This policy explains how the Android game Auto Yard (the “Game”, package name com.autoyard.app) and this website (the “Site”) process personal data. It is based on the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where applicable, the EU General Data Protection Regulation (GDPR).
In short: if you play as a guest, your progress stays on your phone. If you sign in with Google or Facebook, your save is backed up to the cloud. If you turn on the friend features, your nickname, garage and profile photo are visible to other players. Ads only open when you choose to watch one. Your data is never sold.
1. Data controller
The data controller is Burak Gürgil (Türkiye). For any privacy question: gurgilburak@gmail.com or the contact form.
2. Data processed in the game
When you play as a guest
No account is created and no Firebase session is started for guest play. Your save (money, cars, garage, tasks, settings), your purchase ledger and your daily ad counters are stored only on your phone. Your phone's graphics chip, memory and processor details are used only on the device to choose the graphics quality and are never sent anywhere. Guests can still watch rewarded ads and make purchases; see sections 4 and 5.
When you sign in with Google or Facebook
- Account: Google Firebase Authentication signs you in with the Google or Facebook account you choose and gives you a user ID (UID). Google and Facebook accounts with the same email address are combined into one game account; if you link both, either one signs you in to the same account. No other sign-in method is used.
- Profile details: your Google or Facebook display name, email address and profile photo address (URL) are kept in a part of your cloud save that only you can read. Your display name is only shown on your own screen; other players see the nickname you choose.
- Facebook sign-in: if you choose Facebook, the Facebook app or website opens and you approve sharing only your public profile (name, profile photo) and email address with the game; your Facebook password never reaches the game. Firebase Authentication signs you in by verifying the login token Facebook issues and links an app-specific Facebook user ID to your game account; the token is not written to your cloud save. Your friends list and posts are not accessed, and nothing is posted on your behalf. Your Facebook profile photo is not used in the game. The Facebook component in the game (Facebook SDK) is used only for sign-in; automatic app events and advertising ID collection are turned off. Facebook processes the sign-in data under its own privacy policy.
- Cloud save: your whole game progress (economy, cars, garage and decor, tasks, purchase ledger, the list of players you blocked, race counts with your friends) is stored in Google Cloud Firestore, linked to your account and readable only by your account.
When you use the friend features
The friend features require signing in (with Google or Facebook) and a nickname. When you create your nickname:
- Your public garage profile is created: your nickname, friend code, level, garage value, garage layout (decor, displayed cars and their tuning), avatar, frame, the flag you choose, garage name, showcase car, race stats (wins, races, collection, best time) and the junkyard part you asked for, if any. Your money, gems and crates are not part of it.
- Profile photo: a photo you choose from your gallery, take with the camera or your Google account photo is resized to 192×192 pixels and uploaded to Firestore. Your Google photo only becomes your avatar if you choose GOOGLE or turn on GOOGLE: ON under EDIT PROFILE → PHOTO; it is off by default. When you remove your photo or switch to a preset avatar, the uploaded image is deleted from the server.
- Friendship data: your friends list, friend requests (nickname, code and time), the junkyard parts you send to friends as gifts, race news (nickname, the cars raced and the result) and invite links (your ID, nickname and code; a link is valid for 1 hour and an expired invite is deleted within an hour).
- Reports and blocking: when you report a player, the reason, the reported player's ID and nickname and, for photo reports, a copy of the photo are stored; only the developer reviews reports, and they are deleted automatically after 180 days. The list of players you block is kept in your own save, and the blocked player is not notified.
Race notifications (optional)
Only you can turn notifications on (you're asked after your first race, or in SETTINGS → SOUND AND NOTIFICATIONS). When you do, your phone's notification token (Firebase Cloud Messaging) and your language are stored. A notification is sent when a friend beats your car and contains their nickname, at most once every 6 hours per friend. To limit how often notifications are sent, the server records the two player IDs and the time of sending; this record is deleted automatically after 1 day. Turning notifications off deletes the token.
Technical data
To work, Firebase services process technical data such as IP address, device and app version, and an app installation ID. Details: Firebase privacy information.
What the game does not do
The game does not use analytics or crash-reporting tools and does not access your location, contacts or microphone. Your data is never sold.
3. What other players can see
Your public garage profile and profile photo can be seen by players signed in to Auto Yard (when they visit your garage, in their friends list, when they race against you and when they open your invite link). Friend requests and race news are seen only by the two players involved. Your cloud save, email address and Google or Facebook display name are never shown to other players.
4. Ads
The game only shows optional rewarded ads. An ad opens only when you tap WATCH AD (to double a race prize or shorten a long repair); there are no interstitial, banner or app-open ads.
Ads are served by Google AdMob. To show and measure ads, Google may process your advertising ID, IP address, device and app information and your interactions with ads. In the European Economic Area, the UK and Switzerland, Google's consent form is shown when the game starts; you can change your choice later in SETTINGS → ACCOUNT AND PRIVACY → AD PRIVACY OPTIONS. You can reset or delete your advertising ID in your phone's Settings → Google → Ads. The game does not use child-directed ad settings, and ad content is limited to the “T” (teen) rating. Details: How Google uses information from ads.
5. In-app purchases
Gem packs are sold through Google Play. Your payment details (card etc.) never reach us; Google processes the payment. So that a pack is never granted twice and can be restored if lost, a purchase ledger keeps the product, the number of gems, the time and the Google order number (the purchase token only until the transaction is complete). The ledger is part of your save, so if you're signed in it's also in your cloud save. Your phone also keeps one-way hashes of purchase tokens.
6. Permissions, camera and photos
- Camera: requested only when you tap CAMERA to take a profile photo, and used only while that window is open.
