BLOOCK Privacy Policy

This Policy explains how personal data is handled when you play BLOOCK, use an online feature, make a purchase, choose an optional advertisement or contact us. It is an information notice. Accepting the Terms of Use does not give consent to every use of your data. Optional choices and legally required permissions are requested separately.

1. Controller and contact

A natural person based in Türkiye operates BLOOCK under the Ludon Studios brand and is referred to in this Policy as Ludon Studios. Ludon Studios is not a separate legal entity. Ludon Studios is the controller and, under Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK), the veri sorumlusu.

Address: No postal address is published; the publisher can be reached by email at hello@ludonstudios.com
Privacy and support email: hello@ludonstudios.com
Privacy page: https://bloock.ludonstudios.com/privacy/

No representative has been appointed in the European Union or the United Kingdom.

2. Age and young players

BLOOCK is intended for people aged 13 and over, subject to any higher age requirement or restriction applicable to their country, store version or a particular feature. A content rating, the age for independent consent to data processing and the capacity to make a purchase are different matters.

We ask for age information to apply appropriate protections. Depending on the applicable requirement, this may include month and year of birth, an age band, country and any necessary verification or parent or guardian authorisation. We minimise the information used and do not treat a self-declaration as independently verified proof of age. We do not publish a player's birth details or age band.

In this version, players aged 13–17 can use core gameplay and the free wheel, subject to any higher applicable age restriction. Account linking, cloud saves, chosen nicknames, friends, rankings, in-app purchases and advertisements are not available to this age group. We do not currently offer a verified parental-authorisation process to unlock these features. Friends are available only to players whose age answer puts them at 18 or over, who have accepted the current Terms of Use and who can use the Game's online features; they are not available to players aged 13–17, to a player whose age is not known or to anyone under 13. These are the features currently offered, not a statement that the law universally prohibits young players from using online services. Any future access will depend on the particular feature, applicable law, appropriate safeguards and any permission actually required; it will be explained before that feature becomes available. Do not enter a false age to bypass a restriction.

Young players have high-privacy defaults. Optional social visibility is not enabled simply by creating an account. We do not publish their real names. The Game has no player search and does not read or upload address books, so no player can be found by searching. Behavioural advertising and Apple's tracking-permission request are disabled for players known to be under 18. Any advertisement offered to a young player must use an eligible age-appropriate configuration and meet the applicable consent requirements.

Until age-related eligibility is established, we limit processing to what is lawfully necessary to provide the age or parental-permission process, security and other permitted essential functions. The one exception is a sign-in you choose on the first screen of a new installation, which is sent only to find your existing account (section 3.4). This may require limited network communication; it is not a promise that no connection can occur before an age answer. An unknown age is not treated as adulthood.

If we learn that data was collected contrary to the applicable age or permission requirements, we restrict the affected processing and assess the need for permission, correction or deletion. Correcting an age does not automatically delete every earlier save or purchase. A parent, guardian or young person can contact us to ask about these protections or exercise applicable rights.

If an age correction makes an existing profile ineligible, affected cloud saves, sign-in links, friendships, requests and the chosen nickname are restricted for 30 days. The affected save, links and social connections are then deleted and the nickname is released. Contact us promptly if the correction is wrong; the current version has no automatic restoration process. This does not cancel statutory rights concerning an earlier purchase.

3. Information we process

The categories below depend on your platform, age, choices and the features you actually use. Data comes from you, your device, activity in the Game, supported platform services and, for a report or friendship, another player. A pseudonymous identifier remains personal data when it can be linked to you.

3.1 Age, profile and settings

We process age or eligibility information, the result and necessary evidence of an applicable permission check, a randomly generated player identifier, authentication credentials, system-generated or chosen nickname, avatar selection and account-linking status. Settings include language, sound, accessibility, notifications, haptics and gameplay preferences. We also record the relevant Terms version and acceptance, notices shown, privacy choices and their dates where needed to honour or demonstrate them.

Age-check information is used for eligibility and safeguarding, not advertising segmentation. Where an age band and verification outcome suffice, we do not retain a more detailed birth record merely for convenience. If parental verification is required, we explain the method and necessary data at that point. A generic advertising-consent form is not a substitute for legally required parental verification.

3.2 Gameplay, economy and cloud saves

This includes levels, chapters, stars, scores, moves, objectives, tutorials, checkpoints, attempts and results; Coins, Diamonds, Lives, power-ups, cosmetics and entitlements; and available cloud-save content and synchronisation records.

For a wheel or other reward, records may include eligibility, entry cost or advertisement completion, spin or claim reference, the offer and probabilities shown, result, grant and any correction. These records support delivery, limits and duplicate prevention. Configuration and server-time information may be used to apply the current rules.

