Privacy Policy — Prism Sort

Document revision: 2026-10-25.1

Effective date: 25 October 2026 — actual-publication-date candidate

Developer / display name: Saber Games

Developer / controller: SELÇUK EMRE DAĞ

Contact address: Rasimpaşa Mahallesi, Mühendis Sarı Ali Sokak / No: 6, Daire: 4 / Kadiköy - 34716 / Türkiye (TR)

Contact: prismsort@gmail.com

Prism Sort is an ad-supported mobile game. We use a pseudonymous player identifier to operate the game and an Amazon Web Services backend to protect purchases and game economy data. Advertising is delivered through Unity LevelPlay mediation. We do not receive your payment-card details, and we do not sell personal information for money.

1. Scope

This Privacy Policy explains how Prism Sort (the “App”, “we”, “us”, or “our”) collects, uses, and shares information when you use the App. The Android service descriptions below apply to versions that include those services; they do not add those features to earlier versions. This revision corrects retention and deletion information and identifies the individual developer/controller. It does not restrict this package-wide notice to the adult internal-test cohort or enable a new feature. We will update this policy before materially changing our data practices or publishing on another platform.

Android service update: sign-in and purchases

Unity player identity. In versions using Unity Authentication, the game uses a pseudonymous player/account identifier assigned by Unity for sign-in and backend game and economy operations. In those versions, this is the player identifier instead of the older device-derived identifier described below. A pseudonymous identifier is not fully anonymous data.

Unity purchase services. In versions using the updated Unity In-App Purchasing service, Unity may receive player, installation and session identifiers; device, app, platform and country information; service-configuration requests; and session and purchase events. Purchase events can include product, order, price, quantity, transaction, status and failure information. For Google Play paid or fulfilled purchase events, the service can also send the Google purchase receipt and signature. These flows support purchase services and related service analytics. They are separate from optional crash diagnostics; turning crash diagnostics off does not turn these purchase-service flows off.

Additional advertising or linked-analytics identifiers depend on the applicable Unity consent state and remotely enabled service attributes. Their inclusion is not implied by accepting the optional crash-diagnostics choice. Firebase Analytics remains deactivated for the diagnostics feature described below.

Recipient and privacy information: Unity In-App Purchasing privacy information and Unity Game Player and App User Privacy Policy. Unity describes its retention and request handling by service and processing role. For IAP data processed on our behalf, verified privacy requests may require us to instruct Unity through its manual request process. For data Unity processes for its own purposes, Unity directs individuals to its own request process. You can contact us at prismsort@gmail.com for requests concerning our use of your information. Turning off crash diagnostics does not delete purchase-service records.

Optional Android crash diagnostics

Optional crash diagnostics. In Android versions with this feature, adults can separately enable Firebase Crashlytics (Google) in Settings after reading the in-app disclosure. The choice starts off and is separate from advertising consent. Reports can include crash and non-fatal error stacks, exception messages, native diagnostic details, timestamps, app and operating-system versions, and device information. SDK-generated installation and session identifiers, including Firebase installation IDs, may also be processed. Supporting Firebase libraries may process app/device and network-type metadata and app-foreground/session timing to provide crash-quality metrics. We use this information to investigate and fix faults. Automatic reports can contain values from app or third-party code; we cannot promise that every value is removed. Our manual reports use fixed diagnostic codes; we do not attach a player ID, arbitrary gameplay metadata, advertising ID, or custom analytics events to those manual reports. The Firebase Analytics library may be included as a dependency, but its collection is permanently deactivated in this version. Enabling crash diagnostics does not enable Analytics. Firebase Cloud Messaging is not used for this feature.

Declining diagnostics does not block gameplay, purchases, or required game services. You can turn it off in Settings. Switching off blocks new app-triggered diagnostic sends and requests deletion of unsent reports when the native SDK has already started. This is a request, not proof that deletion has completed. The SDK cannot be uninitialized during the running session and may continue to capture locally until the app exits. An upload already queued may finish. Reports already sent cannot be recalled by switching off. If you later enable diagnostics again, the app uses later launches to clear and verify the older local queue before permitting sending; enabling the choice does not immediately upload that older queue.

Recipient: Google Firebase Crashlytics and its supporting Firebase libraries. See Firebase Privacy and Security.

For Crashlytics reports, Firebase keeps crash stacks, data extracted from native crash dumps, and associated identifiers for 90 days, then begins removing them from live and backup systems. Raw native minidumps are held temporarily for processing. Switching off diagnostics does not recall uploaded reports.

Separately, Firebase Installations retains its installation ID until its deletion API is used; Firebase states that removal from live and backup systems then occurs within 180 days. Turning off diagnostics does not itself claim to delete that separate installation record. See the service-specific retention information in the Firebase link above.

Firebase Crashlytics operates on global Google infrastructure. Its data may be processed and stored where Google or its agents have facilities; this feature does not promise storage only in your country or in one selected region.

2. Information we process

Pseudonymous player identifiers. The player identifier depends on the authentication path used by your version of the App. Versions using Unity Authentication use the pseudonymous player/account identifier assigned by Unity. Versions using the local anonymous-authentication path may instead derive an installation-stable identifier by applying a one-way cryptographic hash to a device-provided identifier. We use the applicable pseudonymous identifier for authentication, fraud prevention, account deletion, and game-economy operations.

