Wonder Clash: Quiz Games — Privacy Policy

Last updated: October 25, 2026
Effective date: October 25, 2026

Wonder Clash: Quiz Games ("Wonder Clash," the "Game," or the "App") is provided by THE SELF MADE LABS LTD (the "Company," "we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, protect, retain, and delete personal data when you use our iOS and Android applications. It covers single-player and multiplayer games, social features, purchases, advertising, and customer support.

Data controller and contact details:
THE SELF MADE LABS LTD
Brayford Square, London, E1 0SG, United Kingdom
Email: hello@theselfmadelabs.com

Our service is intended for people aged 13 or older. Additional laws governing children's personal data, advertising, and parental consent may apply in your country. Please read this Policy carefully. Acknowledging a privacy policy does not replace any separate consent legally required for advertising or other activities.

1. Information We Collect and Process

Some information comes directly from you, some is generated when you use the Game, and some is received through Google, Apple, app stores, or the service providers described below. Not all categories of information are collected from every user.

1.1. Account and Authentication Information

• A user UUID generated by our system, display name, and sign-in method.
• If you sign in with Google or Apple, the provider-specific user ID and, if supplied by that provider, your email address and profile image.
• A one-way hash derived from a device identifier for guest accounts.
• Session identifiers, hashed refresh tokens, and session start and expiry times.
• Records of the versions of the Terms of Use and Privacy Policy acknowledged, including the date and sign-in method.

We do not collect or store your Google or Apple account password. The information we receive from an identity provider depends on the permissions you grant and the fields the provider makes available.

1.2. Age, Country, and Language

• Your self-declared age, selected once during registration (the App currently accepts ages 13–100). The current system does not allow users to change this value later.
• The country code derived from your device's regional settings and the country you select for your profile or competitions.
• App language, time zone, and other regional preferences.

We do not collect precise GPS location. Our application server does not track your precise location using your IP address. Advertising providers may, however, infer your approximate location from your IP address.

1.3. Profile and Social Information

• Username, player tag, display name, country, avatar, avatar frame, and profile cover.
• Level, XP, league, scores, and game statistics.
• Online status, last-seen information, and your privacy preferences for profile, statistics, and presence visibility.
• Friends, pending friend requests, and blocked users.
• Player reports, reasons for reports, and optional descriptions.

Information other players may see: Your profile name, player tag, avatar, country, level, and statistics that are permitted to be visible may appear on game, profile, and leaderboard screens. You can manage the visibility of your profile, statistics, online status, and last-seen information in your profile privacy settings. Blocking another user restricts the interactions supported by the App, but it cannot automatically remove copies of previously visible information that others may have retained.

1.4. Content You Upload or Submit

• Profile or avatar images you choose to upload.
• Human moderation decisions and records relating to avatars.
• Support requests, in-app feedback, question feedback, and descriptions submitted with player reports.
• Optional feedback you provide when deleting your account.

Uploading a photo is optional. Only the image you select is processed and uploaded; we do not upload your entire photo library to our servers. Uploaded avatars are optimized and image metadata is removed. Uploaded profile photos are not shown to other players until approved by an administrator. Images depicting children are not permitted as profile photos and are rejected during moderation.

1.5. Gameplay, Usage, and Performance Data

• Matches, opponents, matchmaking records, and game sessions in Duel, Royale, Time Rush, Survival, Daily Challenge, and other modes.
• Questions, your answers, correct and incorrect responses, response times, scores, rankings, wins and losses, forfeits, and reconnection records.
• Daily games, streaks, league and season points, leaderboards, XP, levels, achievements, tasks, and rewards.
• Power-up use, in-game reactions, question feedback, and interactions with the App.
• Records generated within the App relating to ad impressions and interactions.

We use these records to operate the Game, provide fair matchmaking, calculate scores and rewards accurately, identify cheating and abuse, and improve our services.

1.6. Virtual Economy and Purchases

• Balances of coins, gems, or other virtual currencies; inventory, cosmetic items, avatar frames, and power-ups.
• Virtual economy transactions, rewarded-ad verification records, and idempotency records used to prevent duplicate processing.
• Product identifiers, iOS or Android platform, and the relevant app store.
• In-app purchase and subscription history, including subscription start/end dates, status, and entitlements.
• Store transaction and original transaction identifiers, RevenueCat event identifiers, and necessary webhook event data.

