Privacy Policy

Kyrin2 Global, operated by Medveri · Last updated: 20 October 2026

This policy explains what personal data Kyrin2 (the "Game") and kyrin2.global (the "Site") collect, why, and what choices you have.

1. Data we collect

• Account data: username, email address, a salted password hash, and whether your email is verified.
• Sign in with Google or Apple: your provider account identifier and the email address the provider shares. We never receive your Google or Apple password.
• Game data: characters, items, progress, purchases made in the Game, chat messages and in-game social data.
• Technical and security data: IP address, device and app version, connection logs, and records used to detect cheating, fraud and abuse.
• Purchase records: receipts and transaction identifiers from Google Play or the Apple App Store. We do not receive your payment card details.
• Support data: messages you send through the support chat or support page.

2. How we use it

• to create and secure your account, verify your email and let you sign in;
• to run the Game, save your progress and deliver purchases;
• to prevent cheating, fraud and abuse, and to enforce the rules of the Game;
• to provide support and to send service messages such as email verification and password recovery;
• to translate chat messages automatically between players.

3. Sharing

We do not sell your personal data. We share it only with service providers that help us operate the Game, such as cloud hosting, email delivery, Google and Apple (sign-in and in-app purchases), and when the law requires it.

4. Retention and deletion

We keep your data while your account exists and as long as needed for security and legal obligations. You can ask us to delete your account and its data at any time through the account deletion option on the Site or via the support page.

5. Your rights

You can ask to access, correct or delete your personal data, or object to some processing. Contact us through the support page and we will respond as soon as possible.

6. Children

The Game is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

7. Security

We protect data with access controls, encrypted connections and separated production systems. No system is completely secure, but we work to keep your data safe.

8. Changes

We may update this policy. The date at the top shows the latest version; significant changes will be announced in the Game or on the Site.

9. Your choices in the app (Privacy preferences)

The first time you open the app, a privacy screen asks you to accept the Terms of Use and offers three optional choices. None of them is ticked in advance, and none of them is a condition for playing:

• Ad measurement: measuring which ad or link brought you to the game, and sharing this with our measurement provider and advertising partners (sections 10 and 11; except Apple's anonymous notice described in section 10).
• Personalized ads: allowing advertising partners to use your data to show you ads based on your interests (section 11).
• Campaign and event notifications: receiving push notifications about campaigns, discounts and in-game events (section 12).

You can change these choices at any time in the game under Settings > Privacy preferences; a change takes effect in the app immediately and reaches our servers the next time the app connects to our login server, at the latest at your next login. We store your choices, the version of the text you saw, the time, a hashed (SHA-256) form of your IP address and, if you ticked Ad measurement, your AppsFlyer ID, so that we can show which choices you made. If we change the consent text, the app asks you again.

10. Mobile attribution and measurement (AppsFlyer)

We use AppsFlyer, a mobile measurement provider that acts as our service provider (processor), to find out which advertising campaigns, invite links and other sources lead to installs, sign-ups and purchases, and to measure how well our campaigns work.

Only with your consent. The AppsFlyer service in the app runs only if you ticked Ad measurement (apart from Apple's anonymous SKAdNetwork notice below). If you did not, the AppsFlyer service in the app is not started, our servers do not send events about you to AppsFlyer, and no AppsFlyer ID or advertising ID is linked to your account. If you withdraw consent later, the AppsFlyer service in the app stops at once, and our servers stop sending events about you as soon as the change reaches them (at the latest at your next login).

Apple's SKAdNetwork on iOS, also without consent. On iOS the app registers the install with Apple's SKAdNetwork even if you did not tick Ad measurement; the AppsFlyer service is not started in this case either. If you installed the app after seeing an ad, Apple may then tell the advertising network that showed the ad, after a delay and without any identifier, mainly that an install came from that ad. Apple may also send a copy of this notice, which likewise contains no identifier, to AppsFlyer; from it we only see aggregated results, such as the number of installs per campaign. In that case neither we nor AppsFlyer send your advertising ID, your account ID or any device data, the notice contains no identifier and we do not link it to your account. If you have consented, measurement works as described below; Apple's notice may then also carry a coarse progress value such as sign-up, reaching level 5 or 10, or a purchase, and notices created before you withdraw consent may still be sent.

