Ruzzo Kart Privacy Policy

Effective date: 8 October 2026 · Version: 1.1 (Ruzzo Kart 1.1.0)

This policy explains how personal data is processed in the Ruzzo Kart mobile game (iOS and Android) and on the ruzzo-kart.web.app website, including its invite pages. It covers the EU General Data Protection Regulation (GDPR). The Turkish version also serves as the notice required by Turkey's Personal Data Protection Law No. 6698 (KVKK).

The game is available in 14 languages. Button and menu names below are given in English, in capitals as in the game; in another language the game shows the same buttons in that language.

1. In short

• No accounts. We do not ask for your name, e-mail address, phone number or location.
• One age question. The first time you open the game, it asks how old you are. Only an age group (under 13, 13 to 15, or 16 and over) is kept, on your device. It decides how ads work for you (see section 10).
• Children (under 13) get only non-personalised ads suitable for children, served through Google AdMob, and no tracking prompt. They use a ready-made nickname instead of typing one, and they see other players under ready-made names too (section 10).
• Your progress stays on your phone. Levels, coins, crystals, karts and missions are stored on your device.
• Online features (playing with friends, challenges, the leaderboard) use a random anonymous player ID. The nickname you choose and your game results are sent to our servers.
• Ads are rewarded only. You choose to watch an ad. They are served by Google AdMob, with Unity Ads bidding through AdMob for players aged 16 and over. Personalised ads need your permission: Apple's tracking prompt on iPhone and iPad, and a consent form in Europe (the EEA, the UK and Switzerland). Players under 16 are never asked and never get personalised ads. Ad content is limited by age (section 3.8).
• We do not sell your data. The game has no in-app purchases. Crystals cannot be bought.
• To delete your data, e-mail ruzzokart@auraajans.com (see section 11).

2. Controller

3. What we process and why

3.1 Data kept on your device

This data is kept on your device. Except where noted, it is not sent to our servers:

• your game progress: unlocked levels, records, stars, statistics;
• your coin and crystal balance and your karts;
• missions, the daily gift and your settings (sound, vibration);
• your age group from the first-launch question: under 13, 13 to 15, or 16 and over. We never store your age or your birth date, and we never send the age group to our servers. Ad requests carry only Google's "child-directed" or "under the age of consent" mark (3.8). It stays when you reset your progress; only reinstalling the game asks again;
• a copy of your nickname (it is also sent to our servers when you use an online feature, see 3.3 to 3.5) and the code of the last room you joined;
• the players you hid with HIDE THIS NAME;
• rewarded-ad counters (for the daily limits);
• a pending leaderboard score while you are offline (sent once you are online, see 3.5);
• your ad consent choices (stored on the device by the ad SDK).

Deleting the game deletes this data. There is no cloud save of ours, so your progress does not move to a new phone by itself. On Android, the phone's own backup to your Google account may include this data and bring it back when you reinstall the game; we cannot see that backup.

Clipboard: the game reads the clipboard only when you tap PASTE, and only to find a room or challenge code.

Sharing: the invite and CHALLENGE buttons open your phone's share sheet. What you share goes to the app you pick, for example WhatsApp, and that app's own privacy rules apply.

3.2 Anonymous player ID (Firebase Authentication)

The first time you use an online feature, the game signs you in anonymously with Google's Firebase Authentication. The online features are: WITH FRIENDS, opening an invite or challenge link, CHALLENGE, and sending a score to the leaderboard.

• Processed: a random player ID, its creation and last sign-in time, your IP address and your device or browser information (user agent).
• Why: to check that online records are yours and to prevent abuse.
• The ID does not contain your name or e-mail address.

3.3 Friends mode: live room race (Firebase Realtime Database)

When you create or join a room, we process:

• the room code, your player ID, nickname, chosen kart and seat number;
• your ready state, connection state and a "last seen" time, refreshed every 5 seconds;
• your kart's position and speed samples during a race (10 per second);
• your race result: how your race ended (a crash, damage, leaving, or still racing at the end), how long you lasted, the distance, your score and remaining hearts;
• how many rounds you have won in that room;
• a "removed" flag for that room if its host removes you.

The other players in the room see this data. A player under 13 sees the other players under ready-made names instead of the names they typed (section 10). Anyone who knows or guesses a room code can see the room's general state (level, status, lock). Only room members see the player list.

Why: to run the live race (everyone races on until only one player is left, for at most 5 minutes), show everyone the same track and rank the results.

3.4 Challenge links (Firebase Realtime Database)

When you tap CHALLENGE, we store:

• the 6-character challenge code, your player ID, nickname and kart;
• the level, the track seed, your time or progress and your score;
• the ghost: the path of your run (your kart's position samples);
• the item boxes you opened in that level, and the creation time.

Anyone who receives the code or link can open the challenge in the game and race your ghost.