Payments are processed by the Apple App Store or Google Play. Our application servers do not receive or store your credit card number, debit card details, or bank account information. Transaction information received from app stores or RevenueCat may be used to deliver purchases, verify subscription status, handle refunds, and prevent fraud.

1.7. Advertising and Advertising Technologies

The App may display banner, native, interstitial, and rewarded ads through Google AdMob. Depending on your region, consent, age-based restrictions, and platform settings, ads may be personalized, non-personalized, or limited.

Depending on configuration and permissions, the Google AdMob SDK and relevant advertising partners may process:

• Your IP address and approximate location inferred from it;
• iOS IDFA, Android Advertising ID, App Set ID, or similar device/app identifiers;
• Ad impressions, clicks, video interactions, and rewarded-ad verification signals;
• App launches and certain interactions with the product;
• Performance, diagnostic, ad-measurement, and anti-fraud information.

On iOS, App Tracking Transparency (ATT) permission is requested where required for tracking activities. In the European Economic Area (EEA), the United Kingdom, and Switzerland, required advertising choices are collected through Google's User Messaging Platform (UMP) or an appropriate certified consent management platform. Applicable US state privacy choices are also handled through AdMob's regional mechanisms. Where available, you can reopen your choices under Settings > Advertising Privacy Options in the App. You can also adjust your device's advertising and privacy settings. Declining personalized advertising does not necessarily remove all ads.

Users aged 13–17: Ad restrictions are applied based on the mandatory age selection made during registration. Ads shown to these users are subject to age-appropriate delivery requirements and applicable regional protections for children and teenagers. The technical transmission of the appropriate age-restriction signals to the advertising SDK must also be verified before release.

For more information about Google's processing practices, see the Google Privacy Policy and the Google Mobile Ads SDK data disclosure.

1.8. Push Notifications

To deliver notifications through Firebase Cloud Messaging (FCM), we may process, depending on your permission and the features you use, an FCM device token or Firebase Installation ID, its association with your user account, the operating system (iOS/Android), language, notification preference, token registration/update times, and the latest delivery error code. Notification permission is optional and can be disabled in your device settings. Disabling notifications does not prevent access to the core Game.

1.9. Technical Information and Security Logs

Your IP address may be processed temporarily when requests are made for security and rate-limiting purposes. Certain security records may store only a hash of an IP address or token. We may also process request IDs, timestamps, API endpoints, HTTP response codes, error details, platform, app version, language, server performance information, security events, spam and cheating signals, and reverse-proxy or hosting access logs.

1.10. Preferences Stored Only on Your Device

Your language, light/dark theme, music, sound-effect and haptic preferences, certain notification preferences, and some secure local session tokens may be stored on your device. We do not treat preferences that remain solely on your device as information collected by our servers. Notification preferences and session records that must be synchronized for server-side functionality may nevertheless be processed as described above.

2. Why We Process Personal Data and Our Legal Bases

We process information for the purposes below. The table outlines the potential legal bases considered under the UK GDPR and, where applicable, the EU GDPR. The corresponding conditions under Turkey's Personal Data Protection Law (KVKK) and the final legal basis for each processing activity must be assessed in light of the relevant circumstances.

Where legitimate interests are relied upon, those interests must be balanced against individuals' rights and freedoms. Refusing or withdrawing an optional permission affects the processing that legally requires it, but processing necessary for core services may rely on separate grounds.

For personal data of users in Turkey, the applicable conditions under Article 5 of Law No. 6698 (KVKK) may include Article 5(2)(c) (necessity for entering into or performing a contract, such as providing accounts, gameplay, or subscriptions), Article 5(2)(ç) (compliance with legal obligations), Article 5(2)(e) (establishment, exercise, or protection of a right, such as reviewing disputes or appeals), and Article 5(2)(f) (legitimate interests that do not override fundamental rights and freedoms, such as security and abuse prevention). Where no such condition applies and explicit consent is required for advertising or another activity, consent is sought under Article 5(1). Whether a particular condition is satisfied depends on the actual processing activity; this explanation does not itself establish a lawful basis for every activity.