When you have consented, the following data can be collected and processed:

• Advertising ID: on Android the Google advertising ID (GAID). On iOS the advertising identifier (IDFA) is available only if you also allow tracking in Apple's App Tracking Transparency prompt; without that permission it is not collected. If you have limited ad tracking or deleted your advertising ID in your device settings, no advertising ID is available.
• Device and app data: device type and model, operating system and version, app version, language settings and similar technical data needed for measurement.
• IP address and approximate location: AppsFlyer receives your IP address and uses it to derive a coarse location (for example country or city). It is not precise GPS location. We also derive the country from the IP address used at sign-up.
• Install source: on Android the Google Play install referrer, and the information of the ad or link you came from (for example media source, campaign, ad set, ad and click time).
• App events: installs, app opens and invites you share (from the app), and from our servers: account sign-up, email verification, first character, first time in the game, level milestones, days you return to the game, some first-time achievements (such as a first quest or joining a guild), purchases and refunds (amount and currency, never card details), and invite events (an invite used or qualified).
• Identifiers: the AppsFlyer ID, a random identifier that AppsFlyer creates for the app installation, and our internal account ID (a random identifier, not your username) as the “customer user ID”. We do not send your username, email address or password to AppsFlyer.
• Your consent choices: we pass your choices (ad measurement, personalized ads, and whether EU/UK-style data protection rules apply to you) to AppsFlyer so that it and the advertising networks can respect them.
• Uninstall measurement: to measure whether the app is still installed, AppsFlyer may send a silent push message to your device. Silent pushes are not displayed to you. For this we give AppsFlyer the device's push token (the same token used for notifications, section 12).

On our own servers we keep, linked to your account, the AppsFlyer ID, the advertising ID and its ad-tracking setting, the platform and app version, the last IP address used, and the install source data the app received at its first launch. We also record the game milestones listed above in our own database for our own statistics.

11. Sharing with advertising networks

If you ticked Ad measurement, AppsFlyer shares measurement data with the advertising networks we run campaigns with, through its integrations with them. This lets a network see that an install, sign-up or purchase came from one of its campaigns, so that the campaign can be measured and optimised. The data shared can include the advertising ID, the event (for example a sign-up or a purchase and its value), the time and the related technical data described in section 10.

• At the moment this is Google (Google Ads).
• Meta (Facebook and Instagram) and TikTok are named on the consent screen because we may use them later. We share data with them only if we start campaigns with them, and we will update this policy when we do.

Advertising networks may use the data for personalized advertising only if you also ticked Personalized ads; otherwise we tell them, through the consent signals in section 10, that it may not be used for that purpose. The networks process the data under their own privacy policies. We do not sell your personal data.

12. Push notifications (OneSignal)

We use OneSignal to send push notifications to the app. After you answer the privacy screen, the app asks for your permission to show notifications (your device asks you on iOS and on newer Android versions). OneSignal processes:

• your device's push token and a OneSignal subscription ID;
• our account ID as an “external ID” while you are logged in, so that we can send notifications to the right account (it is removed from the device when you log out);
• the language you selected in the game, so that notifications arrive in that language;
• tags, such as marketing_push, which records whether you ticked Campaign and event notifications;
• technical data the OneSignal service needs to deliver notifications, such as device type, operating system and app version.

We send marketing notifications (campaigns, discounts and events) only to devices marked as having ticked Campaign and event notifications. Service notifications about your account and the game can be sent while notifications are allowed on your device. You can turn off all notifications at any time in your device settings, and change the marketing choice under Settings > Privacy preferences. The same push token is also used for uninstall measurement if you consented to ad measurement (section 10).

13. Invite program (invite and creator codes)

Every player can get a personal invite code. Content creators can have a creator code. Player invite codes are random and are not made from your name or account ID. Creator codes are agreed with the creator and may contain their public creator name. You can share your code or invite link through your phone's share menu; we never ask for your friends' phone numbers or email addresses.

