Last updated: 1 August 2026 · Version 2026-08-01-v5
Controller: The operator of the Novara Blast service (“Novara Blast”, “we”, “us”). For privacy and support requests, use our secure contact form or write to [email protected].
In short: If you play as a guest we never collect your name or email address. If you register, we process only what is needed to run your account. We do not sell personal data. You can delete your account and its data yourself inside the app.
1. Scope and purpose
This Privacy Policy explains how personal data is collected, used, shared, protected and deleted across the Novara Blast mobile game, website, player accounts, support channels and related online services. It is designed with Turkish KVKK, the GDPR where applicable and relevant platform rules in mind.
2. Data categories we process
- Account and identity: Guest player ID, install ID, display name and, for registered accounts, email address and password hash; provider user ID and verification result when an enabled social login is used.
- Device and application: Device / install keys, operating system, platform, application and content version, locale, time zone, security signals derived from IP address and push notification token.
- Gameplay and economy: Level, score, progress, gold, inventory, quests, achievements, wheel / reward records, leaderboard results and game session summaries.
- LiveOps and preferences: Campaign impression / click / dismiss events, announcement views, survey answers, notification, language, audio, theme, analytics and advertising preferences.
- Security and technical logs: Request IDs, API access logs, session times, error and crash data, performance signals, suspicious transaction and abuse indicators.
- Purchases: Store product and transaction ID, verification result, currency and amount. Full card or payment instrument details never reach us.
- Contact and support: Name, email, subject, message, screenshots, technical device information and support history submitted through contact forms or bug reports. For web forms, the IP address is transformed into a pseudonymous HMAC digest rather than stored in plaintext, while limited browser information is retained.
- Referral and social features: Referral code, referral relationship and reward status; display name and score shown on leaderboards.
If a feature is disabled or you have not granted a required permission, data specific to that feature is not processed. We do not collect plaintext passwords, full payment card numbers or unrelated content from your device.
3. Why we use data
- To create accounts, authenticate users and synchronize progress across devices.
- To operate game rules, economy, quests, rewards, leaderboards and LiveOps.
- To validate purchases against store records and deliver entitlements.
- To send notifications and transactional emails you request.
- To answer support requests and troubleshoot technical issues.
- To detect cheating, fraudulent transactions, unauthorized access, automation and service abuse.
- To run analytics, measure the experience and personalize advertising to the extent you consent.
4. Legal bases
- Contract performance: Accounts, gameplay progress, synchronization, support and purchase entitlements.
- Legitimate interests: Service security, fraud prevention, essential measurement, debugging and maintaining service quality.
- Consent: Non-essential analytics, personalized advertising and similar processing where consent is legally required.
- Legal obligations and legal claims: Financial records, lawful authority requests, disputes and rights requests.
5. Consent and privacy choices
Where these controls are available in the application version, optional analytics and personalized-advertising choices can be managed at device / platform level. Core account, security and gameplay functions do not depend on those permissions. Where an advertising feature requires tracking on iOS, App Tracking Transparency (ATT) permission is requested separately. Withdrawal does not invalidate processing lawfully carried out before withdrawal.
6. Service providers and transfers
Data may be shared, only as necessary to operate the service, with:
- Cloud hosting, database, cache, content delivery, security and technical logging providers.
- Apple App Store and Google Play for distribution and purchase processing.
- Google, Apple or Meta (Facebook) when the relevant social login provider is enabled and selected.
- Firebase Cloud Messaging / Apple Push Notification Service and Brevo or an equivalently configured transactional-email provider.
- Depending on configuration and your choices, Google Mobile Ads (AdMob), Firebase Analytics / Crashlytics, AppsFlyer and Sentry.
- When enabled, Cloudflare Turnstile for web-form bot protection and Telegram for optional social-task verification.
- Public authorities and professional advisers where legally required.
Providers process data under instructions and security obligations. Infrastructure or providers may be located in other countries; where applicable, contractual and technical transfer safeguards are used. We do not sell personal data.
7. Retention and deletion
You can delete your account yourself in the app under Settings → Account → Delete account. Deletion takes effect immediately, with no waiting period. If you no longer have access to the app, request it through our contact form or at [email protected].
Deleted immediately: email address, password hash, display name, linked Google / Apple / Facebook identities, email and phone verification records, registered push devices and tokens, and all active sessions.
Retained after deletion, and for how long — these records are attached only to a technical player number and no longer identify you:
- Gameplay progress, gold, inventory and achievements: the account becomes a non-identifiable guest record kept pseudonymously for service integrity.
- Purchase, entitlement and financial records: as a rule 10 years, required by financial legislation.
- Security, sign-in and session audit logs: up to 12 months for cheat and fraud prevention.
- Referral relationships: up to 12 months to prevent abuse.
- Support correspondence and bug reports: up to 24 months after the request is closed.
- Technical error and performance logs: up to 90 days.
At the end of these periods, data is deleted, destroyed or irreversibly anonymised. Deleting your account does not cancel a Novara Elite subscription; you must cancel it separately in your Apple or Google account settings.
8. Security
We use administrative and technical controls such as transport security, access controls, password hashing, token expiry, rate limiting, audit logs and abuse detection. No system can guarantee absolute security; please report suspected incidents through the secure contact form.
9. Automated security decisions
Anti-cheat and fraud signals may reject a suspicious transaction or temporarily restrict access to specific features. If you believe a result is incorrect, you may ask support for human review.
10. Your rights
Under KVKK Article 11 and the GDPR where applicable, you may have rights to information, access, rectification, erasure, restriction, objection, withdrawal of consent and data portability. Use the in-app account deletion tool or our secure contact form. We may need to verify your identity and relationship to the account.
11. Children’s privacy
Novara Blast is not specifically directed to children under 13 or a higher digital-consent age required by local law. If we learn that we knowingly collected data from such a child, we take steps to delete it and close the related account.
12. Changes
We may update this Policy as the service or law changes. The version and publication date appear at the top; material changes may be announced in the application and renewed consent may be requested where required.
13. Contact and requests
For privacy questions, data-subject requests or security reports, use our secure encrypted contact form or write to [email protected]; entering “Privacy / KVKK” as the subject speeds up handling. Requests are answered free of charge within 30 days at the latest.