To prevent abuse we also keep the times of your last room creation, last room join and last challenge, and how many challenges you created that day.

3.5 Leaderboard: weekly and all-time (Google Cloud Firestore)

Joining the leaderboard is optional. After your first run that could make it onto the leaderboard, the game asks you once, "Want to join the leaderboard?", and lets you pick the name other players will see (JOIN / NOT NOW). If you do not join, nothing is sent to the leaderboard; your score stays on your device. If you join, each run that beats your best score of the week or of all time is sent to the leaderboard.

You can turn this off at any time in SETTINGS → Show in Rankings. Then nothing more is sent, and your leaderboard entries and run logs are deleted (if you are offline, as soon as you are back online). You can join again later with the same setting or with JOIN THE LEADERBOARD on the STATS tab.

Your nickname is the same in friends mode and on the leaderboard. If you have no nickname yet, the game suggests one such as "Spike 27". You can change it on the LEADERBOARD card of the STATS tab with CHANGE. Players under 13 cannot type a nickname: they only get, or pick from, ready-made names such as "Spike 27" (a kart's name and two digits), so no free text from a child is ever sent (section 10).

• Leaderboard entry: nickname, score, kart, start and final level, run duration, how many times you used WATCH & GO ON in the run (at most twice), game version, server time and your player ID.
• Run log: the track seed, the moments you tapped the screen, the moments you used WATCH & GO ON and the moment the run ended. It is kept to catch cheating: other players' devices replay the top runs from these logs and check the scores.
• Reports: when you report a name with REPORT, or a score fails the check, we store the reporter's and the reported player's IDs, the score and the time.

What other players see: the nickname, kart and score of the top 5. Your own rank is shown only to you. A player under 13 sees the other players under ready-made names instead of the names they typed.

Nicknames are 2 to 12 characters: Latin letters (including accented letters such as é, ñ or ü), digits, spaces, _ and -. They are checked against a list of offensive words in several languages. HIDE THIS NAME hides a name on your own device only; nothing is sent for it.

The leaderboard is read and written directly from the game with your anonymous player ID. Games that open the leaderboard also delete old weekly boards (see 8).

3.6 App verification (Firebase App Check)

To protect our servers from fake clients and abuse, we use Firebase App Check. It confirms that requests come from the genuine Ruzzo Kart app on an unmodified device. It uses Apple's App Attest / DeviceCheck on iPhone and iPad, and Google's Play Integrity on Android. It processes the attestation from those services and an App Check token, which is valid for at most 7 days.

3.7 Technical logs

When your device connects to a Google server, your IP address and device or browser information are logged. This happens:

• when you use online features;
• when you open the ruzzo-kart.web.app invite page;
• when the game checks your connection;
• when the app asks our website for the current time (a request without any identifier), so daily rewards follow the real date.

These logs are used for security, debugging and abuse prevention.

The invite page uses no cookies and no analytics. It picks its language from your browser settings, on your device; nothing about this is sent or stored.

3.8 Ads (Google AdMob, Unity Ads)

The game shows rewarded ads only:

• WATCH & GO ON (on the KEEP GOING! card): when a run ends (a crash, or your last heart is gone), carry on from where you stopped. It is offered at most twice per run, and only after a decent score;
• CONTINUE (on the game-over card): start the next run from the level you reached instead of level 1, with the line "Watch a short video to continue from level N". START above level 1 on the LEVELS map works the same way. Level 1 is always free, and in your first 3 runs continuing is free too. If no video can be shown, you start again from level 1; players under 16 then continue for free instead;
• 2× COINS: double the coins of a run at game over. The button shows a video icon and the line "Watch a short video to double your coins";
• FREE CRYSTALS: a few crystals, a few times a day;
• +2 CRYSTALS (in friends mode, after a race, on the RESULTS screen and on the challenge result card): 2 crystals. The line under the button says "Watch a short video to get 2 crystals".

Each of these buttons shows a video icon and says that it starts a video before you tap it. Daily limits apply: at most 30 WATCH & GO ON, 5 2× COINS, 3 FREE CRYSTALS and 3 +2 CRYSTALS videos per day.

Watching is always your choice. Ads are never offered in your first 3 runs or during a race. In friends mode the only ad is this optional video after a race, on the results screen; none in the lobby, the countdown, the race or while watching others. There are no banner ads and no ads that appear without you asking for them (interstitial ads). There are no in-app purchases and no offers to install other apps for a reward.

Ad content is limited by age: to content suitable for children (Google's "G" rating) for players under 13, and to at most Google's "T" (teen) rating for everyone else. Ads rated for adults only ("MA") are never requested.