- Gallery: you pick a profile photo with Android's own file picker; the game only sees the file you choose and does not ask for gallery access.
- Notifications: on Android 13 and newer, requested only when you turn race notifications on.
- Photo mode: the game photos you take are saved to your phone's Pictures/Auto Yard folder and are not uploaded anywhere.
- Internet: for cloud save, friend features, ads and purchases.
7. Data processed on the website
- Server logs: the Site is hosted on Vercel. For security and operations, Vercel briefly logs data such as IP address, browser details and the requested page.
- Anonymous visit statistics: Vercel Web Analytics is loaded only if you agree in the cookie settings. It uses no cookies and does not track you across sites.
- Form data: the name, email and message you enter in the contact or account deletion form are forwarded to us by email (email service: Resend). Your IP address is briefly held in memory to limit abuse.
- Invite links: the invite page reads the code in the link only in your browser and opens the game; the code is not stored on the server.
- Preference storage: your cookie choice is stored in your browser's local storage (localStorage) and is not sent to the server.
8. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Google / Facebook sign-in and cloud backup | UID, Google / Facebook profile details, game save | Performance of a contract (KVKK art. 5/2-c, GDPR art. 6(1)(b)); you start this feature |
| Friend features and public profile | Nickname, code, garage profile, profile photo, friendship data | Performance of a contract; for the photo, your choice (you can change it at any time) |
| Race notifications | Notification token, language, sending log | Consent (KVKK art. 5/1, GDPR art. 6(1)(a)); withdraw by turning notifications off |
| Rewarded ads | Advertising ID, IP, device details, interactions | Consent; via the consent form in the EEA/UK/Switzerland, elsewhere by choosing to watch an ad |
| Delivering purchases | Product, order number, time | Performance of a contract; legal obligation |
| Community safety (reports, blocking) | Report records, block list | Legitimate interest (KVKK art. 5/2-f, GDPR art. 6(1)(f)) |
| Answering support and deletion requests | Name, email, message | Legitimate interest; legal obligation |
| Site security | Server logs, IP | Legitimate interest |
| Site statistics | Anonymous visit data | Consent; can be withdrawn at any time |
9. Service providers and international transfers
Your data is shared only with the following processors, and only to provide the service:
- Google LLC / Google Ireland Ltd. (Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging): sign-in, cloud save, friend features, notifications
- Meta Platforms Ireland Ltd. / Meta Platforms, Inc. (Facebook Login): sign-in, if you choose Facebook
- Google (AdMob): serving and measuring rewarded ads
- Google (Google Play): in-app purchases
- Vercel Inc.: website hosting and anonymous statistics
- Resend: forwarding form messages by email
The game's cloud data is stored in Google's European data centres; providers may also process data in other countries, including the US. Transfers rely on the providers' standard contractual clauses and the safeguards in Article 9 of the KVKK. Apart from cases required by law, your data is not shared with anyone else.
10. Retention
- Cloud save, Google / Facebook profile details, public garage profile, friend code and friends list: until you delete your account. Profile photo: as long as you use it; deleted when you remove it or delete your account.
- Friend requests: until accepted, declined, withdrawn or the account is deleted.
- Invite links: valid for 1 hour; an expired invite is deleted automatically within an hour.
- Gifted parts: until the recipient collects them. Race news: until dismissed or replaced by the same friend's next race.
- Notification token: until you turn notifications off or delete your account. Notification sending log: 1 day. Report records: 180 days (for review and preventing abuse).
- Data on your phone (save, photos, cache): until you uninstall the app or clear its data.
- Support emails: up to 1 year after the request is closed. Deletion request records: 3 years as proof (email and request date only).
- Ad and purchase data: for Google's own retention periods. Site server logs: for Vercel's retention periods (usually a few days).
11. Deleting your account
You can permanently delete your account in the game via PROFILE → ACCOUNT → DELETE MY ACCOUNT (SETTINGS → ACCOUNT AND PRIVACY → GAME ACCOUNT leads to the same place). This deletes your cloud save, public garage profile, profile photo, friend code, friendships (on both sides), requests, race news, gifts, invites, notification token and your Google / Facebook sign-in links. If you signed in with Facebook, you can also remove Auto Yard's access in Facebook (how?). If you can't open the game, use the form on the Account & Data Deletion page.
After deletion, the following may remain for a while: reports made by you or about you (up to 180 days), notification sending logs (up to 1 day), your nickname in gifts your friends haven't collected yet, purchase and ad records held by Google, and files on your phone (removed when you uninstall the app).
12. Security
Cloud data is protected by Firebase security rules: each player can only read and write their own save, and public profiles are only open to signed-in players. The Site and the game's server connections use HTTPS only. No system is perfect; if a breach occurs, we will notify as required by the KVKK and the GDPR.
13. Children
The game is not directed at children under 13, and we do not knowingly collect personal data from anyone under 13. If you notice that we have, write to us and we will delete it right away.
14. Your rights
Under Article 11 of the KVKK (and the GDPR where it applies) you have the right to know whether your data is processed, to request information and a copy, to rectification, to erasure, to object to processing, to withdraw consent, to learn which third parties received your data, to data portability and to claim compensation for damage.
To make a request, choose "Personal data request" in the contact form or write to gurgilburak@gmail.com. We answer free of charge within 30 days at the latest. If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Authority (or, in the EU, your country's data protection authority).
15. Changes and contact
We may update this policy; we will announce important changes in the game or on this page. The date at the top shows the latest update. Questions: gurgilburak@gmail.com. The Turkish version of this policy is the original; if the versions differ, the Turkish text prevails.