Privacy Policy: Pişti

Effective date: 15 October 2026
Applies to: the Android app Pişti - Card Game (com.lelobyte.pisti), from the release that asks whether to share usage data. It replaces the policy dated 31 August 2026, which covered the versions that sent usage statistics under the ads consent and had no crash reports.
Developer / contact: Altug Ataalp — ataalpaltug92@gmail.com

The short version

Pişti has no accounts, no login, no chat, and no server of its own. The developer runs no backend, receives no personal data, and keeps no profile of you.

Two Google services can run inside the app, and they are the only things in it that reach the internet:

1. Google AdMob, which serves the banner and the occasional full-screen ad;
2. Firebase — Google Analytics for Firebase, which counts how the app is used, and **Firebase Crashlytics, which reports crashes — but only if you say yes to Share usage data**.

The app asks you once whether to share usage data, with a yes and a no of equal weight, and sends no usage statistics and no crash report until you have said yes. You can change the answer at any time in Settings → Share usage data. In the EEA, the UK and Switzerland the app also asks for your consent before an ad uses any identifier, and you can change that answer in Settings → Ad privacy settings.

Everything else — your name, your settings, your progress — stays on your own device and is gone when you uninstall the app.

What the app keeps on your device

A small preferences file in the app's private storage (Android DataStore), which no other app can read. It holds:

• Your player name and your list of bot opponent names, as typed in Settings.
• Game settings — language, sound, vibration, animation speed, theme, table appearance and the optional house rules.
• Your progress — level, total EXP, wins, win streak, prestige, unlocked achievements and daily challenge progress.
• Your consent answer for ads, recorded by Google's consent SDK, and **your answer to "Share usage data"**.
• Whether the app has asked for a rating, so that it asks only once (see *Feedback, rating and telling a friend*, below).

That is the whole of it. There is no address book access, no photo access, no location, and no record of what you do beyond the progress above.

Ads

Ads are served by Google AdMob. The app shows:

• a banner at the bottom of the menu, setup, settings, help, progress, lobby and results screens — never during a hand of cards;
• an occasional full-screen ad between matches: never the first one of a session, and at most one every few minutes.

To fill an ad slot, the AdMob SDK sends Google what an ad request is made of: your device's advertising ID, its IP address, the app and its version, and technical details such as device model, operating system version, language, screen size, and the coarse (city-level) location derived from the IP address. Google acts as an independent controller of that data; what it does with it is governed by its own policies:

• Google's advertising privacy terms: https://policies.google.com/technologies/partner-sites
• Google's ad technology providers: https://support.google.com/admob/answer/6128543

Ads are capped at Google's "T" (teen) content rating or lower.

The developer never sees this data, receives no report identifying you, and cannot connect an ad request to a player.

Analytics

Usage measurement is Google Analytics for Firebase, in the developer's Firebase project pisti-b4bf8. It is off until you say yes to "Share usage data", and off again the moment you say no. With it on, it records:

• automatic events — first open, session start, app updates, and time spent in the app;
• screen views, named by screen (menu, setup, table, results, settings, and so on);
• the app's own events, each made only of words from a fixed list:
  • onboarding_done — whether the first-run lessons were played through or skipped;
  • match_start, match_resumed — a match was dealt, or an unfinished one picked up: played against the computer, hosted or joined; two or four players; the difficulty of the hardest bot;
  • match_end — the same, plus whether you won, lost or drew, roughly how many deals it took (exact up to five, then "6 to 9" or "10 or more") and roughly how long (under a minute, 1–5, 5–15, 15–30 or over 30 minutes);
  • match_abandoned — an unfinished match was replaced by a new one, and roughly after how many deals;
  • pairing_result — how an attempt to meet another phone for a local match ended (linked, other version, Bluetooth or Wi-Fi off, connection failed, left, nobody found), whether this phone hosted or joined, and roughly how long it took;
  • streak_restored — a broken win streak was given back, and whether an ad paid for it;
  • purchase_done — the Remove ads purchase went through;
  • help_opened — How to Play was opened, from the menu or from Settings.

Alongside those, the SDK sends a randomly generated app instance identifier, the device model and operating system, the app version, the language, and the coarse (country/region) location derived from the IP address. The device's advertising ID goes with them only where your answer to the ads consent allows ad storage.

None of it contains your name, the names you gave your bots, the cards you were dealt, your moves, or anything else typed into the app. Nothing identifies you personally. It is used only in aggregate — to see which features are used and where players stop playing — and it is not sold or shared with anyone beyond Google, which processes it on the developer's behalf. The project's data-retention setting is the shortest Google offers — 2 months, after which the event data expires and is gone.

The app instance identifier is not permanent, and you control it: Settings → Reset analytics ID throws it away and starts a new one that cannot be joined to the old. See Your rights, below.

Crash reports

If the app crashes or freezes, Firebase Crashlytics writes a report on the device and sends it the next time the app starts — only if you say yes to "Share usage data". A report written before you answered is thrown away if you say no. A report holds what went wrong (the stack trace), the app version, the device model, operating system and its state at the time (free memory and storage, orientation), and a random installation identifier. It holds nothing you typed and nothing about your games. Google processes it on the developer's behalf, in the same Firebase project, and keeps it for 90 days.

Your consent, and how to change it

There are two answers, and each governs its own part.

Share usage data — asked once, of everybody, wherever you live, the first time you reach the menu: a yes and a no of equal weight, and the same words as the switch in Settings → Share usage data. Until you have answered, and whenever the answer is no, the app sends no usage statistics and no crash report. You can change it at any time with that switch.

Ads consent — where the GDPR or UK GDPR applies, the app shows Google's certified consent message on first launch and requests no ad until you have answered it. Until then all four consent categories — analytics storage, ad storage, ad user data and ad personalisation — start denied. That is the app's declared default, not something you have to switch off. Analytics storage is then granted only by a yes to Share usage data; the other three follow your answer here.

