Last updated October 12, 2026
ToppleBloom privacy policy
You play ToppleBloom without creating an account; for the leaderboard the game gives you a player code. Signing in with Google or Apple is optional. The game shows ads through Google AdMob, and there is no analytics, crash reporting, location, camera, microphone, contacts or chat. This page says exactly what leaves your device, why, and how to delete it.
In short
You play ToppleBloom without creating an account. For the leaderboard, the game automatically gives you a player code (e.g. M238972789103N). Other players only see this code, the highest level you have unlocked and your avatar.
Signing in with Google or Apple is optional. If you sign in, your name appears on the leaderboard as “Ayşe Y.-1” and your progress is saved to the cloud so it is kept across your devices.
The game shows ads through Google AdMob. In the EU, UK and Switzerland we ask for your consent before ads. On iPhone we do not show the tracking prompt (ATT) and we do not read your Apple advertising identifier.
There is no analytics, crash reporting, location, camera, microphone, contacts or chat. We do not sell your data.
You can delete your account in the game with Settings › Delete my account. Other options: Retention and deletion.
Who we are
This policy applies to the ToppleBloom mobile game (iOS and Android). The game is published by Kaya Can Kaya (Team Eks Games), İzmir, Türkiye, the data controller for the matters in this policy. Contact: teameksgames@gmail.com
What stays on your device
Game progress and its backup (levels, leaves, items, rescued creatures, Haven and Album), settings (sound, music, vibration, reduce shake/flash, language), the daily-reward day, the ad frequency counter and session data (sign-in key, your name, your player code) are stored only on your device.
While the game is open, it reads your device language, your “Reduce Motion” setting and whether another app is playing audio. These are not stored or sent.
On Android, the sign-in library (Credential Manager) declares a biometric authentication permission. No fingerprint or face data ever reaches the game.
If iCloud or Google backup is on, the operating system may include these files in the device backup in your own account. We cannot access those backups.
Leaderboard and player code (Firebase Authentication + Cloud Firestore)
When the game opens, if you are online, an anonymous account is created for you on Google Firebase. There is no sign-in screen; no name, email or phone number is requested.
Only the following is written to the cloud: a random technical user ID, the player code the game assigns at random (players cannot type a name), the highest level you have unlocked, your avatar (the species code of your highest-level creature in the Haven) and the time of the last update. A “code → ID” mapping is also stored so that no two players share a code.
Other players of the game see this on the leaderboard.
There is no free text, chat or messaging.
Account and cloud save (optional: Google / Apple)
You can sign in with your Google or Apple account in Settings. Signing in is optional; if you don't, the player code is used.
When you sign in, Firebase Authentication stores the account's ID, your name, the sign-in type and, for Google sign-in only, your email address. We do not request your email from Apple. We never receive your password, photo or friends list.
Instead of the player code, the leaderboard shows only your first name and last initial, followed by a number that separates people with the same name (e.g. “Ayşe Y.-1”). Your full last name and email are never shown to any player. A “name → ID” record is kept so that each name stays unique.
Cloud save: your progress (levels, in-game currency and items, rescued creatures, Haven and Album) is stored in Cloud Firestore under your account, so it comes back when you reinstall the game or sign in with the same account on another device. Only you can read it. Your settings are not uploaded.
Turning off Show me on the leaderboard deletes your leaderboard entry; turning it back on writes it again.
Sign out deletes your leaderboard entry; your account and cloud save stay for when you sign in again.
Ads (Google AdMob)
The game shows ads through Google AdMob: at most one full-screen interstitial ad every 4 games, and optional rewarded ads (watching one is your choice; at most 12 per day). Ad content is limited to a general-audience level (at most PG).
To deliver and measure ads, cap their frequency and prevent fraud, AdMob may process: your IP address and the approximate location derived from it, device and app information, ad interactions, device or app identifiers and diagnostic data. On Android this includes the advertising ID, which you can reset or delete in your device settings.
On iPhone and iPad we do not show the tracking prompt (ATT); the Apple advertising identifier (IDFA) is not read, and we do not track you across other companies' apps and websites.
In the EU, UK and Switzerland, Google's consent form is shown before any ads. If you do not consent, only non-personalized or limited ads are shown. You can change your choice at any time in the game under Settings › Ad privacy.
How Google uses ad data: policies.google.com/technologies/partner-sites
In-app purchases
In-app purchases are handled entirely by the App Store / Google Play. We never see or store your card or payment details.
