Privacy Policy

Trayful

Effective date: November 7, 2026
Developer: Atta Games Teknoloji A.Ş. ("Atta Games", "we", "us")
Contact: support@atta.games · Antalya, Türkiye

This policy explains what information the mobile game Trayful (Android package and iOS bundle ID com.attagames.trayful, together the "Game") collects, why, and the choices you have. It covers the Game on Android (versions 1.3.0 and 1.3.1) and on iOS (versions 1.3.0 and 1.3.1, iPhone and iPad). Where a part applies to only one platform, we say so. A short summary in Malay is at the end (section 12).

1. The short version

• You do not create an account, and we do not ask for your name, email address, phone number or contacts.
• Your game progress is stored on your device (and in your own device backup, if you use one).
• The Game (versions 1.3.0 and 1.3.1 on iOS and Android, November 2026) shows no ads and sells nothing.
• We use Google Firebase to understand how the Game is played, including how you interact with each level, and to find crashes.
• On Android, outside the European Economic Area (EEA), the United Kingdom, Switzerland and Türkiye, we measure which of our own ads (on Google and on Meta's Facebook and Instagram) led to your install and to two early steps in the Game (finishing the tutorial and reaching level 10), using your device's advertising ID. By default we also let Google and Meta use this information to personalize ads (section 4).
• The Game has one data switch in its settings. On Android outside the regions above it is called "Ad personalization", with the note "Analytics and ad measurement stay on.": turning it off stops ad personalization and stops the Meta SDK, while gameplay analytics and non-personalized measurement of our Google ads continue. In the EEA, the UK, Switzerland and Türkiye, and everywhere on iOS, the switch is called "Share data", the Game does no advertising measurement linked to you, and the switch turns gameplay analytics on or off. Where the Game is translated, the switch appears in your device language.
• On iOS (iPhone and iPad), the Game does not ask to track you, does not read your device's advertising identifier (IDFA) and does not include the Meta SDK. Installs from ads are measured only through Apple's SKAdNetwork, which reports in aggregate and does not identify you (section 5).
• We do not sell your personal information for money. On Android, some US state laws may treat sending your advertising ID and in-game events to Meta and Google for ad personalization as a "sale" or "sharing" of personal information, or as "targeted advertising". You can opt out at any time by turning off "Ad personalization" in the Game's settings. On iOS, the Game sends nothing to Meta and nothing for ad personalization.

2. Information stored on your device

Level progress, settings and similar game data are saved locally on your device. If Android backup is turned on for your Google account, Android may include this data in your own device backup; that backup is handled by Google under your Google account settings, and we cannot access it. On iOS, the Game keeps this data in its own app storage on your iPhone or iPad; it does not sync it to iCloud. If iCloud Backup or a backup to your computer is turned on, Apple includes the Game's data in that backup of your device; that backup is handled by Apple under your Apple Account or on your computer, and we cannot access it. Uninstalling the Game removes the local data.

3. Analytics and crash reports (Google Firebase)

We use Google Analytics for Firebase, Firebase Crashlytics and Firebase Remote Config, services of Google LLC, on Android and on iOS, to:

• understand how players use the Game, for example which levels are started, completed, failed or left, and how a level is played: the moves you make, where on the screen you tap, how long you take between moves, and when you use undo or see a hint, as well as how far you have progressed and how often you come back to the Game (for example on the day after you install it);
• make levels fairer and the Game easier to use, for example by finding levels that are too hard or buttons that are hard to hit;
• detect and fix crashes and performance problems;
• adjust a few game settings remotely without an app update, for example asking players to update when an important fix is out.

This gameplay information is linked to a random app instance identifier, not to your name. If you tap "Request data deletion" in Settings, the email it prepares includes this identifier so we can find and delete your data. It does not include anything you type, your contacts, your photos or your precise location.

How you found the Game (Android only). When the Game is first opened, it reads the Google Play Install Referrer once to learn what led to the install. It records the kind of source (organic, Google, Meta or other) and, outside the EEA, the UK, Switzerland and Türkiye, the names of our campaign, ad set and campaign group, the campaign objective, the marketing medium, whether the ad ran on Instagram, and how long after the ad click the Game was installed. If the Facebook, Instagram or Facebook Lite app is installed and the Meta SDK is active (section 4), the Game may also ask that app once, within 7 days of installing, whether the install came from one of our Meta ads, and records the same kind of campaign details and whether the ad was clicked or viewed. A positive answer tells us that one of these Meta apps is installed on your device; we do not record which one. We do not store the full referrer or ad-click identifiers ourselves. Outside the EEA, the UK, Switzerland and Türkiye, Google Analytics for Firebase and the Meta SDK may use the install referrer, including ad-click identifiers, to attribute the install to our ads.

