This policy describes how Bayakawa (“we”, “us”) collects, uses, stores, and shares information when you use the Kaya (بەیەکەوە) app on iOS and Android.
Kaya is a social games app for teens and adults. It is not a children’s product and is not designed for kids.
By using the App, you agree to this policy. If you do not agree, please do not use the App.
1. Who we are
Kaya is a multiplayer and single-player games app (board games, word games, puzzles, and related social features). Privacy requests:
Email: privacy@bayakawa.com
2. Information we collect
Depending on how you use the App, we may collect the following.
2.1 Account and profile
- Google Sign-In: email address, name, and profile photo URL that Google shares with us when you sign in.
- Sign in with Apple: Apple account identifier, and the name or email address you choose to share with us, including private relay email addresses when used.
- Profile you create: display name, friend code, optional bio, avatar image, and privacy flags (appear offline, block friend requests, block new messages).
- Account identifiers: internal user and profile IDs used for accounts, friendships, matches, and messaging.
2.2 Content you create
- Messages: direct messages and in-match / party chat.
- Feedback: notes you send through in-app feedback.
- Profile photos: images from your library or camera, uploaded to our avatar storage.
2.3 Gameplay and social activity
- Progress, scores, wins, points, leaderboard stats, and play history.
- Online match and lobby data (status, invites, rematch requests, game state).
- Friendships, blocks, invites, and related in-app notifications.
- Virtual balances and items (coins, hints, undos, and similar), including local and cloud-synced values.
2.4 Device and app data
- On-device preferences: theme, sound, haptics, and local game progress.
- Diagnostics: app version, connectivity, and crash reports (Firebase Crashlytics) so we can fix failures.
- Analytics: limited event data such as game start/complete and whether an ad was shown (Firebase Analytics).
- Permissions you grant: photos / camera for avatars; Face ID or device lock to confirm account deletion. The App plays sound but does not record the microphone.
2.5 Purchases and advertising
- In-app purchases: available on iOS and handled by Apple and RevenueCat. We receive purchase status and non-sensitive metadata needed to deliver items — not your full payment card details. Android does not offer real-money purchases.
- Ads: Google AdMob may show rewarded, interstitial, banner, and native ads. Ad networks may collect device identifiers and usage data under their own policies. On iOS, you can remove most ads with an in-app purchase. Rewarded ads may still be available if you choose to watch them for coins or gems.
- Tracking permission: on iOS, we request App Tracking Transparency permission before collecting data that could be used for tracking or personalized advertising. If you decline, ads may still appear but should be less personalized.
- Consent: in regions that require it, we show Google’s User Messaging Platform (UMP) consent form before requesting ads. Settings includes an ads privacy options form.
3. How we use information
- Create and manage your account and profile.
- Provide matches, friends, messaging, and leaderboards.
- Sync progress, stats, and virtual items.
- Process purchases and ad rewards.
- Respond to feedback and keep the App reliable and safe (including abuse prevention).
- Measure feature use and crashes so we can improve the App.
- Comply with law and enforce our rules.
We do not sell your personal information.
4. How we share information
- Other players: display name, avatar, bio, and game stats, plus messages you send, as part of normal play.
- Service providers:
- InstantDB — accounts, profiles, social, messaging, and game data.
- Google — Sign-In, Firebase (Analytics, Crashlytics, Realtime Database), and AdMob.
- Cloudflare — avatar uploads and related account-deletion APIs.
- RevenueCat — in-app purchase entitlements.
- Apple App Store — distribution and iOS billing.
- Google Play — Android distribution.
- Legal / safety: if required by law, or to protect users and the App.
5. Retention and deletion
We keep account, profile, gameplay, messaging, and related data while your account is active and as needed to run the App. Local preferences stay on your device until you clear app data or uninstall. Purchase records may be kept for accounting, fraud prevention, and legal compliance.
Delete your account in the App under Profile → Settings → Delete account. Deletion requires confirmations (including your email, a confirmation phrase, Google or Apple re-authentication, and your device lock / Face ID / fingerprint). After that we delete your InstantDB user and associated data, and remove your uploaded avatar when possible.
You can also email privacy@bayakawa.com from the address on the account. We handle verified requests within a reasonable time, subject to legal retention and residual backups.
6. Your choices
- Edit profile and privacy flags in Settings.
- Sign out in Settings.
- Revoke Google access in your Google Account, or revoke Sign in with Apple access in your Apple Account settings.
- Manage iOS tracking permission in system settings.
- Revoke photo or camera permission in system settings (avatar upload may then be unavailable).
- Manage ads consent via Settings → ads privacy options, where available.
- Depending on your region (for example EEA, UK, or California), you may have rights to access, correct, delete, or restrict certain processing. Contact us to use those rights.
7. Children
The App is for a general audience of teens and adults. It is not directed to children under 13 (or the minimum age in your country), and it is not submitted as a children’s or “Designed for Families” product. We do not knowingly collect personal information from children under that age. If you believe a child has created an account, contact us and we will delete it.
8. Security and transfers
We use reasonable technical and organizational measures (including encrypted transport where applicable). No method of transmission or storage is 100% secure.
Providers may process data in countries other than yours, including the United States and other locations where InstantDB, Google, Cloudflare, or RevenueCat operate.
9. Third-party policies
- Google Privacy Policy
- Google Advertising / AdMob
- Firebase Privacy
- InstantDB Privacy Policy
- Cloudflare Privacy Policy
- RevenueCat Privacy Policy
- Apple Privacy Policy
- Google Play / Google Privacy Policy
10. Changes
We may update this policy. We will change the “Last updated” date and, when appropriate, give extra notice in the App or on this page. Continued use after changes means you accept the updated policy.
11. Contact
Bayakawa
privacy@bayakawa.com
This page is the privacy policy URL for App Store Connect and Google Play Console:
https://auderhama.github.io/Kaya/