Privacy Policy

Last updated: October 5, 2026

This policy explains what data the Crystal Rush mobile game and the crystalrush.babir.net server collect, why it is used and what rights you have over your data. The developer and data controller of the game is Babir (contact: [email protected]).

Playing without an account

You can play the game without creating an account. In that case your progress is stored only on your device and no personal data is sent to our server. For the data collected by the game's advertising service (Google AdMob), see the Ads section below.

Data collected when you create an account

Account details: your username, email address and password. The password is stored only in a non-reversible form (bcrypt hash); nobody can see your password.
If you sign in with Google: your Google account's email address, your name and your Google account ID (a permanent number). We never see your Google password and receive no other data from Google.
Game data: level progress, scores, stars, gold and experience points, in-game upgrades you bought, missions and achievements, duel results, your friend list and your display name.
Technical data: device model (as the session name), last sign-in time and IP address. This data is used for account security, cheat prevention and blocking abuse (e.g. many failed sign-in attempts).
Purchase records: if you buy in-game gold through Google Play, the product, order number, date and a non-reversible hash of the purchase token. These records are used to add the purchased gold to your account exactly once and to prevent fake purchases. Your payment details (card etc.) are processed only by Google; we can't see them.
Rewarded ad records: the type and time of the rewarded ads you watch (to apply daily limits and to give each reward only once).

The game contains optional rewarded ads: an ad is shown only when you choose to watch it for a reward (e.g. continuing where you left off, a gold gift). Ads are served by Google AdMob. AdMob may collect your device's advertising ID, your IP address (approximate location), device and app information and your interactions with ads in order to show ads, measure their effectiveness and prevent fraud. This data is processed by Google; for details see How Google uses information from sites or apps that use its services.

In the European Economic Area, the United Kingdom and Switzerland you are asked for consent to personalized ads when the game starts (Google's consent form); you can change your choice at any time.
You can reset or delete your advertising ID in your device settings (Settings → Google → Ads).

Why we use the data

To create your account, verify your sign-in and keep your progress across devices,
to provide the leaderboard, duel and friend features (your username and score are visible to other players; your email address is never shown),
to prevent cheating by verifying game results and to keep the service secure.

Sharing

We do not sell, rent or share your account data with anyone for advertising. Data is processed only by the providers used to run the service: server hosting (VPS), Cloudflare for secure delivery of the connection, Google Play for verifying purchases and Google AdMob for rewarded ads (see the Ads section above). The game contains no separate analytics tool. Unless required by law, data is not transferred to any other third party.

Security

All communication between the app and the server uses an encrypted (HTTPS) connection. Passwords are stored as hashes and session keys expire after a certain time.

Retention and account deletion

Your data is kept for as long as your account exists. You can permanently delete your account at any time:

In the game: Account screen → Delete my account,
without opening the game: https://crystalrush.babir.net/delete-account.

When you delete your account, the account and all game data linked to it (progress, scores, leaderboard entries, duels, friendships, rewarded ad records) are deleted immediately and permanently. Purchase records are unlinked from your account; the product, date, order number and token hash are kept without being associated with your identity, to prevent the same purchase from being reused and to meet financial record-keeping obligations. In security logs, entries containing only the account number are kept for at most 90 days.

Children

The game is designed for players aged 13 and over. We do not knowingly collect personal data from children under 13; if we find such an account, we delete it.

Your rights

Under the GDPR and the Turkish data protection law (KVKK), you have the right to access, correct and delete your data and to object to its processing. You can send your requests to [email protected].

Changes

If this policy is updated, the new version is published on this page and the "Last updated" date is changed.