Last updated: 14 October 2026

1. Data Controller

Tombala is operated by Hakan Serindik under the hknsoft brand. The data controller can be contacted at [email protected].

2. Information We Collect

• Account and profile data: an internal Tombala user ID, nickname, avatar, and account timestamps.
• Google account data: when you link Google Play Games Services, we process the provider identifier, email address, and display name available for authentication and account linking.
• Authentication and security data: refresh-token hashes and related session metadata. Raw refresh tokens are not stored in the backend. Apple-linked accounts, where supported, may also use an encrypted authentication credential for validation and token revocation; raw credentials are not included in exports.
• Gameplay and moderation data: room participation, gameplay events, reports, blocks, bans, avatar unlocks, and related moderation records.
• Technical and operational data: IP addresses, request metadata, and administrative audit records may be processed for security, abuse prevention, troubleshooting, and service operation.
• Advertising and consent data: Google AdMob and its consent tools may process device or advertising identifiers, usage data, approximate location, and consent choices according to their applicable policies.
• Rewarded advertising verification data: when you choose to watch a rewarded ad to unlock an avatar, Tombala sends Google AdMob an opaque, short-lived reward-attempt identifier as custom data. AdMob returns this identifier in a signed server-side verification callback so Tombala can validate the reward. The identifier does not contain your name, email address, provider identifier, access token, or device advertising identifier. Tombala uses it only to validate the requested avatar reward.

3. How We Use Your Information

• Providing account, profile, multiplayer, and related game functionality
• Authenticating accounts and maintaining sessions
• Operating rooms, gameplay, rewards, moderation, and abuse prevention
• Protecting the service, investigating security incidents, and complying with legal obligations where applicable
• Displaying advertisements and managing consent choices

Depending on the applicable law and the processing context, these activities may be based on providing the service, your consent, security and legitimate interests, or legal obligations.

4. Third-Party Services and Sharing

We do not sell your personal data. Data may nevertheless be processed by service providers needed to operate Tombala, including Google Play Games Services and Google AdMob.

• Google Play Services and Google Play Games Services
• Google AdMob

Depending on your location and the service involved, advertising-related processing or provider processing may be considered sharing under applicable privacy laws. Consent and opt-out choices are handled through the available consent tools and device settings.

For rewarded avatar unlocks, Google AdMob receives the reward-attempt identifier and returns it to Tombala in a signed server-to-server verification callback. Google AdMob may process this data according to Google's applicable privacy policies.

5. Hosting and International Transfers

We use third-party cloud hosting and infrastructure providers to operate the Tombala backend and database. These providers may process data outside your country. Provider locations and subprocessors may change. Where required, we apply applicable contractual, technical, and legal safeguards.

6. Data Storage and Security

We use HTTPS/WSS in production, secure platform storage for mobile session credentials, token hashing, and encryption for Apple authentication credentials. Access to administrative data is restricted to service operations and moderation needs.

7. Data Retention

• Room activity is retained for up to 90 days under the backend operational retention policy.
• After account deletion, reports and bans may be redacted and retained for up to 180 days for security and abuse prevention.
• Administrative audit metadata and IP information are anonymized after 90 days and audit records are deleted after 3 years.
• Refresh-token records are retained only until expiry, with a maximum configured lifetime of 180 days, and are then purged.
• Encrypted Apple authentication material is retained only as long as needed for validation or revocation and is purged when that workflow no longer requires it.
• Reward-attempt identifiers expire with the related reward attempt, currently within up to two hours, and expired backend attempt records are removed through scheduled maintenance. Any data retained by Google AdMob is governed by Google's applicable retention policies.
• Data held by Google, AdMob, and other providers is retained under their respective policies.

Technical logs may be retained only as long as necessary for service operation, security, abuse prevention, and legal obligations under the applicable operational logging policy.

8. Your Rights and Choices

• Access and export: signed-in users can request an account data export from the App's Settings. The export ZIP is temporarily written to the App's private cache for sharing and is removed after the share flow completes or through scheduled cleanup. Copies saved to another app or service are governed by that service's policies.
• Correction: you can update your nickname and avatar in the App; other corrections can be requested by email.
• Deletion: you can delete your account from Settings or request deletion by email.
• Advertising: you can manage consent and advertising choices through the available consent tools and device settings.
• Privacy requests: contact [email protected]. We may verify your identity and aim to respond to verified requests within 30 days, subject to applicable law.

Exports exclude raw credentials, encrypted credential material, and other users' personal data. Provider-side data must be requested from the relevant provider where applicable.

9. Account Deletion

See our Account Deletion page for the in-app and email deletion process and the limited records that may remain after deletion.

10. Changes to This Privacy Policy

We may update this Privacy Policy when our data practices, providers, retention decisions, or legal obligations change. The latest version will be published at this URL with its effective date.

11. Contact Us

For privacy questions or requests, contact Hakan Serindik / hknsoft at [email protected].