Privacy Policy
Scope and controller
This policy covers TrapBoom, offered under the NebulaPurr Games brand. The legal publisher and data controller is Rabia Çiloğlu. NebulaPurr Games is the developer brand used by Rabia Çiloğlu and is not a separate company or legal entity. Contact for support, privacy and personal-data requests: support.nebulapurr@gmail.com. Effective date: 7 October 2026.
On-device storage
Guest single-player progress, completed games, wins, local progression/XP, selected theme/difficulty and sound/motion preferences are stored on the device. Language preference and a randomly generated local guest ID are also stored locally. This ID is not an advertising ID. Operating-system backups may contain separate copies.
Online play and accounts
This policy is for the release with online play enabled. Supabase provides the online service. Guest online play creates a server user ID without requiring an email address; it does not mean that no data is processed. Email accounts process an email address and authentication data. Never include your password in a support request. Player IDs, matchmaking/room records, selected champion/theme, moves, results, ratings, XP, virtual currency balances, ownership and transaction records may be stored to operate the game. Notice/terms revision and acknowledgement or acceptance times may also be recorded.
Single-player while signed in
Guest single-player without a server session uses local progression. While a server session is active, board validation, move sequences and result/reward processing may send data to Supabase. We therefore do not describe all single-player use as data that never leaves the device.
Technical data and recipients
Supabase provides authentication, database and account-deletion functions. IP addresses, timestamps, requests/responses and errors may be processed to provide and secure the service. Support email processes your email address and message contents through the email provider. Your opponent sees your selected theme/avatar, match state and other information needed for play; your email address is not intended to be displayed to opponents. Necessary information may be disclosed to competent authorities where legally required.
Advertising, analytics and permissions
The first closed-test release does not use a third-party advertising network, marketing analytics, advertising-ID tracking or real-money in-app purchases. The game does not request access to contacts, precise location, camera, microphone or the photo library. If any of these features is introduced later, the provider, purpose, data categories and relevant policy links will be added here and to the store data disclosures before that app update is released.
Purposes and legal grounds
Account, match and progression information operates the service you request. Technical records support security, troubleshooting and abuse prevention; support messages are used to answer requests. Depending on applicable law and purpose, grounds include performance of a contract, legal obligations, establishment or defence of rights, and legitimate interests balanced against your rights. Features requiring consent use a separate, specific and withdrawable choice. Reading this policy is not blanket consent to processing or international transfers.
International processing
The primary database for online services is hosted in Frankfurt, Germany. Supabase Pte. Ltd. is used as a processor for authentication, database and account-deletion services; the support-email and website-hosting providers may also process data outside Türkiye. The Supabase Data Processing Addendum forms part of the service agreement and includes contractual commitments concerning regional hosting, subprocessors, security, deletion and international transfers. Frankfurt as the primary region does not mean that all authentication, technical logs, support, subprocessors and backups remain exclusively in Germany. Transfers are handled with the applicable safeguards and notification procedures required by Article 9 of Türkiye’s Personal Data Protection Law and other applicable data-protection laws.
Retention
Local saves remain until the relevant app data is cleared. Account and associated progression data remain while the service and purpose require them and are removed from active records following a verified deletion request. Online match details from current and previous game versions, together with server-side solo boards, enter hourly cleanup 30 days after creation. Unfinished, unexpired online matches are retained; outages or backlog may delay deletion. Account progression, ranking, balances and ownership are unaffected. TrapBoom does not create a separate archive of technical logs; provider logs are kept according to the active plan, usage limits and the period needed for security and troubleshooting. Support correspondence is retained for no more than six months after the request is closed. Where provider backups are enabled, deleted data may remain in encrypted rotating disaster-recovery backups until the applicable backup cycle expires and is not restored for ordinary use. Limited records needed for a legal obligation or a specific dispute may be retained for the necessary period.
Deletion and control
Use Delete Account in the Account or Privacy and Data screen to initiate deletion of the server account and associated active game data. Recent authentication may be required. If you cannot use the app, use the external Account and Data Deletion page. Online guests can copy their server player ID in the app; possession of an ID alone is not proof of ownership. Clear local game data using your device controls; uninstall/backup restoration behaviour depends on the operating system. Server deletion does not automatically remove local saves or operating-system backups.
Your rights
Depending on applicable law, you may request access, information about processing and recipients, correction, deletion, restriction or portability, object to certain processing or automated decisions, and complain to the competent authority. Türkiye residents have the rights provided by Article 11 of Law No. 6698. Contact support to exercise your rights. We use proportionate verification and never ask for your password or payment-card information.
Children and updates
The first release of TrapBoom is intended for users aged 16 and over and is not directed to children under 16. If you believe that data relating to a person under 16 has been processed without appropriate authority, contact the support address so that the matter can be verified and the necessary deletion performed. Material changes to data use, target age or providers require an updated policy and appropriate in-app notice.