when you delete your account.
- Accounts that never chose a username: hold no game progress on our servers and are deleted automatically after 30 days of inactivity.
- Mailbox: unclaimed mail is deleted when it expires, claimed mail 30 days after you claim it. Friend requests are deleted once answered.
- Guild data: your membership is deleted when you leave or are removed from a guild; when a guild is disbanded, all of its records (log, applications, invites, contributions) are deleted. Applications and invites are deleted once answered or when they expire. Daily contribution records are deleted after a few days.
- Security records (including IP addresses): kept briefly and deleted regularly, usually within a few days.
- Cheat records: deleted after 180 days; unlinked from you earlier if your account is deleted.
- Ad reward records (used to verify the rewarded ads you watch): deleted after 90 days.
- Last Breath run records: deleted after 30 days (your record stays on your account).
- Reports: kept until reviewed and acted on, and for a reasonable time afterwards so repeated behavior can be assessed; unlinked from you when your account is deleted. Your block list is deleted with your account.
- Feedback messages: unlinked from you when your account is deleted and kept anonymously, so they can no longer be tied to you.
- Server technical logs: deleted automatically under our infrastructure provider's short retention policy.
- Data held by Google and Apple (purchase history, ad data): governed by Google's and Apple's own policies; we can't delete it.
8
Delete your account and data
In the app
- In Loyalty, tap Settings on the home screen.
- Tap Permanently Delete My Account at the bottom of the list.
- Enter your password and confirm. Your account and its data are deleted immediately; this can't be undone.
Without the app
Even if you've uninstalled the app or can't sign in, you can request deletion: email loyalty.idle@gmail.com with the subject "Account deletion" and include your username. After confirming the account is yours, we delete it within 30 days and let you know. Details: account deletion page.
Deleted: username, password, recovery email, all game progress, heroes, purchase records, promo code use, mailbox, friendships and friend requests, your guild membership and in-guild contributions, guild applications and invites, Last Breath runs, your block list, age information.
Kept: anonymized feedback messages, cheat records and reports, short-lived security records (section 7), providers' short-lived technical logs, and purchase and ad data held by Google and Apple. In-app deletion works the same way on iPhone and iPad. Deleting only some of your data without deleting your account is not currently supported.
If you lead a guild: we recommend transferring leadership to another member before deleting your account. If you don't, leadership passes automatically to another member; if the guild has no other members, it is closed and all of its records are deleted.
9
Your rights
Türkiye (KVKK)
Under Article 11 of KVKK you can learn whether your data is processed, request information, learn the purpose and recipients, ask for correction or deletion and for recipients to be notified, object, and claim compensation. You can complain to the Personal Data Protection Board.
European Union and United Kingdom (GDPR, UK GDPR)
You have the rights of access, rectification, erasure, restriction, portability and objection, and you can withdraw consent at any time where processing relies on it. You can complain to your local data protection authority (the ICO in the UK).
California (CCPA/CPRA)
You can learn what we collect, ask us to delete or correct it, and opt out of sale or sharing. We don't sell your data. AdMob's processing of your advertising ID may count as "sharing" under some readings; you can stop it in your device's ad settings or by contacting us. Exercising your rights won't lead to different treatment.
Other countries
If your local law (e.g. Brazil's LGPD, Japan's APPI, South Korea's PIPA, India's DPDP) gives you additional rights, this policy does not limit them.
For any request: loyalty.idle@gmail.com. We respond within 30 days.
10
Security
We use encrypted connections, hashed password storage, row-level access controls, server-side value checks, IP-based attempt limits and daily usage quotas. No method over the internet is perfect; we make reasonable efforts but can't guarantee absolute security.
11
Changes and contact
We may update this policy; for significant changes the date above changes and, where appropriate, we tell you in the app. Questions: loyalty.idle@gmail.com.
Document 2 of 2
Terms of Use
Last updated: October 9, 2026 · Loyalty (Android and iOS)
By downloading Loyalty and creating an account, you agree to these terms. We've tried to keep them short.
1
The service
Loyalty is an idle mobile game built around an ever-growing number. In-game Gold is entirely virtual and has no real-world monetary value.
2
Age and your account
You must be at least 13 to use Loyalty. If you're under 18, please read these terms with a parent or guardian and use the game and make purchases with their permission.
You're responsible for your username and password; don't share your password. Usernames and guild names appear on public leaderboards; we may refuse or remove offensive or impersonating names.
3
Acceptable use
You agree not to:
- Use cheats, bots, automation or anything that manipulates the game economy
- Try to access another player's account without permission
- Harass or spam others through friend requests, usernames or feedback
- Impersonate another player or Loyalty
- Use a guild name, tag or guild invites to harass, advertise or mislead
- Ask other players for passwords or personal information
- Reverse engineer the game or our servers
- Use Gold, heroes or progress for gambling, betting or real-money trading
- Abuse the service in ways that harm our servers or other players
To prevent abuse, we apply daily or hourly limits to some actions (friend requests, feedback, promo codes, sign-in and password reset attempts). When an account breaks these rules we act in proportion to how serious the breach is: a warning, reverting the affected progress, changing a username or guild name, a temporary suspension, or, for serious or repeated breaches, closing the account. Unless there is a security risk or a serious breach, we warn you first. To appeal a decision, write to loyalty.idle@gmail.com; we review and answer every appeal ourselves.