Gameplay, account, and economy data. Our backend, hosted on Amazon Web Services, may process level progress and attempts, virtual-currency and item balances, entitlements, reward state, and related timestamps under the pseudonymous player identifier. This lets us operate the game, enforce economy rules, restore eligible purchases, and prevent abuse.

Purchase information. If you make an in-app purchase, we receive a store-issued transaction identifier, product identifier, purchase token or receipt, and validation result. We use these details to validate the purchase and grant the product. Google Play processes the payment; we do not receive your card or bank-account details.

Advertising and device information. The App uses Unity LevelPlay mediation with Google AdMob, Unity Ads, and Meta Audience Network. These services may process the Android Advertising ID (AAID), IP address, device model, operating-system and app information, general location inferred from network information, ad impressions and clicks, reward events, and SDK diagnostic or fraud-prevention signals. The ad SDKs process this information under their own privacy policies. We do not separately store the AAID in our first-party backend.

Local data. Game save data is stored on your device using authenticated AES-256 encryption. App preferences and consent or platform-choice state may also be stored locally.

3. Advertising choices and consent

The current Android build requests non-personalized advertising by default. We will not enable personalized advertising in a jurisdiction where consent is required unless a certified consent mechanism is available and the required consent has been obtained. You can reset or delete the Android Advertising ID, or limit its use, through your device’s privacy settings. The exact menu name varies by Android version.

No iOS version is currently published. If an iOS version is released, access to Apple’s Identifier for Advertisers (IDFA) will require authorization through App Tracking Transparency (ATT). Denying ATT will not block gameplay or purchases.

4. Information we do not ask you to provide

• Your real name or email address, unless you contact us for support.
• Precise GPS location, contacts, messages, photos, camera, or microphone content.
• Payment-card or bank-account details.
• Health, fitness, or biometric data.

5. Why we process information

6. Service providers

7. Children’s privacy

Prism Sort is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to us, contact us and we will take appropriate steps to delete it.

8. Retention and deletion

We use account, entitlement and progress data to provide the game and maintain your game state. We do not promise automatic deletion after three years of inactivity. You may request deletion through the routes in Section 9.

When an account-deletion request is accepted, some purchase, refund and audit records are deliberately retained in a reduced form to handle store transactions, later refunds or reversals, duplicate notifications, security and applicable record-keeping obligations. These records can include store transaction and product details, what the purchase granted, refund status and the store’s reason category, together with a pseudonymous reference. They are distinct from the playable account and its progress.

Our currently adopted retention calculation for these deletion-kept records uses ten years after the end of the relevant calendar year: the purchase year for a retained receipt, and the year the audit record was written for a retained audit record. The year is determined using the Istanbul calendar; the calculated expiry is at 00:00 UTC on 1 January. A retained record does not expire earlier than 30 days after the deletion request was accepted. If the purchase time is unavailable, a usable validation time or the accepted-deletion time is used as a fallback, which can move the expiry later. Missing purchase time alone therefore does not mean that no expiry is assigned. This is our current retention setting, not a statement that every record is legally required to be kept for ten years.

That calculation is not a universal maximum or a guarantee of physical erasure on a particular day. Records affected by invalid or unusable clock inputs, legacy or unconfigured expiry rules, or refunds that cannot be matched to a purchase may lack an automatic expiry. Database removal, backups and provider deletion are separate processes. You can contact us to ask what is retained in your case and to exercise applicable deletion or other data rights.

Separately, the backend keeps a limited pseudonymous deletion marker without an automatic expiry, to recognise a previously deleted identity and prevent a store purchase from being credited again. This marker is distinct from a retained purchase receipt and is not covered by the ten-year calculation.

Support correspondence is used to handle your request, document its resolution and address any continuing legal obligation or claim. We do not promise automatic deletion after two years. Retention must remain limited to what is necessary for those purposes; you can request deletion or information about the records retained for your request.

Data processed by Unity, Firebase and advertising providers is subject to the service-specific information and request routes described elsewhere in this notice. Turning off optional crash diagnostics does not delete separate purchase-service records or recall reports already uploaded.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your information, and to withdraw consent where processing relies on consent. You may use the account-deletion control in the App’s Settings screen or email prismsort@gmail.com. We may ask for the pseudonymous player identifier shown in the App, or other reasonable verification, so that we act on the correct account. Do not send us your raw device identifier.

We do not sell personal information for money. Disclosures to advertising providers may be treated as “sharing” or “targeted advertising” under some privacy laws. You can exercise applicable opt-out rights by contacting us and by using your Android advertising-ID controls.

10. International transfers

Our providers may process information in countries other than the country where you live, including the United States. Where required, transfers rely on legally recognized safeguards such as adequacy decisions or standard contractual clauses.

11. Security

We use technical and organizational measures designed to protect information, including HTTPS/TLS for network communications, access controls for backend services, and authenticated encryption for the local save file. No security measure can guarantee absolute security.

12. Changes to this policy

We may update this policy when our App, providers, or legal obligations change. We will update the effective date above and provide additional notice in the App when required.

13. Contact

Saber Games Email: prismsort@gmail.com