This policy applies to the xibalbasoftware.com website and to the mobile apps, games, and web services published under the name Xibalba Software.
The data controller is Haldun Akkoyunlu, a natural person established in Turkey. Xibalba Software is the trade name he uses. Because this is a one-person business, when we say "we" here, we mean one person.
This text was not written under the law of a single country, but according to the common and highest standard of the rules in the countries the products reach. Not all of these protections may be mandatory in your country; we still act in the same way.
The original of this text is Turkish. Translations into other languages are for information only; in case of conflict, the Turkish text prevails.
1. What this policy covers
xibalbasoftware.comMobile apps and games: TerfiNET, Baby Grow Sense, Word Ward, Husky Rush, Block Grid X, Medieval Tides: Orya WarsCorrespondence: support emails, contact form, and newsletterOut of scope: tools used only inside the studio that are not offered for sale or opened to the public. If a product has a separate privacy notice published on its store page, that notice takes precedence for that product.
2. Products fall into three groups for data
They do not all do the same thing; knowing which group applies makes it easier for you.
Apps that require an account — TerfiNET, Baby Grow Sense. You sign in; your progress and purchases are tied to your account.Games that do not require an account — Word Ward, Husky Rush, Block Grid X, Medieval Tides. You can sign in if you want a leaderboard or cloud save; if you do not, the game still works.Services that run on the device — Block Grid X's Pic Grid mode. Your file, photo, or table never goes to a server.3. Data we process
This depends on which product you use and what you allow.
Account data: email, display name, authentication identifier, email verification statusUse and progress: questions you solve, repetition intervals, level, score, achievements, app settingsDevice information: model, operating system, language and region, app version, app instance IDDiagnostics: crash logs and performance measurementsAnalytics: aggregated statistics such as which screens are opened and which features are usedPurchase: transaction information and subscription status from the store and subscription infrastructure — we never see your card numberAdvertising identifiers: GAID or IDFA in products that show adsSite side: IP address, browser information, cookies, and similar technologiesCorrespondence: what you send through the contact form or by direct emailNewsletter: if you subscribe, your email address, language preference, and subscription dateBaby information: only in Baby Grow Sense — date of birth, sex, height and weight, notes, and photosWe do not ask for any of these in any product: Turkish national ID number or equivalent, card details, continuous location tracking, contacts, microphone recording, or camera recording.
4. Why we process this data
To run the app, game, or site and show the contentTo create, verify, and protect your accountTo process purchases and subscriptions; to restore your rights when you change devicesTo find bugs, fix crashes, and measure performanceTo show ads in the free versionTo answer support requestsTo send the newsletter if you asked for itTo prevent fraud, abuse, and cheatingTo meet legal obligationsWe do not sell your personal data. We do not transfer data to advertising networks for money.
5. Legal basis
Where GDPR and UK GDPR apply:
Performance of a contract — account, purchase, game progressExplicit consent — newsletter, personalized advertising, non-essential cookies (you can withdraw consent at any time)Legitimate interest — security, debugging, basic analytics, prevention of abuseLegal obligation — tax, accounting, official requestsFor KVKK, processing is based on the contract, legal obligation, and legitimate interest grounds in Article 5, and on explicit consent for cases outside those grounds. If another country requires a different basis or an additional notice, that rule applies for users in that country.
6. Data that never leaves your device
Some functions work entirely inside the device. They do not go to a server, we do not see them, and we do not store them.
Block Grid X, Pic Grid: the photo you choose is processed on the phone; it is not uploaded to any server.Offline operation: in products such as TerfiNET, downloaded content and progress remain on your device.7. Artificial intelligence
There are two situations that should not be confused:
Content generation: TerfiNET questions and some visuals and music in the games are produced with artificial intelligence tools. This is done before publication and without your data. User data is not sent to these tools.Artificial intelligence content may be wrong. Especially in TerfiNET, do not treat questions and explanations as a substitute for official legislation or institutional announcements.8. Cookies, ads, and consent
On the site, measurement and advertising cookies may be used alongside essential cookies. For non-essential cookies, visitors in the EEA, the United Kingdom, and Switzerland are shown a consent screen; your choice is saved and you can change it at any time.
