Privacy Policy
Last updated: July 2026
This policy applies to the xibalbasoftware.com website and to the mobile apps, games, and web services published under the name Xibalba Software. The data controller is Haldun Akkoyunlu, a natural person resident in Turkey; Xibalba Software is the trade name he uses. Because this is a one-person studio, when we say "we" here, we mean a single person.
The text was not written to one country's laws alone, but to the shared highest standard of the rules that apply in the countries the products reach. Not all of these protections may be mandatory in your country; we still act the same way.
The original of this text is Turkish. Translations into other languages are for information only; in case of conflict, the Turkish text prevails.
1. Contact
Haldun Akkoyunlu (Xibalba Software)
Email: info@xibalbasoftware.com
Web: https://www.xibalbasoftware.com
All privacy-related requests come to this address. We usually reply within a few days; we never exceed the one-month upper limit provided by law.
2. What this policy covers
Website: xibalbasoftware.comMobile apps and games: TerfiNET, Flash Weaver, Baby Grow Sense, Word Warp, Husky Rush, Block Grid X, Medieval Tides: Orya Wars, Pixel Kicker, Pixel Racket, Pixel Jump Basket, Pixel Hand Egg, Light Trail, HekaWeb services: CadeNET, PurgioNetCorrespondence: support emails, the contact form, and the newsletterWhat is out of scope: tools used only inside the studio that are not sold or made public. Also, if a product has a separate privacy notice published on its store page, that notice takes precedence for that product.
3. Products fall into three groups for data
They do not all do the same thing; knowing which group you are in makes things easier.
Apps that require an account — TerfiNET, Flash Weaver, Baby Grow Sense. You sign in; your progress and purchases are tied to your account.Games that do not require an account — Word Warp, Husky Rush, Block Grid X, Medieval Tides, the Pixel series, Light Trail, Heka. You can sign in if you want a leaderboard or cloud save; if you do not, the game still works.Services that run on your device — PurgioNet and Block Grid X's Pic Grid mode. Your file, photo, or table never goes to a server.4. Data we process
It depends on which product you use and what you allow.
Account data: email address, display name, authentication identifier, email verification statusUsage and progress: number of questions you solved, your repetition intervals, level, score, achievements, app settingsDevice information: device model, operating system version, language and region, app version, app instance identifierDiagnostics: crash logs and performance metricsAnalytics: aggregated statistics such as which screens were opened and which features were usedPurchases: transaction information and subscription status from the store and subscription infrastructure — we never see your card numberAdvertising identifiers: GAID or IDFA on products that show adsWeb side: IP address, browser information, cookies and similar technologiesCorrespondence: what you send through the contact form or by direct emailNewsletter: if you subscribe, your email address, language preference, and subscription dateBaby information entered by a parent: only in Baby Grow Sense — date of birth, sex, height and weight measurements, notes, and photosWe do not ask for any of the following in any product: a national ID number or equivalent official identity number, card details, continuous location tracking, your contacts, or microphone or camera recording.
5. Why we process this data
To run the app, game, or site and show you the content available to youTo create, verify, and protect your accountTo process purchases and subscriptions, and to restore your entitlements when you change devicesTo find bugs, fix crashes, and measure performanceTo show ads in the free versionTo respond to support requestsTo send the newsletter if you asked for itTo prevent fraud, abuse, and cheating attemptsTo meet legal obligationsWe do not sell your personal data. We do not transfer data to advertising networks for money.
6. Legal bases
Where GDPR and UK GDPR apply, our bases are:
Performance of a contract — your account working, your purchases, your game progressConsent — newsletter, personalised advertising, and non-essential cookies; you can withdraw consent at any timeLegitimate interest — security, debugging, basic analytics, and preventing abuseLegal obligation — tax, accounting, and official requestsUnder KVKK, processing is based on the establishment and performance of a contract, legal obligation, and legitimate interest under Article 5, and on explicit consent in cases outside those.
If another country's law requires a different basis or additional notice, that rule applies for users in that country.
7. Data that never leaves your device
Some features are designed to run entirely on your device. They do not go to a server, are not seen by us, and are not stored by us:
PurgioNet — the file, image, or table you open. All processing happens inside the browser. Even in modules that use AI, the model file downloads into the browser and computation runs locally. You can verify this yourself from the browser's network tab.Block Grid X, Pic Grid mode — the photo you choose is processed on the phone and turned into a puzzle; it is never uploaded to any server.Offline use — in products like TerfiNET, downloaded content and progress are kept in your device's storage.8. Artificial intelligence
There are two separate situations that should not be confused.
Content generation: TerfiNET's questions, Flash Weaver's cards, and some of the games' visuals and music are produced with AI tools. That production happens before we publish the content and has nothing to do with your data. User data is not sent to these tools.On-device AI: Two of PurgioNet's modules run open-source models inside the browser. The model downloads once; after that, all computation happens on your device. No file or line is sent to an AI service.AI-generated content can be wrong. Especially in TerfiNET, we recommend that you do not treat questions and explanations as a substitute for official legislation and institutional announcements.
9. Cookies, ads, and consent
On the website and web services, cookies for measurement and advertising may be used alongside essential cookies. For non-essential ones, visitors in the European Economic Area, the United Kingdom, and Switzerland are shown a consent screen; your choice is saved and you can change it anytime.