These services may process an app instance identifier, device and app information (for example device model, operating system, language, screen size), in-game events and crash logs. The Game does not ask for or collect your device location. Google and, when the Meta SDK is active (section 4), Meta may estimate an approximate area (country, region or city) from the connection's IP address; we only see this in aggregate analytics reports. We never receive your IP address or your precise location. Event-level analytics data is kept for up to 14 months; user-level analytics data is kept for up to 14 months after your last use of the Game; our copy in our analytics data warehouse (Google BigQuery) is kept for up to 14 months. Crash reports are kept for 90 days, after which Google starts deleting them. See https://firebase.google.com/support/privacy.

Your choices. In the EEA, the UK, Switzerland and Türkiye, and everywhere on iOS, turning off "Share data" in the Game's settings stops all gameplay analytics. On Android outside these regions, turning off "Ad personalization" stops ad personalization and the Meta SDK (section 4), while gameplay analytics continue so that we can keep improving the Game. Crash reports and the small settings check (remote configuration) always stay on so we can fix problems and keep the Game working.

If you used an earlier version (Android only). Android versions before 1.3.0 had a "Share gameplay data" switch. If you turned it off, version 1.3.0 handles your choice as follows. On Android outside the EEA, the UK, Switzerland and Türkiye, the new rule applies: gameplay analytics and non-personalized measurement of our Google ads resume, while ad personalization and the Meta SDK stay off, and the "Ad personalization" switch shows as off. In the EEA, the UK, Switzerland and Türkiye, gameplay analytics stay off until you turn "Share data" on; if you later use the Game outside these regions, the new rule applies from then on. Once you change the switch in version 1.3.0, your new choice is kept.

4. Measuring and personalizing our advertising (Android only, outside the EEA, the UK, Switzerland and Türkiye)

We advertise the Game in other apps and on websites, for example through Google Ads and on Meta's Facebook and Instagram. To learn which of these ads lead to installs and to players who enjoy the Game, so that we stop paying for ads that do not work, the Game does the following on Android, only when you are outside the European Economic Area, the United Kingdom, Switzerland and Türkiye:

• Google. Google Analytics for Firebase may read your device's advertising ID and send it with the install and the in-game events described in section 3, including finishing the tutorial and reaching level 10, so that Google Ads can match an install or one of these steps to the ad that led to it. While "Ad personalization" is on, we also allow Google to use this information for ad personalization, for example to show our ads to people who are likely to enjoy the Game, or to stop showing them to people who already play it. We have turned on Google signals, which lets Google associate this activity with the Google account of a signed-in user who has allowed ad personalization in their Google settings, for cross-device measurement and ad audiences. When "Ad personalization" is off, Google may still use the advertising ID and these events to measure our ads, but not to personalize ads.
• Meta. While "Ad personalization" is on, the Game uses the Meta SDK, provided by Meta Platforms, Inc. and Meta Platforms Ireland Ltd., only to report that the Game was installed, that it was opened (once each time the Game starts), that you finished the tutorial (the first three levels) and that you reached level 10 (each step once per install), plus technical events the SDK needs to work. If your install came from one of our Meta ads, the Game also passes the Meta install referrer described in section 3 to the Meta SDK. With these events the Meta SDK sends your advertising ID, an identifier it creates for the Game on your device, and basic device and app information (for example device model, operating system version, language, time zone and app version). If the Facebook app is installed on your device, the Meta SDK also reads the attribution identifier that the Facebook app provides and sends it to Meta, so that Meta can match the install to an ad. We do not send Meta your level progress beyond these two steps, your taps or any other gameplay details, and we have turned off the Meta SDK's automatic event logging (including its crash and error reports) and its optional collection of screen titles and app layout information. Meta processes this information under its own terms and privacy policy, which also describe how Meta may use it to improve its advertising systems: https://www.facebook.com/privacy/policy.

Meta may also use this information, together with information from other apps and websites, to provide measurement services and to deliver and target ads on its services. While "Ad personalization" is on, we do not ask Meta to restrict its use of this information (Meta's Limited Data Use mode is off). When you turn the switch off, the Meta SDK stops; if it was already running at that moment, the Game also asks Meta to apply its Limited Data Use mode to anything the SDK still sends. We may switch ad personalization or advertising measurement off remotely, globally or for a country, without an app update.

How the Game decides where you are. The Game decides this on your device, without asking for location permission and without contacting any server, from the country of your SIM card, the country of the mobile network you are connected to and your device's time zone, and checks again each time you return to the Game. If any of these points to the EEA, the UK, Switzerland or Türkiye, or if the Game cannot tell, advertising measurement stays off: the advertising-related consent settings stay denied for Google, and the Meta SDK is not started. This is a best-effort check based on these device settings, not on your precise location. The Game uses these signals only for this decision and does not send them to us.