3. Who May Receive Personal Data?

The following recipients or categories of recipients may process information to the extent necessary for the relevant service:

Depending on their roles, service providers may act as processors or independent controllers. Google's consent interface may provide additional information about active advertising technology partners and their purposes. We do not sell personal data as a general-purpose player list or data marketplace. However, certain disclosures within the advertising ecosystem may fall within specialized legal definitions of "sharing" in some jurisdictions, and any associated rights remain available.

4. International Data Transfers

Our primary application servers operate on Hetzner infrastructure located in Europe. However, Apple, Google, Firebase, AdMob, RevenueCat, Cloudflare, and their subprocessors may process or access data in other countries, including the United States.

Technical safeguards such as HTTPS/TLS and encryption are used during transmission. Encryption does not replace the legal basis required for an international transfer of personal data. The applicable transfer rules depend on the country of origin and destination, the recipient, and the governing law. Transfers involving users in the United Kingdom, European Economic Area, or Turkey may require an applicable adequacy decision, appropriate safeguards (such as valid standard contractual clauses or UK international data transfer arrangements), or a narrowly defined legal exception. We do not claim that a particular provider agreement has been signed or that a particular transfer mechanism applies without reviewing the relevant documentation.

You may request information about the applicable transfer mechanism and safeguards for your personal data by emailing hello@theselfmadelabs.com. The Company remains responsible for assessing the transfer requirements that apply to each provider and data flow.

5. How Long We Keep Information

We aim not to retain personal data longer than necessary for its purpose. Certain temporary records have defined periods, listed below. For other categories, the general criterion is that the information is required while the account or relevant feature is active and is then subject to the 30-day deletion process following an account deletion request. Legally required accounting or transaction evidence, ongoing disputes, security incidents, and limited deletion-audit records may be exceptions. Third-party providers have their own retention practices.

Information remaining in backups is not restored for ordinary service use. It may be processed only as necessary for recovery and is removed at the end of the maximum two-year backup retention period. This means that even though primary records are physically deleted 30 days after an account deletion request, encrypted backup copies may remain until the end of their two-year rotation period. The legal appropriateness of the two-year backup period must be evaluated against data minimization principles and deletion rights. When a retention period ends, information is deleted or rendered no longer identifiable unless another applicable legal obligation or valid basis requires retention.

6. Account Deletion: How It Works

You can request account deletion in the App under Settings > Delete Account. You can also use our Account Deletion page or email hello@theselfmadelabs.com.

When a deletion request is submitted:

1. OAuth connections, including Google or Apple links, are removed; active sessions are revoked; and push tokens are deleted.
2. Your display name is anonymized to "Silinmiş Oyuncu" ("Deleted Player"); avatar and country information are removed; and your profile is deactivated and hidden from other players.
3. Physical deletion of the primary user record and its associated data is scheduled for 30 days after the request.
4. After 30 days, the primary user record and related data are deleted. Avatar files are removed from storage through a separate cleanup job.
5. Limited deletion-audit records may be retained for 30 days, and subscription records for up to 2 years. Encrypted backup copies may remain for up to 2 years without being restored for ordinary use. Any other legally required retention exception is assessed separately.

Deleting your Wonder Clash account does not automatically cancel an active subscription with Apple or Google. You may need to cancel the subscription separately in the relevant app store's subscription settings to stop recurring charges. Account deletion may also leave some locally stored information on your device or copies of previously public information retained by others.

7. Data Security

We use technical and organizational measures proportionate to the risks to support the confidentiality, integrity, and availability of information. These measures include:

• HTTPS/TLS for data in transit;
• Keeping PostgreSQL and Redis services from being directly exposed to the public internet;
• Storing applicable tokens in hashed form and managing secrets separately from source code;
• MFA/TOTP for administrator accounts, short-lived administrator sessions, role-based access controls, and audit records;
• Rate limiting, security controls, and protections against spam and abuse;
• Encrypted backups, restore tests, service health checks, and resource limits for production services; and
• Restricting authorized personnel's access to what is necessary for their duties.

No technical or organizational measure can provide an absolute guarantee of security. If a security incident occurs, we assess our applicable legal obligations and make the necessary notifications.

8. Age Restrictions and Children's Privacy

Wonder Clash is not intended for children under 13 and requires a declared age within the 13–100 range at registration. If we become aware that we have processed the personal data of a child under 13, we take appropriate steps to investigate and delete it. You can contact us by email.