3.3 Competitions, friends and moderation

For an eligible competition we process entries, event identifiers, scores, rank, reward status, timestamps and information needed to verify a result, such as moves or a replay. Other players may see the permitted nickname, avatar, score and rank in the relevant standing.

Where friends are available to you (section 2), friend features process your friend code; your public reference, a random reference that other players' controls use to identify your profile instead of your player ID; each friend request and friendship, including who asked whom, when the request was sent and whether and when it was accepted; removals and blocks; and the name, avatar and verified competition results shared through those features (section 7). Your friend list is a social graph: it records who you are connected with in the Game. We also process reports, relevant evidence, filter results, moderation decisions, reasons, appeals and administrator review records. This may include content supplied by another player about an incident. Moderation is not limited to automatically screening a name; reports and challenges to decisions may also require review.

3.4 Purchases and account linking

For a purchase we process the store, product, transaction reference, purchase state and time, receipt or purchase token, verification and delivery result, entitlement, refund and duplicate-prevention records. Apple or Google handles payment. We do not receive your complete payment-card number or store password.

If you choose an available Apple or Google sign-in method, the provider authenticates you and supplies the account identifier and information described by the sign-in permission screen. We use the information needed to link, recover or synchronise your Game profile. We do not receive your provider password. Provider account rules and applicable age or parent permissions continue to apply. On a new installation you can also choose Apple or Google on the first screen, before you are asked your age. The Game then sends that sign-in to our server only to check whether it belongs to an existing BLOOCK account, a step you ask for to sign in with your account (performance of a contract). If it belongs to an adult account, that account is restored to the device with the age band and acceptance of the Terms of Use already on file for it, and you are not asked for them again; if the account lacks either, you are asked only for what it lacks, once, and your answer is recorded on the account. An account on file for a player under 18 is not restored. If the sign-in belongs to no account, nothing about it is kept: an account is created only after you have answered the age question and accepted the Terms of Use, and if the age given is under 13 the sign-in is discarded on the device and nothing more is sent.

3.5 Optional analytics and diagnostics

Optional gameplay analytics and diagnostic uploads start off. They are used only after a valid separate choice, with parental authorisation where required. They may include levels, scores, moves, tutorial and screen events, app/device versions, performance information, crash or freeze details and limited diagnostic context. They may be associated with a pseudonymous session or player reference.

Turning the setting off stops new optional uploads. Necessary security, fraud-prevention, purchase and service-operation records are treated separately; they are not described as optional analytics simply because they contain a technical event. Passwords, authentication secrets, complete payment details and unrelated message or save contents are not needed for optional diagnostics.

3.6 Advertising and privacy forms

When permitted for your age and choices, advertising and consent services may process an IP address and approximate country, device and operating-system information, app version, language, network information, placement, advertisement interactions, consent and privacy signals, provider identifiers, fraud-prevention information and permitted advertising identifiers.

The presence of an advertising service does not mean every player is tracked. A provider's non-personalised mode can still process personal data or use device storage; applicable permission requirements still apply. Advertising identifiers are not used as a substitute for your BLOOCK login credential.

3.7 Support and security

If you contact us, we process your email address, the name you choose to provide, message, attachments, timestamps and information needed to investigate. Do not send unnecessary identity documents, passwords or full payment details.

Our servers and infrastructure providers also process connection and security information such as IP address, request time, requested service, response status, app or browser version and abuse-prevention signals. These can arise when an essential connection occurs, including a permitted eligibility or support process. Some providers maintain their own logs; their relevant roles and retention are disclosed in section 8.

4. Permissions and information not required for ordinary play

Ordinary play does not require your contacts, precise device location, microphone, camera or photo library. We do not ask for a real name or postal address merely to place blocks or choose a nickname. Information voluntarily included in support correspondence is handled for that request. If a particular verification or legal request needs additional information, we explain why and seek only what is proportionate.

An approximate country derived from an IP address is different from precise GPS location. A notification or tracking permission shown by the operating system is separate from accepting the Terms. Declining an optional device permission leaves other eligible features available.

5. Purposes and legal grounds

The following sets out the principal purposes and the legal grounds used where the GDPR applies. A contractual basis is used only for processing objectively necessary to provide a requested service under a valid contract; writing a purpose into the Terms does not make it necessary. Where consent or parental authorisation is required, we do not replace it with another label to avoid that requirement.