Your choices. Turn off "Ad personalization" in the Game's settings to stop ad personalization with Google and to stop the Meta SDK at any time. To stop new measurement data from being linked to your current advertising ID, reset or delete your device's advertising ID in your Android settings (for example Settings > Privacy > Ads, or Settings > Google > Ads, depending on your device). You can learn more about ad choices at https://www.aboutads.info/choices. Depending on where you live, sending your advertising ID and in-game events to Google and Meta for ad personalization may count as a "sale" or "sharing" of personal information, or as "targeted advertising" (for example under California law); the "Ad personalization" switch is how you opt out of it.

5. On iOS (iPhone and iPad)

On iOS, the Game does no advertising measurement linked to you and does not personalize ads:

• it does not show Apple's "Allow to track" prompt and does not track you across other companies' apps and websites;
• it does not read your device's advertising identifier (IDFA), and Google Analytics for Firebase does not collect the identifier for vendors (IDFV);
• it does not include the Meta SDK and sends nothing to Meta;
• the advertising-related consent settings for Google (ad storage, ad user data and ad personalization) always stay denied, wherever you are;
• it does not read an install referrer (the "How you found the Game" part of section 3 is Android only).

SKAdNetwork. While Share data is on, Google Analytics for Firebase registers the Game with Apple's SKAdNetwork. If you installed the Game after seeing one of our ads, Apple may later tell the ad network (for example Google) that the ad led to an install. Apple sends this after a delay and under its own privacy thresholds, without your advertising identifier or any other identifier of you or your device, and without your activity in other apps. This is aggregated, non-personal measurement: we only see totals per campaign in our ad reports.

Apple Ads (iOS, from version 1.3.1). If you installed the Game after tapping an Apple Ads ad, Apple tells us which campaign led to the install through its AdServices framework, and Google Analytics for Firebase records it while Share data is on. This is campaign-level information only: it does not use your advertising identifier, does not track you across other companies' apps or websites, and needs no tracking permission.

Gameplay analytics, crash reports and the remote settings check work on iOS as described in section 3. The "Share data" switch in the Game's settings turns gameplay analytics on or off; crash reports and the remote settings check always stay on. The "Request data deletion" link in the Game's settings works on iOS too.

6. Sharing of information

We do not sell your personal information for money. Information is shared only with the service providers named above (Google Firebase, Google Play and, on iOS, Apple as the operator of the App Store and SKAdNetwork) for the purposes described, with Google and Meta for advertising measurement and, while "Ad personalization" is on, ad personalization as described in section 4 (Android only, outside the EEA, the UK, Switzerland and Türkiye), or when required by law. On Android, some US state laws may treat sending your advertising ID and in-game events to Meta and Google for ad personalization as a "sale" or "sharing" of personal information, or as "targeted advertising". You can opt out at any time with the "Ad personalization" switch in the Game's settings; this stops ad personalization with Google and stops the Meta SDK.

7. Children

The Game is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us and we will delete it.

8. Data security and international transfers

Data sent by the Game travels encrypted over HTTPS. Our service providers may process data on servers outside your country, including in the United States. For transfers from the EEA, the UK and Switzerland they rely on safeguards such as the European Commission's standard contractual clauses or, where the provider is certified, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. You can ask us for more information about these safeguards at support@atta.games.

9. Legal bases and your rights

Legal bases. The information described above is collected automatically by the Game and the services named above while you play. Where a data protection law asks for a legal basis (for example the GDPR, the UK GDPR or Türkiye's Law No. 6698), we rely on: the performance of our agreement with you and our legitimate interest in a stable game for crash reports and the remote settings check; our legitimate interest in understanding and improving the Game for gameplay analytics; our legitimate interest in promoting the Game and paying only for advertising that works for advertising measurement and, while "Ad personalization" is on, ad personalization (only on Android, outside the EEA, the UK, Switzerland and Türkiye); and compliance with legal obligations where the law requires us to keep or disclose information. You can object at any time with the "Ad personalization" or "Share data" switch in the Game's settings (section 1) or by contacting us.

Depending on where you live (for example under the GDPR, UK GDPR, Law No. 6698 on the Protection of Personal Data, Malaysia's Personal Data Protection Act 2010 or California law), you may have the right to access, correct or delete your personal information, to restrict or object to its processing, and to withdraw consent. Because the Game has no accounts, we usually cannot link data to you personally; contact us at support@atta.games and we will help you exercise your rights, including deletion of analytics data linked to your device. You can also uninstall the Game at any time. You have the right to lodge a complaint with a data protection authority, for example the supervisory authority where you live in the EEA, the UK Information Commissioner's Office or Türkiye's Personal Data Protection Authority (KVKK). See also our data deletion page.

10. Changes

We may update this policy when the Game changes, for example if a later version adds ads or optional purchases. The effective date above shows the latest version, and significant changes will be noted in the Game's store listing or in the Game.

11. Contact

Atta Games Teknoloji A.Ş. · Antalya, Türkiye · support@atta.games

12. Ringkasan dalam Bahasa Melayu