Users aged 13–17 may also be considered children under applicable privacy laws. Advertising restrictions are applied based on the age that users must select during registration. Players can manage profile and online-status visibility through their profile settings. User-uploaded photos do not become visible before administrator approval, and images depicting children are rejected. Some jurisdictions may require a higher age threshold for parental consent, more protective default privacy settings, or restrictions on particular data-processing activities. Setting a minimum age of 13 does not eliminate those requirements. The availability of profile visibility controls does not remove the need to assess legally required default settings for users aged 13–17.

9. Automated Game Processes and Human Moderation

Matchmaking, scoring, league placement, task/reward distribution, and evaluation of cheating signals may be performed automatically according to game rules. Players can report or block other players. Blocking is a social feature initiated by the player.

Player reports and uploaded avatars are reviewed by authorized administrators through human moderation. Bans are not imposed through an automatic decision-making system; player or account bans are decided by an administrator. Such decisions may affect access to the Game and social interactions. To request a review of a moderation or ban decision, email hello@theselfmadelabs.com and include your player tag. Gameplay scoring and matchmaking are not designed as automated decision-making processes intended to produce legal or similarly significant effects on individuals.

10. Your Rights and Privacy Choices

Depending on your location and the legal basis for particular processing, you may have the following rights under the UK GDPR, EU GDPR, Turkey's Personal Data Protection Law No. 6698 (KVKK), and other applicable laws:

• To learn whether personal data about you is processed and to request access to it;
• To request correction of inaccurate or incomplete data;
• To request deletion, destruction, or anonymization where the relevant conditions are met;
• To request restriction of processing, object to certain processing, and request data portability where applicable;
• To withdraw consent for consent-based processing, without retroactively affecting processing that was lawful before withdrawal;
• To reopen advertising privacy choices in the App and manage device-level tracking and advertising settings;
• To disable push notifications through device settings;
• To exercise rights available under the KVKK, including information about transfers to third parties and compensation where the relevant legal conditions are met; and
• To lodge a complaint with an appropriate data protection supervisory authority.

How to submit a request: Email hello@theselfmadelabs.com with the subject "Privacy / Personal Data Request". Where possible, include your player tag, the email associated with your account, the subject of your request, and how you would prefer to receive a response. Account deletion requests can also be submitted under Settings > Delete Account or via our Account Deletion page. Written requests may be sent to the Company's postal address above, subject to any legally prescribed local submission method.

Identity verification: To confirm that a request is genuinely from the relevant account holder, we first use available information such as the email linked to the account, the user/player identifier, or an existing authenticated session. If that information is insufficient, we may request additional proportionate evidence of account ownership. Some requests may not be completed until verification is sufficient to avoid disclosing someone else's information. Do not send passwords, complete identity documents, or payment card information unless specifically requested through an appropriate secure process.

Response time: We assess requests as promptly as reasonably possible. Requests under the KVKK are generally resolved within 30 days; requests under the UK/EU GDPR are generally answered within one month. Applicable identity-verification rules, lawful extensions for complex requests, and other procedural requirements remain in effect. Where an extension is necessary, we provide the explanation required by the applicable law. Responses are sent through a verified communication channel.

You may have the right to complain to the Information Commissioner's Office (ICO) in the United Kingdom, the Personal Data Protection Authority (KVKK) in Turkey, or another competent data protection authority in your jurisdiction. Our privacy contact is THE SELF MADE LABS LTD — hello@theselfmadelabs.com. If a separate data protection officer or regional representative must be appointed under applicable law, the relevant contact information will be provided to affected users.

11. Changes to This Privacy Policy

We may update this Policy when Game features, service providers, or legal requirements change. We indicate the last-updated date above. Where appropriate, we bring material changes to users' attention through in-app notices, notifications, or email. Before processing data for a new purpose, we provide additional information or obtain permission where required.

12. Contact Us

For questions about this Policy, your data protection rights, account deletion, or security, contact:

THE SELF MADE LABS LTD
Brayford Square, London, E1 0SG, United Kingdom
Email: hello@theselfmadelabs.com
Account deletion: wonderclash.theselfmadelabs.com/account-deletion