Privacy Policy

Last updated: September 8, 2026

Zoo Merge: Rescue the Animals ("the App") is made by Shimal / Hazar Üstün ("we", "us"). This page explains what data the App collects, why, and how to reach us about it.

1. No account, no personal profile

The App does not require you to create an account, and does not ask for your name, email address, or any other personal identifier to play. Your progress — score, rescued animals, coins, diamonds and settings — is stored only on your own device.

2. Advertising

The App shows ads through Google AdMob (rewarded video ads you choose to watch, and occasional interstitial ads between runs). To do this, AdMob and its partners may collect:

• Your device's advertising identifier (IDFA), where you have granted tracking permission via Apple's App Tracking Transparency prompt
• General device and app information used to serve and measure ads (device type, OS version, coarse location inferred from IP, ad interaction events)

If you are in the European Economic Area, the United Kingdom or Switzerland, the App shows you a consent form before any ad is requested, built with Google's User Messaging Platform. Nothing is collected for advertising until you answer it. You can change your answer at any time from Settings → Ad Privacy Choices inside the App — withdrawing consent is as easy as giving it, and takes effect on the next ad request.

Outside those regions you control tracking in Settings → Privacy & Security → Tracking on your device. Declining still lets you play the App and watch ads — they are simply less personalized. For details on how Google's advertising products handle data, see Google's Partner Sites policy, and for the list of companies that may receive data under your consent, the vendor list shown inside the consent form itself.

Legal basis (EEA/UK)

• Personalized advertising and the advertising identifier — your consent, GDPR Art. 6(1)(a), collected through the form described above and withdrawable at any time.
• Non-personalized advertising, fraud prevention and ad measurement — our legitimate interest in funding and protecting a free app, GDPR Art. 6(1)(f).
• Purchases — performance of a contract, GDPR Art. 6(1)(b), carried out by Apple.

3. Purchases

Diamond packs and Remove Ads are processed entirely by Apple through StoreKit (In-App Purchase). We never see or store your payment details — Apple's own privacy policy governs that transaction.

4. What we do not collect

• No account registration, no email, no phone number
• No user-generated content, no chat, no social features
• No location tracking beyond the coarse, IP-based signal AdMob uses for ad delivery
• No sale of personal data, ever

5. On-device diagnostics

The App keeps a small set of counters on your own device (sessions played, runs completed, best score) purely so it can pace its own tutorial and review prompt. There is no analytics SDK, no server, and no way for these numbers to leave your device. Deleting the App deletes them.

6. Data retention

Gameplay data lives on your device for as long as the App is installed. Deleting the App deletes this data. Advertising identifiers are governed by Apple's and Google's own retention rules, not ours.

7. Children's privacy

The App is rated 4+ for a general audience. It is not directed at children, and we do not knowingly collect personal data from children under 13 (or under 16 in the EEA, where local law sets that age). Ad content is limited to Google's "General audiences" rating. Where tracking is declined, unavailable, or the consent form is answered "no", ads are served in non-personalized form. If you believe a child has provided personal data through the App, contact us and we will have it deleted.

8. Your rights

We hold no account and no personal profile tied to you, so in practice most requests are answered by your own device: Ask App Not to Track, the in-App Ad Privacy Choices screen, and deleting the App, which erases everything it stored.

Where the GDPR or the UK GDPR applies, you nevertheless have the right to access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent at any time without affecting processing already carried out. Write to the address below and we will answer within one month, routing anything held by an advertising partner to that partner.

You also have the right to lodge a complaint with a supervisory authority (GDPR Art. 77) — in the EEA, the authority of the country you live or work in; in the UK, the Information Commissioner's Office; in Türkiye, the Kişisel Verileri Koruma Kurumu.

9. International transfers

We run no servers of our own. The advertising and payment partners named above — Google LLC and Apple Inc. — process data in the United States and other countries outside the EEA, UK and Türkiye. Those transfers rely on the European Commission's Standard Contractual Clauses together with the EU–US Data Privacy Framework, under each company's own terms.

10. KVKK aydınlatma metni (Türkiye)

6698 sayılı Kişisel Verilerin Korunması Kanunu kapsamında veri sorumlusu Hazar Üstün'dür. Uygulama; reklam gösterimi amacıyla reklam kimliği (IDFA), cihaz ve uygulama bilgileri ile reklam etkileşim verilerini, açık rızanıza dayanarak (KVKK m.5/1) Google LLC aracılığıyla işler. Satın alma işlemleri Apple Inc. tarafından sözleşmenin ifası hukuki sebebiyle yürütülür. Verileriniz yurt dışına, yukarıda belirtilen güvenceler çerçevesinde aktarılır. KVKK m.11 uyarınca verilerinizin işlenip işlenmediğini öğrenme, düzeltilmesini veya silinmesini isteme ve zararın giderilmesini talep etme haklarına sahipsiniz; başvurularınızı aşağıdaki e-posta adresine iletebilirsiniz.

11. Changes to this policy

We may update this page from time to time. The current version always lives at this address; material changes will be reflected here with an updated date.

12. Contact

Questions about this policy: hello@shimal.app