Pipzi Privacy Policy

About this policy

Tiki Studios ("Tiki Studios", "we", "us") is an independent mobile studio brand based in Türkiye. We make mobile apps and games, including Basso, Pipzi, PromptMaster, MaskedTalk, LiftAlong and Wickstart. This Privacy Policy covers all of them, and every app or game we release in the future.

The policy has two parts. The first part, below, applies to all of our products. The second part has one section per product, describing exactly what that product collects, why, and who processes it. If a product section and the general part differ, the product section is the more specific one and applies to that product.

Some products have extra pages that stay on their own websites. For MaskedTalk these are the Child Safety Standards and Account Deletion pages on maskedtalk.live.

Who is responsible

Tiki Studios is the data controller for the personal data described in this policy. For any privacy question or request, contact us at legal@tikistudios.io.

What we collect, in general

What we collect depends on the product. The product sections list the details. Across our products, the categories are:

• Data you give us, such as an email address, username, profile details, messages, photos, reviews or journal entries, in products that have accounts or community features.
• Data created on your device, such as progress, results, settings and preferences. In several products this data never leaves your device.
• Usage and diagnostic data, such as which screens you open, feature events, crash reports and performance data, linked to a random app-instance or installation identifier.
• Purchase data, such as which product you bought and your subscription status. Payments are processed by the app store. We never see your card details.
• Device or installation identifiers, where described in a product section for functionality, subscriptions, usage or diagnostics.
• Advertising identifiers, only in products that show ads or measure our own ad campaigns, and only as described in the product section and in the advertising section below.
• Support correspondence, if you email us.

We do not collect precise location in any product. We do not sell personal data.

How and why we use data

We use personal data to:

• Provide the product: run your account, sync your content, deliver messages and calls, and unlock what you paid for. The legal basis is performance of our contract with you.
• Keep products safe: verify age limits, moderate content, prevent fraud and abuse, and respond to reports. The legal bases are our legitimate interests and, where it applies, legal obligations.
• Understand and improve our products: usage analytics, crash reporting and performance monitoring. The legal basis is our legitimate interest in building reliable, useful products. Where a product lets you turn analytics off, the setting is described in its section.
• Show ads in products that contain them. The legal basis is your consent where the law requires it, otherwise our legitimate interest.
• Measure our own ad campaigns: learn which of our ads lead people to install a product, use it and subscribe, so we know where to advertise. This is not used to show you ads. The legal basis is your consent where the law requires it, otherwise our legitimate interest.
• Answer you when you contact support.
• Meet legal obligations, such as keeping purchase records or responding to lawful requests.

For users in Türkiye, these purposes and legal bases correspond to Article 5 of the Personal Data Protection Law No. 6698 (KVKK). For users in the European Economic Area, the United Kingdom and Switzerland, they correspond to Article 6 of the GDPR.

Service providers

We use service providers that process data on our behalf, under their own data-processing terms. Not every product uses every provider; each product section names the ones it uses.

• Google Firebase (Google LLC / Google Ireland Ltd): analytics, crash reporting, performance monitoring, remote configuration, push notifications and, in some products, authentication.
• Google AdMob (Google): advertising, in products that show ads.
• RevenueCat, Inc.: subscription and purchase management.
• Adjust GmbH (Berlin, Germany): measuring which of our ad campaigns lead to installs and subscriptions, in products whose section says so.
• Apple, Google Play, Huawei AppGallery and Samsung Galaxy Store: app distribution and payment processing, under their own privacy policies.
• Hetzner Online GmbH: server hosting for products that have a backend. Our servers are in the European Union (Finland).
• Slack Technologies: the internal tool our moderation team uses to review safety reports, where a product section says so.

Advertising and tracking

Only products whose section says so show ads. In those products:

• If you are in the EEA, the UK or Switzerland, or another region where consent is required, Google's consent form asks for your choices before any ad is requested. You can change your choices later in the app's settings.
• On iOS, we ask for permission through App Tracking Transparency before using your device's advertising identifier. If you decline, ads are not personalized.
• On Android, you can reset or delete your advertising ID, or opt out of personalized ads, in your device settings.

Paid plans that remove ads do not request ads.

Ad measurement. Some products, including products without ads, use Adjust to learn which of our own ads bring people to them. This measures our campaigns; it does not show you ads or target ads to you individually. Each product section says what is sent, when it starts and how to turn it off. In the EEA, the UK and Switzerland it starts only with your consent. On iOS, the advertising identifier is used for it only if you allow tracking.

International transfers

Some of our service providers, including Google and RevenueCat, process data in the United States and other countries. Where data leaves the EEA, the UK, Switzerland or Türkiye, the transfer relies on the safeguards the law provides, such as the European Commission's Standard Contractual Clauses and the providers' data-processing terms.

How long we keep data

• On-device data stays on your device until you delete it in the app or delete the app. Your phone's own backups (iCloud or Google backup) may keep a copy under your control.
• Account data is kept while your account exists and is deleted after you delete your account, as described in the product section.
• Analytics data is kept for up to 14 months. Crash reports are kept for up to 90 days.
• Purchase records are kept as long as needed to restore your purchases and to meet tax and accounting rules.
• Support emails are kept only as long as needed to handle your request.

Product sections give specific retention periods where they differ.

Your rights

Depending on where you live, you can ask us to:

• tell you whether we process your data and give you a copy;
• correct inaccurate data;
• delete your data;
• restrict or object to certain processing, including processing based on legitimate interests;
• give you your data in a portable format;
• withdraw consent at any time, without affecting processing that already happened.

To use these rights, email legal@tikistudios.io. For products without accounts, we can only identify data linked to a random app identifier, so deleting the app or its data is often the most complete option. We may need to verify your request before acting on it. We respond within 30 days, or sooner where the law requires.

You can also complain to a data-protection authority. In Türkiye this is the Personal Data Protection Authority (KVKK Kurumu). In the EEA, it is the authority in the country where you live or work.

California and other US states. We do not sell personal information. We share it for cross-context behavioral advertising only through the ads in products that show ads, and through ad measurement, which reports campaign results to the ad networks we advertise with. You can control both as described above and in each product section. We do not use sensitive personal information to infer characteristics about you. You will not be treated differently for exercising your rights.

Children

Our products are not directed to children under 13. Some products have higher minimum ages: MaskedTalk is for adults 18 and over. Product sections state the minimum age and how it is checked.

If you are a parent or guardian and believe a child has given us personal data, contact legal@tikistudios.io and we will delete it.

Security

We protect data with encryption in transit (HTTPS/TLS), access controls on our servers, and the app sandboxing and storage encryption of your phone's operating system. Data kept only on your device is protected by your device lock. No system is perfectly secure, so we also try to collect as little as we can.

Our website

tikistudios.io does not use cookies, analytics or advertising. Fonts are served from our own server; no third party receives your IP address to deliver them. Links to app stores and other websites are governed by those sites' own policies.

Changes to this policy

When we change this policy, we post the new version here and update the date at the top. If a change is significant, we tell you in the affected product or on this page before it takes effect.

Contact

Tiki Studios, Türkiye · Email: legal@tikistudios.io