Privacy Policy

The game does not ask for your name, email, phone number, or precise location. The server stores only the following:

• Guest account: when the game first connects to the server, a random account identifier is created. Only one-way hashes of sign-in keys and session tokens, your language preference, and the creation time are stored.
• Cloud save: a backup of your game progress (game data such as floors, households, service levels, in-game dollars, reputation, gifts and cosmetic choices), its revision, and save time.
• Purchases: product ID, Google Play purchase token and order number, purchase state and time, acknowledgement state, permanent entitlements granted to your account (Patron Pack, cosmetics), and dollar pack records.
• Rewarded ad records: the reward type you chose, the day, whether the reward was granted, and a one-way hash of the transaction number sent by AdMob. These enforce daily limits and prevent the same reward from being granted twice.
• Google sign-in (optional): if you link your account with Google, the Google ID token is verified on the server and only a keyed one-way hash of your Google account identifier (sub) is stored. Your name, email, profile photo, and the ID token itself are not stored. We never receive your Google password.
• Technical information: the server uses your IP address only in memory and briefly for rate limiting to prevent abuse. Hosting infrastructure may keep limited access logs for security.

Game progress is also stored locally on your device. Uninstalling the app or clearing its data removes the local save.

We process this information to provide the game, keep and restore your cloud save after reinstalling, verify purchases and grant entitlements, verify rewarded ad rewards and enforce daily limits, prevent abuse and fraud, handle refunds and financial reconciliation, and provide support.

Legal bases: performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)), compliance with legal obligations (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)), legitimate interests, in particular security and fraud prevention (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)), and your consent for personalised ads (KVKK Art. 5/1; GDPR Art. 6(1)(a)).

Tower Boss shows only rewarded ads that you choose to watch, using Google Mobile Ads (AdMob). There are no interstitial or banner ads. Each reward type has a daily limit.

In the European Economic Area, the United Kingdom, and other regions where consent is required, Google User Messaging Platform (UMP) collects your advertising privacy and consent choices. Personalised ads are shown only if you consent; otherwise non-personalised ads are requested. You can change your choice at any time under Privacy options in the game settings. For users in Türkiye, this policy is the KVKK privacy notice, and explicit consent for personalised ads is requested on the same consent screen.

Google may process your IP address, advertising ID or App Set ID, device and app information, and ad interactions under its own policies to serve and measure ads and for security. When a reward is earned, Google sends our server a signed verification callback (SSV) containing a random in-game identifier, the reward, and a transaction number; it contains no personal information. See Google advertising technologies and the Google Privacy Policy.

Dollar packs, the one-time Patron Pack, and cosmetics are sold through Google Play Billing. Google Play processes the payment; Cerit Apps does not receive your card or payment details. Purchases are verified and acknowledged on our server using the Google Play Developer API. For this, a random alias linked to your account that does not identify you is passed to Google.

Gifts are bought with in-game dollars only; gifts or satisfaction are never sold for real money. There are no randomised loot boxes. The Patron Pack and cosmetics are permanent and can be restored on the same Google Play account. Dollar packs are consumable; they are added to your in-game balance and kept with your save. You can purchase with a guest account; after your first purchase we recommend linking your account with Google to protect your save.

Under KVKK Art. 11 you have the right to learn whether your personal data is processed, to request information, to learn the purpose of processing and whether data is used accordingly, to know the third parties it is transferred to, to request correction if it is incomplete or inaccurate, to request erasure or destruction, to request that these actions be notified to recipients, to object to an adverse outcome produced solely by automated analysis, and to claim compensation for damage caused by unlawful processing.

If the GDPR applies to you, you have the rights of access, rectification, erasure, restriction, data portability, and objection, the right to withdraw consent at any time, and the right to lodge a complaint with a data protection supervisory authority. In Türkiye you can apply to the Personal Data Protection Board (KVKK Kurulu).

Send requests to [email protected]; we respond within 30 days. You can also delete your account in the app; see account and data deletion.