If you see an inappropriate username, guild name or behavior, you can report the player or guild in the game and block a player. We review reports and take the actions above where needed.
4
Guilds
A guild's name, tag and emblem are public and follow the same rules as usernames. We may refuse, change or close guilds whose names are offensive, abusive, discriminatory, or that impersonate another guild, brand or person.
Whoever creates a guild is its leader and is responsible for its name, who is admitted, and conduct inside the guild. A leader can remove members, and you can leave a guild at any time. If a leader leaves or deletes their account, leadership passes to another member; if there is no other member, the guild is closed.
Guild points, level, boss progress and ranking are in-game indicators only; they have no real-world value and can't be sold, transferred or traded for real money. Fake accounts or collusion aimed at manipulating the guild leaderboard count as a breach of the acceptable use rules.
5
Virtual items and purchases
Gold, heroes and other in-game items are valid only in Loyalty; they can't be exchanged for money or transferred to another player. Real-money purchases are processed by Google Play on Android and by the Apple App Store on iPhone and iPad; these stores handle payment, billing and refunds, and purchases are subject to the relevant store's refund policy and applicable consumer law. Prices are shown in the currency of the country your store account belongs to. On iOS you can request a refund from Apple at reportaproblem.apple.com. Digital content is delivered as soon as you buy it; by confirming a purchase you ask for immediate delivery. Where the law allows, this means the right of withdrawal ends on delivery (for consumers in Türkiye, Article 15(1)(ğ) of the Distance Contracts Regulation); the store's refund policy and your other statutory rights still apply.
The "Remove Ads" item gives you the rewards of the game's rewarded ads directly, without watching them (Loyalty never shows forced ads anyway).
Free gifts and rewards sent to your mailbox expire; anything not claimed in time is deleted. The mailbox has limited space, and when it's full, new free gifts may not arrive.
If you're the parent or guardian of a user under 18 and believe a purchase was made without permission, you can request a refund through Google Play or Apple, or contact us.
Not a single day can be added to the day counter or the streak with money; both grow only when you sign in each day. The Streak Shield you can buy doesn't add days; it only keeps your streak from resetting on a day you couldn't sign in.
6
Promo codes
Promo codes only grant in-game rewards, can be redeemed once per player, and can't be sold or transferred. Their duration, number of uses and rewards may change or be cancelled without notice.
7
Your feedback
Suggestions and bug reports you send remain yours; you allow us a limited, non-exclusive right to use them to improve the game, without payment or royalties.
8
Intellectual property
Loyalty's name, design, artwork and code belong to us. Apart from personal, non-commercial use (such as sharing a screenshot), they may not be copied or distributed without permission.
9
Changes to and end of the service
Loyalty is actively developed; features may be added, changed or removed. If we decide to shut the service down entirely, we'll announce it in the game at least 30 days in advance and stop real-money purchases during that period; virtual items stop being usable when the service closes. Your statutory rights as a consumer are not affected. You can close your account at any time via Settings → Permanently Delete My Account.
10
Limitation of liability
Loyalty is provided "as is". We don't guarantee uninterrupted or error-free operation. To the extent permitted by law, we're not liable for interruptions or indirect losses caused by things outside our control. This section doesn't limit your statutory rights as a consumer.
11
Governing law
These terms are governed by the laws of the Republic of Türkiye. Consumer Arbitration Committees and Consumer Courts at your place of residence have jurisdiction. If you live in another country, the mandatory consumer protection rules of your country continue to apply.
12
Additional terms for the Apple App Store
If you downloaded Loyalty from the Apple App Store, the following terms also apply:
- These terms are between you and the developer (Buğra Han Baran, trading as BHB Studio), not Apple. The developer, not Apple, is solely responsible for Loyalty and its content.
- Your license is non-transferable and allows you to use Loyalty only on Apple-branded devices that you own or control, as permitted by the Usage Rules in the App Store Terms of Service.
- The developer, not Apple, is responsible for providing any maintenance and support for Loyalty. Support: loyalty.idle@gmail.com.
- Questions, complaints or claims about Loyalty: Buğra Han Baran (trading as BHB Studio), Istanbul, Türkiye — loyalty.idle@gmail.com.
- If Loyalty fails to conform to any applicable warranty, you may notify Apple, and Apple may refund the purchase price, if any. To the maximum extent permitted by law, Apple has no other warranty obligation with respect to Loyalty.
- The developer, not Apple, is responsible for addressing any claims relating to Loyalty, including product liability claims, claims that it fails to conform to legal or regulatory requirements, consumer protection claims, and claims that Loyalty infringes a third party's intellectual property rights.
- You represent that you are not located in a country subject to a U.S. Government embargo or designated by the U.S. Government as a "terrorist supporting" country, and that you are not on any U.S. Government list of prohibited or restricted parties.
- You must comply with applicable third-party terms of agreement when using Loyalty (for example, your mobile data or internet provider's terms).
- Apple and its subsidiaries are third-party beneficiaries of these terms; once you accept them, Apple has the right to enforce them against you.
13
Changes and contact
We may update these terms; for significant changes the date above changes. If any section is found invalid, the rest remain in effect. Contact: loyalty.idle@gmail.com