• If you consent, ads may be personalised, and the advertising ID may go with usage statistics you have chosen to share.
• If you refuse, the app works in full and still shows ads, but non-personalised ones: a request is still sent, because that is how any ad arrives at all, but it is not selected from a profile of you.

You can reopen that choice at any time in Settings → Ad privacy settings, which appears wherever a consent form exists for your region.

Independently of the app, Android lets you reset or delete the advertising ID itself, in *Settings → Privacy → Ads*. That stops personalised ads on the device for every app, not just this one.

What else leaves your device

Local multiplayer. A two-player match over Bluetooth or Wi-Fi uses Google Play services' Nearby Connections to talk directly to the other player's device in the same room. What crosses that link is the player name you chose and the moves of the game in progress — to that one device and nowhere else. There is no relay server, no matchmaking service, and no copy kept by the developer. Nearby Connections is a part of Google Play services running on your device, and Google's privacy policy governs that service.

Android backup. The app allows Android's standard backup (allowBackup="true"). If device backup is switched on in your Android settings, your settings and progress — including the player name you entered — may be included in the backup your device makes to your own Google account. That backup is yours and is governed by Google's privacy policy; the developer has no access to it, and you can turn device backup off in Android's settings.

Nothing else leaves the device, and no data about you is sold to anyone.

Feedback, rating and telling a friend

Three rows under Settings → About hand you to another app. None of them sends anything by itself.

• Send feedback opens a draft in your own email app, addressed to the developer. Under the space for your message, the draft names the app's version, your Android version and the manufacturer and model of your phone. You can delete that line, and nothing is sent unless you send the email. If you do, the developer receives it as any email arrives — with your address — and uses it only to answer you and to fix the app.
• Rate Pişti opens the app's page on Google Play.
• Tell a friend opens Android's share sheet with one sentence and a link to that page. Who it goes to, and through which app, is your choice.

Once, after you have finished a few matches, the app asks Google Play to show its rating window. That window is Google Play's own. A rating or a review you give in it goes to Google Play under your Google account, as it would from the Play Store, and can be changed or deleted there. The app is not told whether the window was shown or what you answered.

Permissions and why they exist

About the location permissions: they are a legacy requirement of older Android versions for Bluetooth scanning. The app never requests your position, never reads GPS, and never stores or transmits a location. On Android 13 and newer they are not part of the app at all, and the scanning permissions it does use are declared neverForLocation.

Children

The app is not directed at children, and neither the developer nor the app builds a profile of anyone. It does carry ads and usage analytics, both of which involve the identifiers described above, and its ads are capped at Google's "T" content rating. If a child uses this app, ad personalisation can be limited further from the device's own Google settings and from the family controls on the Google account.

Purchases

There is one, and it is optional: Remove ads, a one-time purchase that turns off the banner and the between-match ads permanently. There are no subscriptions and nothing else is for sale.

The purchase is sold and processed by Google Play. Payment happens inside Play, not inside this app: the developer never receives, sees or stores your card details, billing address or name — only Play's record that the purchase exists. Whether you own it is kept on your device and re-checked with Play at each launch, which is also how it comes back after a reinstall or on a second device signed in to the same Google account.

Buying it stops all ad requests, and with them everything described under Ads above. Usage statistics and crash reports are unaffected and stay under your answer to Share usage data.

Your rights (GDPR, KVKK, and similar laws)

The developer holds nothing about you, so there is nothing on the developer's side to access, correct, export or erase — unless you chose to write in: an email you sent through Send feedback sits in the developer's mailbox, and is deleted if you ask at the same address. For the data Google receives as ad, analytics and crash-report provider, those rights are exercised through Google, under the policies linked above.

What you can do directly:

• Stop sharing usage data: Settings → Share usage data, at any time. Turning it off stops usage statistics and crash reports from that moment on, and throws away crash reports not yet sent.
• Change your ads consent: Settings → Ad privacy settings, at any time. Withdrawing it stops personalised ads from that moment on.
• Reset the advertising ID: Android Settings → Privacy → Ads.
• Erase everything local: uninstall the app, or use Android's *Settings → Apps → Pişti → Storage → Clear data*. Either removes all settings, names and progress permanently.
• Stop the backup copy: turn off device backup in Android's settings, or delete the app's backup from your Google account.
• Cut the analytics data loose from you: Settings → Reset analytics ID. This deletes the analytics data held on the device and issues a new app instance identifier, so everything recorded from that moment belongs to a fresh identity that cannot be joined to the previous one. Statistics already uploaded stay in the Firebase project until they expire under its retention setting (see Analytics, above), but nothing links them to you or to your new identifier any more.

A note on requesting erasure by email. What Firebase holds carries no name, no email address and no account — only that random identifier. The developer therefore cannot look you up, cannot tell which rows are yours, and would have to collect more data about you to try. Where a controller cannot identify the data subject, the GDPR does not require them to acquire further data purely to service a request (Art. 11), and the reset above is offered instead: it is immediate, it needs nothing from the developer, and it does not ask you to hand over an email address to exercise a privacy right. Write to the address below with any question about this, of course.

Questions and requests: ataalpaltug92@gmail.com. Residents of the EU/EEA and of Türkiye may also lodge a complaint with their national data protection authority (in Türkiye, the KVKK — Kişisel Verileri Koruma Kurumu).

Changes to this policy

A revised version is published at the same address with a new effective date and, where the change concerns how data is handled, noted in the app's release notes. This version is published before the first release carrying the usage-data question and crash reports ships, and the Play Store listing's Data safety declaration is updated to match it.

Contact

Altug Ataalp
ataalpaltug92@gmail.com