Google AdMob — shows ads in some mobile products. Baby Grow Sense does not use full-screen or rewarded video ads; only a non-personalised banner is shown.Google AdSense — shows ads on CadeNET and PurgioNet. On these sites, a Google-approved consent management platform is used for European Economic Area, United Kingdom, and Switzerland traffic.Apple ATT — tracking permission is requested on iOS. If you say no, personalised ads are not shown and the product continues to work the same way.Device settings — on Android you can reset or delete your advertising ID; on iOS you can turn off tracking.10. Who we work with
The following service providers may process data under their own policies while providing services to us:
Google Firebase — authentication, database, file storage, analytics, crash reporting, notifications, remote configuration, and hostingGoogle AdMob and Google AdSense — advertisingRevenueCat — management of subscription and in-app purchase entitlementsApp stores — Google Play, Apple App Store, Samsung Galaxy Store; they collect the paymentLemonSqueezy — payment and tax processing as merchant of record for the PurgioNet subscriptionEmail infrastructure — verification, support, and newsletter deliveryYouTube — embedded video in restricted mode in Baby Grow SenseApart from these, we do not sell, rent, or share your data for marketing purposes. Information is provided to competent authorities only when required by applicable law and only to the extent necessary.
11. Children
Games and general apps are aimed at a general audience and are not directed at children under 13. If the digital age of consent is higher in your country — it can go up to 16 in the European Union — that age applies. We do not knowingly collect data from under-13s in these products; if we learn that we collected it by mistake, we delete it. If you think your child left data, write to us and we will delete it immediately.Baby Grow Sense is a parent tool. The user is an adult; the child is not the end user. Baby-related information is entered by the adult who opens the account. This product does not use behavioural advertising, full-screen ads, or rewarded video; only a non-personalised banner may be shown. Embedded YouTube content runs in restricted mode. Baby data is not sold and is not transferred to advertising networks.Frameworks followed: COPPA, GDPR provisions on children's data, Google Play Families Policy, and the stores' child-safety rules.12. How long we keep data
Account and progress data: for as long as your account remains openPurchase records: for the period required by tax and accounting law (as a rule, ten years in Turkey)Crash and diagnostic logs: at most ninety daysAnalytics: in aggregated form, at most fourteen monthsSupport correspondence: at most two years after the request is closedNewsletter: until you unsubscribe; after that, only the minimum record needed to stop sending to you again is keptWhen the period ends, data is deleted or irreversibly anonymised.
13. Transfers abroad
Our service providers' servers may be outside Turkey, mostly in the European Union and the United States. For these transfers, the European Commission's Standard Contractual Clauses, adequacy decisions, or equivalent safeguards are used. Under KVKK, the conditions in Article 9 are followed.
14. Security
We use encryption in transit and at rest, access restriction, server-side validated authorisation rules, and regular updates. Payment information never reaches us. Still, no system is one hundred percent secure.
If you notice a security vulnerability, write to info@xibalbasoftware.com. If a breach that triggers a notification duty occurs, we will inform the competent authority and affected users within the time required by law.
15. Your rights
Wherever you are, you can send the following requests to info@xibalbasoftware.com. We may need to verify that the request really comes from you. We will not give you worse service or change prices because you exercised a right.
Learn what data is processed and request a copyHave incorrect or incomplete data correctedRequest deletionRequest restriction of processingObject to processingReceive your data in a portable formatWithdraw consent you gaveObject to a decision made solely by automated meansAdditional details by region:
European Economic Area and United Kingdom — all rights under GDPR and UK GDPR; the right to lodge a complaint with the data protection authority in your country.Turkey — rights under Article 11 of Law No. 6698 on the Protection of Personal Data (KVKK). If we do not respond within thirty days or you find the response inadequate, you may complain to the Personal Data Protection Board.Switzerland — rights under the Federal Act on Data Protection and the ability to apply to the FDPIC.United States — rights to know, delete, correct, and opt out of sharing for targeted advertising under California (CCPA/CPRA) and similar state laws in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others. We do not sell personal data for money. In California you may also apply through an authorised agent.Canada — rights under PIPEDA and, in Québec, Law 25.Brazil — rights under the LGPD and the ability to complain to the ANPD.Mexico and Latin American countries — access, correction, cancellation, and objection rights under local law.Japan — requests for disclosure, correction, and suspension of use under the APPI.South Korea — rights under the PIPA and the ability to apply to the PIPC.India — rights and complaint routes under the Digital Personal Data Protection Act, 2023.Indonesia — rights under Personal Data Protection Law No. 27/2022.Vietnam — rights under Decree No. 13/2023.Thailand — rights under the PDPA and the ability to complain to the PDPC.Saudi Arabia and the United Arab Emirates — rights under local personal data protection laws.Australia and New Zealand — access and correction rights under the Privacy Act and privacy principles.16. Deleting your account or data
Write to info@xibalbasoftware.com from the email address registered to your account and say which product you mean. We will delete or anonymise data that is not subject to a legal retention duty, and we will let you know when it is done. Records of purchases made through a store cannot be deleted because of tax law.
17. Changes
We update this policy when a new product launches or the law changes. The current version always lives on this page and the date at the top changes. If there is a material change, it is also announced on the site or in the app; where needed, consent is asked again.
18. Contact
Haldun Akkoyunlu (Xibalba Software)
info@xibalbasoftware.com
https://www.xibalbasoftware.com