Under KVKK, processing is assessed against the applicable conditions in Articles 5 and, where relevant, 6. These include explicit consent where required, processing directly necessary for establishing or performing a contract, a legal obligation, the establishment, exercise or protection of a right, and legitimate interests that do not harm fundamental rights and freedoms. We do not assume that every GDPR ground has an identical application under KVKK. Local rules, including rules treating age or child data as sensitive, are applied where relevant.

You may object to processing based on legitimate interests where the applicable law provides that right. Required information is identified in the relevant flow. If you do not provide information necessary for a feature or a required permission, that feature may not be available; optional data is not made a condition of unrelated core play.

6. Advertising, analytics and choices

BLOOCK uses Google's User Messaging Platform (UMP) for applicable advertising privacy choices and Unity LevelPlay for advertising mediation. The active providers and their roles are listed in section 8 and the relevant form. A request for advertising is made only after the applicable eligibility and privacy conditions have been met. If a lawful provider mode is unavailable, the affected advertisement is not requested.

Declining personalisation does not prevent core play. It may result in an eligible limited or non-personalised advertisement, or no advertisement, depending on the rules and available configuration. A young player's non-personalised experience must also meet the relevant age safeguards; the absence of personalisation alone is not sufficient.

We do not use behavioural advertising or request Apple's App Tracking Transparency (ATT) permission for players known to be under 18. For an eligible adult on iOS, Apple's permission is separate from advertising consent and is requested only when tracking is actually proposed. Denying it does not block core play.

Use Profile → Privacy & Data → Privacy Choices where available to review advertising choices. Optional analytics has a separate control. Withdrawing consent stops new processing based on it and does not affect the lawfulness of earlier processing. We pass applicable updated signals to the relevant services; data already held by an independent controller remains subject to that controller's rights process and legal duties.

We do not sell personal information for cash. Some laws define disclosures for cross-context behavioural advertising as a sale, sharing or targeted advertising even without payment. Where those laws apply, the relevant opt-out, consent and recognised preference-signal requirements apply. You may contact us for assistance, and we do not deny a statutory privacy right because you decline an optional use.

7. What other players see

A permitted nickname, avatar, score, rank and limited event information can be visible in a competition you join or to a friend you accept. Where friends are available to you, anyone who has your friend code can send you a friend request. While a request is waiting, each side sees only the other's name (the chosen nickname or the system-generated name) and avatar, and no score. Once you are friends, each of you also sees the month the other started playing, their best verified Weekly Tournament score, their best verified Daily Challenge score, their number of verified runs and their verified stars. Young players have restricted visibility by default; broader discoverability or sharing is not silently enabled by account creation. The relevant control explains the audience before optional sharing is enabled.

Your birth details, age band, account credential, email address, IP address, full save and purchase history are not displayed in a ranking. A nickname you choose must follow the Community Guidelines. Friends do not see your age, birth date, age band, country, email address, sign-in account, device or advertising identifiers, save or purchases. Either of you can remove a friendship at any time; the sender can cancel a request that has not been answered and the recipient can decline it. Removing, cancelling or declining deletes the record of that friendship or request, and being friends again needs a new request. You can block any player whose name you see in a friend or request row, on a friend's card or in competition standings. A block ends any friendship between you for good, even if you later unblock the player, and hides each of you from the other in friend lists, requests, friend cards and standings; the blocked player cannot send you a request and is shown only that you are not available. Blocked players are listed in Privacy & Data, where you can undo a block at any time. Removing a friendship or blocking someone does not erase every screenshot or prior disclosure outside our control.

8. Recipients and providers

We use providers for hosting, network security, account linking, app distribution, purchase verification, consent, advertising and email. They receive the data required for their particular service. A provider may act on our instructions as a processor, or determine some purposes independently under its own notice; its role depends on the actual service and contract.

The provider details, enabled services, roles and relevant privacy and retention information are:

We may also disclose proportionate information to confidential professional advisers; authorities or courts where required by law; and relevant parties where necessary to protect people, establish or defend a claim or deal with a genuine security incident. If operation of the Game changes, any transfer of player data is subject to appropriate notice, purpose limits and applicable safeguards. A transfer of ownership is not permission for unrelated new data uses.

9. International transfers

We operate from Türkiye. Providers or authorised support personnel may process data in other countries. The applicable destinations, services and transfer safeguards are:

Where required, a transfer must have a valid legal mechanism, such as an applicable adequacy decision or the required contractual safeguards, with additional measures where necessary. Different GDPR, UK and KVKK requirements may apply to the same service. Consent to play or to advertising is not a general waiver of transfer rules. Contact us for further information or an applicable safeguard, subject to protection of legitimately confidential information.

10. Retention

We retain personal data for the purpose for which it is needed, subject to the following criteria. A continuing legal or security need is assessed against the relevant record, rather than used to retain an entire account indefinitely.