Purposes and legal bases
Leaderboard, account and cloud save (ID, player code, level, avatar; if signed in, name, email, sign-in type, progress): to provide these game features. Legal basis: necessary to provide the service (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
IP address and device information (Firebase): to prevent fake accounts and abuse. Legal basis: legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
Ads: to offer the game for free. In the EU, UK and Switzerland, the legal basis for personalized ads and storing information on your device is your consent (GDPR Art. 6(1)(a)). For other ad processing: legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
Emails you send us: to answer your request. Legal basis: legitimate interest; for requests about your data protection rights, legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).
We do not use your data for profiling or automated decisions about you.
Third parties and international transfers
We do not sell your data. It is processed only by:
Google Firebase (Google LLC / Google Cloud, processing on our behalf): game saves and the leaderboard are kept in Cloud Firestore in the European Union (Belgium and the Netherlands, with a witness replica in Finland). Account records (ID, name, email) are in Firebase Authentication, which Google runs only from data centers in the United States, so your account data is transferred to the US. The transfer relies on the standard contractual clauses in Google's data processing terms (GDPR Art. 46; KVKK Art. 9). firebase.google.com/support/privacy
Google AdMob (Google LLC / Google Ireland): processes ad data under its own policies; data may be processed in other countries, including the US.
Sign in with Google / Sign in with Apple: the sign-in window is shown by Google or Apple and is governed by their own policies (policies.google.com/privacy, apple.com/legal/privacy).
Other players: see your player code or shortened name, your level and your avatar on the leaderboard.
App Store and Google Play: downloads, your store account and purchases are governed by Apple's and Google's policies. If you turned on sharing diagnostics in your device settings, the platform may show us crash and performance statistics that do not identify you.
Email: correspondence may be stored on our email provider's (Google) servers outside your country.
Retention and deletion
Settings › Delete my account › Yes, delete immediately and permanently deletes your Firebase account (ID, name, email), your cloud save, your leaderboard entry, your name record and your player-code mapping. If you signed in with Apple, the app's authorization at Apple is also revoked. The progress on your device stays in the game. Google also removes deleted data from its backup systems within 180 days.
If you never signed in, or cannot access the game: the anonymous account and leaderboard entry stay in the cloud even if you delete the game. To have them deleted, email teameksgames@gmail.com with the subject “ToppleBloom data deletion” and your player code (shown in Settings) or, for a signed-in account, its name and email address. We delete it within 30 days.
IP addresses are kept by Google for a few weeks.
Ad data is subject to Google's own retention periods; the in-game delete button does not remove it. On Android you can reset or delete your advertising ID in your device settings.
Files on your device are removed when you delete the game. On Android, to reset the game without deleting it: Settings › Apps › ToppleBloom › Storage › Clear data (menu names may vary by device).
Emails are deleted within 12 months after your request is resolved; you can ask us to delete them sooner at any time.
Children
ToppleBloom is made for players aged 13 and over; it is not directed to children under 13 and we do not knowingly collect data from them. The game can be played without signing in; as a guest, the leaderboard shows only your player code, never your real name. If you are under the age of digital consent in your country (13–16 in the EU, depending on the country), ask a parent or guardian before signing in. There is no chat or communication with other players. A parent or guardian can ask us to delete a child's data at teameksgames@gmail.com; the player code or the name shown on the leaderboard is enough.
Your rights
If you are in the EU or UK, under GDPR Articles 15–22 you have the right of access, rectification, erasure, restriction, data portability and objection, and you can withdraw consent at any time. Under Article 11 of the Turkish Personal Data Protection Law No. 6698 (KVKK), you have the right to learn whether your data is processed, request information, learn the purpose and the third parties it is transferred to, request correction and deletion and their notification to those third parties, object to an adverse result arising solely from automated analysis, and claim compensation.
Send your request to teameksgames@gmail.com; we answer free of charge within 30 days. If you are not satisfied, you can complain to your local data protection authority or to the Turkish Personal Data Protection Board. On request we can also send you a copy of your cloud save.
Security
Data sent to the cloud travels over an encrypted connection (HTTPS). Access rules ensure that only you can read your cloud save and only you can write your leaderboard entry. Files on your device sit in the protected storage the operating system gives each app.
Changes
If the game starts processing new data (for example analytics), this policy will be updated before that version is released and the “Last updated” date will change. We announce significant changes in the store release notes.
Contact
Kaya Can Kaya (Team Eks Games), İzmir, Türkiye · teameksgames@gmail.com