• Invite links are AppsFlyer OneLink links (go.kyrin2.global). When someone opens one, AppsFlyer processes the click (for example the IP address, device and browser type and the time) to send them to the right store or to the invite page on this Site, and, if they later consent to ad measurement in the app, to pass the code into the app. An invite link also carries a technical AppsFlyer identifier of the player who shared it, so that the invite can be credited. The invite page on this Site only reads the code from the link inside your browser to display it; it does not store it and uses no cookies.
• When you use a code (through a link, by typing it at sign-up, or once later in the game under Invite a Friend), we record which code you used, who it belongs to (the inviting account or creator), how it was entered and when. For fraud checks we also record the IP address and a device identifier from your sign-up, and, if you consented to ad measurement, your AppsFlyer ID and advertising ID.
• Reward eligibility: to decide whether an invite qualifies for rewards, we check the invited account's progress, such as character level, the number of different days played, account age and, if a purchase-based reward is active, whether a purchase was made and not refunded. Weekly and lifetime limits apply.
• Fraud prevention: we compare the invited account with the inviting account's known accounts and devices: the same device identifier, AppsFlyer ID or advertising ID, the same network address range, or matching email addresses. A match does not reject the invite automatically; the invite is held and reviewed by our team.
• What other players see: the inviting player sees the invited player's character name masked (only its first characters) and the invite status. The invited player sees who invited them, also masked, or the creator's name.

14. Legal bases

Depending on where you live, we process personal data under the Turkish Personal Data Protection Law No. 6698 (KVKK) or the EU/UK General Data Protection Regulation (GDPR). For the features in sections 9 to 13 we rely on:

• Your consent (explicit consent under KVKK; GDPR Art. 6(1)(a)) for ad measurement with AppsFlyer, including uninstall measurement and sharing with advertising networks, for personalized ads, and for marketing push notifications. You can withdraw it at any time (section 17); this does not affect processing that took place before. Apple's anonymous SKAdNetwork notice (section 10) contains no data that identifies you and does not rely on consent.
• Performance of our contract with you for running the invite program, checking reward eligibility and delivering rewards, and for service notifications.
• Our legitimate interests in preventing fraud and abuse, in particular the device, network and account checks of the invite program, and in keeping the game secure.
• Legal obligations, for example keeping records of purchases or of the consent you gave.

15. How long we keep this data

• User-level campaign details that come from advertising networks (campaign, ad set, ad and channel, currently for Google and Meta) are anonymised in our systems 6 months after the install. Only the general source (for example “Google Ads”) and the install date remain.
• The full install source data the app receives at its first launch is deleted after 90 days.
• Advertising IDs and IP addresses linked to a device are deleted 13 months after the device was last seen; the IP address from sign-up is deleted 13 months after sign-up.
• Records of events sent to AppsFlyer are deleted after 30 days (90 days for events that could not be delivered).
• Aggregated reports, such as the number of installs or sign-ups per campaign and day, do not identify you and are kept as long as we need them.
• Your consent records, invite records and push subscription data are kept while your account exists and as long as needed for the purposes above, for security and to meet legal obligations.
• AppsFlyer, OneSignal and the advertising networks keep data under their own retention periods and their agreements with us.

16. International transfers

AppsFlyer, OneSignal, Google and, if enabled later, Meta and TikTok process data on servers outside Turkey and the European Economic Area, for example in the United States. We transfer personal data abroad only under a transfer mechanism permitted by KVKK Article 9 and, for users in the European Economic Area, Chapter V of the GDPR, together with the providers' data processing terms.

17. Withdrawing consent and your rights

• Withdraw or change consent: in the game open Settings > Privacy preferences and untick the options you no longer want. AppsFlyer measurement in the app stops at once; our servers stop sending events about you and marketing notifications stop as soon as the change reaches them, at the latest at your next login.
• Device controls: you can turn off notifications in your device settings, reset or delete your advertising ID (Android) and keep “Allow Apps to Request to Track” off (iOS).
• Your rights: you can ask to access, correct or delete your personal data, to restrict or object to processing, to receive your data in a portable format where this applies, and to learn which third parties received it. Under KVKK these are your rights under Article 11.
• Deletion: you can delete your account through the account deletion page or ask us through the support page. We then delete or anonymise the data described above in our systems and, where it applies, ask AppsFlyer and OneSignal to delete the data they hold about you.
• Complaints: you can also complain to a data protection authority, for example the Turkish Personal Data Protection Authority (KVKK) or the authority in your EU or UK country of residence.

To make a request, contact us through the support page. We may need to confirm that the account is yours before we act on a request.

← Back to home