The schedule below concerns records under our control and our backup cycle. Provider-specific processing and retention information is given separately in section 8. Providers processing data on our behalf remain subject to our applicable retention and deletion requirements.

Deleting a name or replacing it with an identifier does not by itself anonymise data. Irreversibly anonymised aggregate information may be retained where it cannot reasonably be linked to a person.

11. Deletion and copies

Use Profile → Privacy & Data → Delete My Data, an available export control, or the data requests page. You may also email us without access to the Game. A player ID alone is not sufficient authorisation; we use proportionate verification.

Deletion removes or irreversibly de-identifies personal information no longer required for a lawful purpose, including relevant profile and cloud data, account links, social connections, identifiable ranking and reward records, and optional analytics. Deleting your profile deletes all your friendships and friend requests in both directions, your friend code, and the blocks and reports made by you or about you; a legal hold can keep copies of reports and blocks until the hold ends, but never of friendships or requests. Limited records may remain for legal obligations, unresolved claims, transaction integrity or justified safety investigations. They are minimised, restricted and not used to recreate an ordinary active profile.

Backups expire according to section 10. If recovery restores data already subject to a completed deletion, the deletion is reapplied before ordinary use. A pending or offline request is not reported as completed server deletion. We tell you when the action is completed and explain a material exception.

Deletion can remove access to progress and active service entitlements; the confirmation and Terms explain material consequences. Store-held purchase records are independent. Supported permanent cosmetics or remaining Pass time may be restored from a verified entitlement without issuing one-time currency bonuses again. Exercising a privacy right does not waive consumer remedies.

Uninstalling the app does not itself delete server records, and operating-system storage or backups may preserve local information. The copy of your data you can request in Privacy & Data lists every friendship and friend request, sent or received, accepted or waiting, with its dates, and names the other player only by their system-generated name. It marks a friendship or request as restricted only when your own age correction restricted it, so it reveals nothing about another player's age. An automatic export may not contain every category covered by a legal access request; contact us for any additional information you are entitled to receive.

12. Your rights and response periods

Depending on the applicable law, you may have rights to information, access, a copy, correction, deletion, restriction, portability, withdrawal of consent, objection to applicable processing and review of certain decisions made solely by automated means. You may also complain to a competent authority or seek a judicial remedy. These rights are subject to the conditions and exceptions of the applicable law.

KVKK Article 11 includes the right to learn whether your data is processed; its purpose and whether it is used accordingly; recipients in Türkiye or abroad; correction of incomplete or inaccurate data; deletion or destruction where the legal conditions are met and notification of relevant action to recipients; objection to an adverse result arising exclusively from automated analysis; and compensation for damage caused by unlawful processing.

Email hello@ludonstudios.com or use the relevant Game control. We request only proportionate verification. A parent or other representative may act where authorised by law, subject to the young person's own rights.

We comply with the deadline applicable to your request. Under the GDPR, the usual period is one month from receipt, with a permitted extension of up to two further months for complexity or the number of requests, notified within the first month. Under KVKK, we respond as soon as possible and within 30 days under the applicable procedure. A shorter or different local deadline takes priority where applicable; these periods are not a worldwide minimum waiting time. Verification does not automatically restart every legal deadline. Requests are normally free, with a fee or refusal only where the applicable law permits and with an explanation.

You may contact the Kişisel Verileri Koruma Kurumu in Türkiye or the authority competent for you elsewhere, including an EEA authority or the UK Information Commissioner's Office where applicable. Follow any mandatory local complaint procedure. This Policy does not impose an additional requirement to exhaust our support process before using a remedy available by law.

13. Automated checks and human review

We may automatically check age-related eligibility, names, suspicious activity, purchase validity and competition results. A rejected name or unverifiable score is not itself an accusation of unlawful conduct. You may contact support to challenge a mistake and request human review.

Where a decision based solely on automated processing has a legal or similarly significant effect and the applicable law gives additional rights, we honour those rights. We do not assume that every game calculation has that effect, or that no account restriction could ever have it.

14. Security, changes and language

We apply technical and organisational safeguards appropriate to the processing and risks, including controlled access, protected communications and measures against unauthorised use. No system is completely secure. We assess suspected breaches and notify authorities and affected people where required by law.

We publish the current Policy and its effective date and provide appropriate notice of material changes. A change requiring new consent does not take effect for the affected optional processing until that consent is obtained. Withdrawing one optional choice does not cancel another independent choice or automatically terminate the Terms.

Translations are provided to help you understand the Policy. A discrepancy does not reduce mandatory local rights or legally required disclosures. Contact us if a passage is unclear or inconsistent.