Google AdMob — ads in some mobile products. Baby Grow Sense has no full-screen or rewarded video ads; only non-personalized banner ads.Apple ATT — tracking permission is asked on iOS. If you say no, personalized ads are not shown; the product continues to work.Device settings — on Android you can reset or delete the advertising ID; on iOS you can turn off tracking.9. Who we work with
Providers that may process data under their own policies while providing the service:
Google Firebase — authentication, database, storage, analytics, crash reporting, notifications, remote configuration, hostingGoogle AdMob and AdSense — advertisingRevenueCat — subscription and in-app purchase entitlementsApp stores — Google Play, App Store, Galaxy Store (they collect the payment)Email infrastructure — verification, support, newsletterYouTube — embedded video in restricted mode in Baby Grow SenseOther than these, we do not sell, rent, or share your data for marketing. Information is given to competent authorities only where the law requires it and only as much as necessary.
10. Children
Games and general apps are for a general audience; they are not directed to children under 13. If the digital age of consent is higher in your country (it may be up to 16 in the EU), that age applies. We do not knowingly collect data from children under 13; if we notice it was collected by mistake, we delete it. If you think your child left data, write to us and we will delete it immediately.Baby Grow Sense is a parent tool. The user is an adult; the child is not the end user. Baby information is entered by the adult account holder. This product has no behavioral advertising, full-screen ads, or rewarded video; only non-personalized banner ads may appear. YouTube runs in restricted mode. Baby data is not sold and is not transferred to advertising networks.Framework followed: COPPA, GDPR child provisions, Google Play Families Policy, and store child-safety rules.11. How long we keep it
Account and progress: while the account remains openPurchase records: for the tax/accounting period (as a rule, ten years in Turkey)Crashes and diagnostics: at most 90 daysAnalytics: in aggregated form, at most 14 monthsSupport correspondence: at most 2 years after the request is closedNewsletter: until you unsubscribe; then only the minimum record needed to prevent sending againWhen the period ends, data is deleted or irreversibly anonymized.
12. Transfer abroad
Our service providers' servers may be outside Turkey, mostly in the EU and the United States. Transfers use the European Commission Standard Contractual Clauses, adequacy decisions, or equivalent safeguards. KVKK Article 9 conditions are followed.
13. Security
We use encryption in transit and at rest, access limitation, server-side authorization, and regular updates. Payment information does not reach us. Still, no system is one hundred percent secure. If you notice a vulnerability, write to info@xibalbasoftware.com. If a breach creates a notification obligation, we notify the competent authority and affected users within the legal period.
14. Your rights
You can send the requests below to info@xibalbasoftware.com. We may need to verify that the request comes from you. We will not give you worse service or change the price because you exercise your rights.
Learn what data is processed and request a copyHave incorrect or incomplete data correctedRequest deletionRequest restriction of processingObject to processingReceive your data in a portable formatWithdraw consent you gaveObject to a solely automated decisionAdditional routes by region (examples): GDPR/UK GDPR and local authority; in Turkey KVKK Article 11 and the KVKK Board; U.S. state laws (CCPA/CPRA etc.); Brazil LGPD; Japan APPI; Korea PIPA and other local laws. These are examples; all rights and complaint routes in your country are reserved.
15. Deleting your account or data
Write to info@xibalbasoftware.com from the email in your account; say which product you mean. We delete or anonymize data that is not subject to a legal retention obligation and tell you when it is done. Store purchase records cannot be deleted for tax reasons.
16. Changes
We update this policy when new products or laws change. The current version stays on this page; the date at the top changes. If there is an important change, it is announced on the site or in the app; if necessary, consent is requested again.
17. Contact
For privacy requests: info@xibalbasoftware.com