1. Who is responsible
Furkan Erkorkmaz, operating under the Nifu Games name, is responsible for the personal information processed to provide Toyfold and this website. Contact: info@nifugames.com. This policy covers the Toyfold app, toyfold.nifugames.com, and support communications. The Turkish activity-specific notice is available at KVKK Aydınlatma Metni.
2. Information and purposes
| Information | Why it is processed | When |
|---|---|---|
| Player ID, game progress, scores, level stars, preferences, chosen profile and mascot, virtual balances | Run the game, save progress, synchronize supported features, and protect the game economy | During play and cloud saving; a guest account can be created automatically |
| Apple sign-in credential and linked player identifier | Link and recover your game account | When you choose Sign in with Apple; Toyfold does not request Apple's name or email scopes |
| Purchase identifiers, product and transaction records, entitlement status, and a purchase-specific user ID | Verify purchases, deliver items, restore eligible purchases, process reversals, and prevent duplicate credits | When using purchase features; Apple handles payment details |
| Gameplay events and app/device information; crash traces, diagnostics and related installation identifiers | Understand usage or diagnose problems | Only when you enable the respective optional analytics or crash-reporting setting |
| Advertising interactions, device/network information such as IP address, and permitted advertising identifiers | Deliver and measure ads, confirm rewarded views, and prevent ad fraud | Where advertising is enabled; consent and platform permissions apply |
| Push token, platform and time zone | Deliver enabled notifications | When notification permission has been granted |
| Game Center identifiers and scores | Provide supported Game Center features | When you use those features with Apple Game Center |
| Email address, message, optional player ID and attachments | Answer support or privacy requests and investigate issues | When you contact us |
| IP address, request time, browser/network metadata and security events | Deliver and secure this website | When visiting the site, through Cloudflare infrastructure |
We do not receive your full payment-card details from Apple. Please do not send passwords, authentication codes, full payment details, or unnecessary sensitive information to support.
3. Your settings and permissions
- Analytics and crash reports: optional and off by default. Change them in Profile → Privacy & support. Disabling collection stops future optional collection; disabling crash reports also deletes unsent reports. It does not automatically erase reports already transmitted.
- Advertising: separate from analytics. Use Ad privacy options where offered. You can also manage tracking permissions in iOS Settings → Privacy & Security → Tracking. Declining tracking does not necessarily remove contextual ads.
- Notifications: manage permission in iOS Settings → Notifications → Toyfold.
- Account: use the account deletion action in Profile, or contact us if you cannot access it.
4. Service providers and recipients
Information needed for the purposes above is shared with relevant service providers. We use Firebase (Google) for authentication, cloud data/functions, app integrity and supported notification features, plus optional Analytics and Crashlytics; RevenueCat for purchase and entitlement management; Apple for App Store payments, Sign in with Apple and Game Center; and Cloudflare for website delivery and security. In ad-enabled builds, AppLovin MAX and configured advertising partners, including Google AdMob, process advertising information. The partners and choices applicable to an ad request are described in the in-app consent interface where available.
Read their notices: Firebase, RevenueCat, Apple, Cloudflare, AppLovin, and Google. Their processing may also be governed by their own terms and roles. We may disclose limited information when legally required, to protect lawful rights or security, or as part of a business transfer subject to applicable safeguards.
5. Legal bases and international processing
Where data-protection law requires a legal basis, we rely on performance of the service you request for account, save and purchase features; legitimate interests in proportionate security, fraud prevention and support, balanced against your rights; legal obligations for required records; and consent for optional analytics, diagnostics or advertising/tracking where required. You may withdraw consent without affecting the lawfulness of earlier processing.
Providers may process information outside your country, including in the United States and Europe. International transfers must comply with applicable requirements, including adequacy decisions, approved contractual safeguards or another valid transfer mechanism where required. A privacy notice or your use of the app alone does not replace a legally required transfer safeguard or consent. Contact us for information about the safeguards applicable to your data.
6. Retention, deletion and security
Player data is kept while needed to provide your account and game features. The account deletion workflow removes the player record and associated game data, linked authentication and purchase-service profile, and associated ad/push records handled by that workflow. Limited deletion-processing records are marked for expiry after 30 days following completion; actual cleanup can depend on database expiry processing. A limited transaction reference may remain to prevent duplicate credits, with player-linked fields removed. Records required for legal obligations, disputes, security or fraud prevention may be retained for those purposes.
Optional reports already sent to providers, support correspondence, independent Apple records, and provider backups are not all removed by the in-app deletion action. Contact us to request deletion of information outside that workflow. Retention depends on the purpose, provider settings, and applicable duties; information is deleted or de-identified when no longer needed. No storage or transmission system is completely secure, but this does not limit our legal security responsibilities.
7. Your rights
Depending on your location and applicable law, you may request access, correction, deletion, a copy or portability, restriction, object to processing, withdraw consent, and complain to your competent data-protection authority. Applicable sale/sharing or targeted-advertising opt-out rights can be exercised through the available ad privacy controls or by contacting us. We do not sell player account records for money; advertising disclosures may fall within broader definitions of sharing or sale under some laws. We do not use gameplay data to make decisions with legal or similarly significant effects about you.
Send requests to info@nifugames.com with “Toyfold privacy request” in the subject. We may ask for proportionate verification before disclosing or changing account information. Include your player ID if available, but never your password. We will respond within the period required by applicable law. Exercising your rights will not result in unlawful discrimination. See account deletion support.
8. Children
Toyfold is a general-audience game and is not directed to children under 13, or under a higher age where local law requires parental authorization for the relevant processing. An App Store content rating is not consent to personal-data processing. If a parent or guardian believes a child has provided information without required authorization, contact us so we can investigate and take appropriate action, including deletion where required.
9. This website
This marketing site does not add analytics, advertising pixels, embedded third-party video players, or marketing cookies. Fonts and artwork are served locally. Cloudflare still processes network information to deliver and secure requests and may use necessary security technologies. Clicking an external link takes you to a service with its own practices. Email links open your email app and send nothing until you choose to send.
10. Updates and contact
We will update this page when our practices change and provide additional notice or obtain consent where required. The date above identifies the current version. Questions: info@nifugames.com.