Ads are served by Google AdMob. The ad SDK (Google Mobile Ads SDK) may process:

• your IP address, to estimate your approximate location;
• advertising identifiers: on Android the advertising ID and app set ID; on iPhone and iPad the IDFA, only if you allow tracking;
• device and app information;
• ad interactions: impressions, taps and video views;
• performance and diagnostic data.

It uses this data for these purposes: serving ads, measuring them, preventing fraud and, only with your permission, personalising ads to your interests.

Cookies and similar technologies: when ads are served, Google and the ad networks may place and read cookies or similar local storage on your device. They may also use advertising identifiers, IP addresses and web beacons to collect information. The game itself does not use cookies for this.

Google also processes this data as an independent controller. See How Google uses information from sites or apps that use its services.

Players under 16. For a player who answered under 13, every ad request is marked as child-directed (Google's "tag for child-directed treatment", COPPA). For a player who answered 13 to 15, every request is marked as under the age of consent (GDPR). In both cases: ads are never personalised and no remarketing is used; the advertising identifier (IDFA, AAID) is not sent; Apple's tracking prompt and the consent form are never shown; and the Unity Ads SDK is not even started for these players. Ads are limited to the "G" rating under 13 and to the "T" rating for 13 to 15.

• On Android, only Google AdMob serves their ads, from a separate ad unit that no other ad network bids on, and the ads can be closed after 5 seconds (they then give no reward).
• On iPhone and iPad, their ads are served through Google AdMob from the game's usual rewarded ad unit, with the same marks and limits.

Mediation. To fill more ads for players aged 16 and over, AdMob lets the ad network below bid for each ad (AdMob mediation). The ad you see may come from it, and it may process similar data under its own privacy policy. Your consent choice from section 4 is passed on to it:

3.9 When you contact us

If you e-mail us, we process your e-mail address and your message, only to reply and to handle your request.

4. Ad consent and your choices

• The order: the age question comes first, on the first launch. Nothing about ads happens before you answer it. For players aged 16 and over the questions come right after it, on the main menu: where it applies, the consent form appears first, then (on iPhone and iPad) Apple's "Allow tracking?" prompt (sometimes after a short explanation screen). No ad is requested and your advertising identifier is not read before these steps are finished. Ad offers still start only after your first 3 runs. In friends mode these steps never appear; an ad is requested there only after a race, when you tap the video on the results screen, and only if the steps were completed before. Players under 16 never see the consent form or Apple's prompt (section 10).
• Europe (EEA, UK, Switzerland): a consent form (Google's User Messaging Platform, UMP) appears before any ad is requested. You can accept or refuse personalised ads.
• iPhone and iPad: after a short explanation screen, Apple's "Allow tracking?" prompt appears (App Tracking Transparency). If you do not allow it, your advertising identifier (IDFA) is not shared.
• Refusing changes nothing in the game. You get the same rewards; the ads are simply not personalised.
• Non-personalised ads are not based on your past behaviour. They use the current app and city-level location. Ad identifiers may still be used for frequency capping, aggregated reporting and fraud prevention.

To change your choice:

• In the game: SETTINGS → Privacy Options. The row appears when a consent form applies in your region (never for players under 16, who are not asked).
• iPhone and iPad: Settings → Privacy & Security → Tracking → Ruzzo Kart.
• Android: Settings → Privacy → Ads, where you can reset or delete your advertising ID. Menu names can differ between phones.

5. Legal bases (GDPR Art. 6(1); KVKK Art. 5)

We collect this data automatically, through the app and our servers.

6. Who we share data with

• Google (Firebase and Google Cloud): authentication, database, leaderboard, App Check and web hosting. Google acts as our processor for these services.
• Google AdMob and the ad networks in 3.8: to serve ads. They process ad data under their own policies.
• Apple and Google (App Attest / DeviceCheck / Play Integrity): to verify the app.
• Other players: as described in 3.3, 3.4 and 3.5 (nickname, kart, score, ghost).
• Authorities: only when the law requires it.

We do not sell or rent your personal data.

7. International transfers

Our providers' servers are outside Turkey:

• The room, challenge and leaderboard databases are in Belgium (Google, europe-west1).
• Firebase Authentication runs only from data centres in the United States.
• Google and the ad networks may process data in the US, the EU and other countries.

Google states that it complies with the EU-U.S. and Swiss-U.S. Data Privacy Frameworks for data from the EEA, Switzerland and the UK. Transfers from Turkey follow Article 9 of the KVKK.

8. How long we keep data

9. Security

• All traffic between the game and the servers is encrypted (TLS).
• The database security rules let each player write only their own records.
• App Check blocks fake clients.
• We collect only the minimum data the game needs.

No transfer over the internet is completely secure.

10. Children

Ruzzo Kart is a game for everyone, children included. That is why it asks one neutral age question on the first launch ("How old are you?"). Every age from 4 to 17 and "18+" are shown as equal tiles, nothing is preselected, and the answer unlocks nothing. Only the age group is kept, on the device. There is no way to change it in the game. A progress reset keeps it, and only reinstalling the game asks again (on Android, if the phone's own backup restores the game's data, the answer comes back with it).

What changes for a player under 13 (a child):

• Ads: rewarded only, and only when the child taps a video button. Every ad request is marked as child-directed (COPPA). Ads are never personalised, use no remarketing and no advertising identifier, and are limited to ads suitable for children ("G" rating). They are served through Google AdMob; the Unity Ads SDK is never started for a child. On Android they come from a separate AdMob ad unit that no other ad network bids on, and they can be closed after 5 seconds. In friends mode the only ad is the optional video on the results screen after a race, which the child taps; it follows the same rules. When no video can be shown, a child continues from the level reached for free.
• No tracking prompt and no consent form. We never ask a child for permission to track or to personalise ads.
• No typed names. A child cannot type a nickname. The game uses ready-made names such as "Spike 27" (a kart's name and two digits), on the leaderboard and in friends mode. No free text from a child is sent to us.
• No names typed by others. A child does not see the nicknames other players typed. On the leaderboard, in rooms and in challenges, every other player is shown under a ready-made name made from their kart's name and two digits.
• What we still process for a child: the anonymous player ID, the ready-made nickname and game data, only when an online feature is used (sections 3.2 to 3.5); the technical logs (3.7); and, for the ads the child chooses to watch, the data Google AdMob needs to serve a contextual ad (for example the IP address, used for an approximate location, and device information).
• What we never collect from a child: name, e-mail, phone number, photos, precise location, contacts or the advertising identifier.

Players aged 13 to 15 (who may be under the age of digital consent in their country, see below) get the same ad protections: no consent form, no tracking prompt, no personalised ads, and the Unity Ads SDK is not started (on Android, their ads come from the same separate AdMob unit). Their ads are limited to Google's "T" (teen) rating. They can type a nickname.

Parents: you can ask us at any time to see or delete your child's data. Write to ruzzokart@auraajans.com with the subject "Delete my child's data" and the details in 11.3 (the nickname, the device type, roughly when your child last played online). We delete the server records within 30 days and confirm by e-mail. Uninstalling the game deletes everything stored on the device.

The laws we follow:

• United States (COPPA): children under 13 get child-directed treatment and no personal information is collected from them for advertising.
• EU / EEA (GDPR Art. 8): the age of digital consent is between 13 and 16 depending on the country. Everyone under 16 is treated as under the age of consent: no consent is asked and no personalised ads are shown.
• Turkey (KVKK): we process children's data only as described here, keep it to the minimum needed for the game, and do not ask a child for explicit consent. A parent or guardian can use the rights in Article 11 of the KVKK on the child's behalf.

If you think a child has given a wrong age, write to ruzzokart@auraajans.com. We will delete the online data, and a reinstall asks the question again.

Do not use your real name as your nickname. Other players can see it.

11. Your rights and deleting your data

11.1 Your rights

Under the GDPR (EEA, UK, Switzerland) you can:

• ask for access to your data;
• ask for it to be corrected or deleted;
• ask for its processing to be restricted;
• ask for a portable copy;
• object to processing based on legitimate interests;
• withdraw your consent at any time (section 4);
• complain to your data protection authority. The list of authorities is at https://edpb.europa.eu/about-edpb/board/members_en

Players in Turkey have the rights in Article 11 of the KVKK, and may complain to the Personal Data Protection Board (https://www.kvkk.gov.tr).

11.2 How to make a request

• By e-mail: write to ruzzokart@auraajans.com.

We reply free of charge within 30 days.

11.3 Delete my data: step by step

1. E-mail ruzzokart@auraajans.com with the subject "Delete my data". Include:
   • your nickname (as shown on the leaderboard or in rooms);
   • your device type (iPhone, iPad or Android) and roughly when you last played online;
   • any challenge codes you created, and the room codes you remember.

   Send it from the e-mail address you want our answer at. We may ask you a question to make sure the data is yours.

2. Within 30 days, we delete these server-side records:

   • your anonymous ID;
   • your room records;
   • your challenges;
   • your rate-limit records;
   • your leaderboard entries and run logs;
   • reports you made.

   We confirm by e-mail.

3. Delete the data on your device yourself by uninstalling the game. This also erases your progress permanently.
4. For ad data, use the settings in section 4, or follow the ad networks' privacy policies.

If you use an online feature again after deletion, a new anonymous ID is created.

12. Changes

We may update this policy. The current version is always at https://ruzzo-kart.web.app/privacy, and the effective date at the top changes with it. We also announce important changes in the game or in the update notes.

13. Contact

Aura Medya · ruzzokart@auraajans.com

Türkçe sürüm: https://ruzzo-kart.web.app/gizlilik