Privacy Policy

Effective 2026-10-28 · Applies to the Simsty apps for iPhone, iPad and Android

Who we are

Simsty is published by Nar Apps Oyun Yazilim Teknolojileri A.S., Zemin Kat, No:Z09 Ankara Teknoloji Gelistirme Bolgesi, Universiteler Mahallesi, 06800 Ankara, Türkiye ("we"). Contact us at support@simsty.com.

1. Data on your phone

The app saves these on your phone. We do not receive them, except the device ID, the events and the game wallet described below.

• The name you enter in the briefing or in Profile.
• Case progress, including the answers you typed, hints you revealed and evidence you found.
• Active play time, recently opened cases, and your language and recap settings.
• Stars, and a copy of your game wallet (section 2) shown while the app waits for our service: lives, hints, unlocked cases, ad credits and the day's free case.
• Wallet changes waiting to be sent: lives or hints you used, rewarded ads you finished and purchases waiting to be confirmed, with their store transaction IDs.
• Game events waiting to be sent (see section 4) and your game account sign-in token, kept in the iOS Keychain on this device or, on Android, in the app's device storage.
• Your device ID (see section 2).
• Your random invite code, the day you installed the app, a session counter, whether you play free, have watched a rewarded ad or have bought something and, if you came from a shared link, that link's invite code.
• Downloaded cases and their images.

Backups. So that progress survives a reinstall, iPhone keeps a copy of your progress, name, play time and stars in your own iCloud account if you use iCloud. Android includes the same data, plus waiting events, your invite code, install day and session counter, in your phone's Google backup if backup is on. These copies sit in your Apple or Google account, under their terms. We cannot read them. The device ID, the sign-in token and the game wallet copy are not part of these backups; your lives, hints and unlocks come back from our service.

2. Your device ID and game account

Device ID. On iPhone and iPad, the app creates a random ID the first time it starts and keeps it in the iOS Keychain on this device, so it stays the same if you delete and reinstall the app. It is not copied to iCloud or to another device. On Android, the app uses the ID that Android gives each app on your phone (ANDROID_ID), which stays the same across reinstalls until the phone is reset; if Android has none, the app creates a random ID and keeps it in the app's storage.

The same device ID is sent to our game service (below), to RevenueCat (section 8), to Airbridge (section 6), and to Firebase Analytics and Firebase Crashlytics (section 5). So the data each of them holds can be matched to the same phone.

Game account. The app connects to our game service the first time you submit a typed answer or the first time it sends game events, usually soon after you start your first case. It sends the device ID, the platform (iOS or Android) and the app version. The service finds the account for this device ID, or creates one, containing:

• the device ID and the platform (the app version is checked, not stored);
• a random account ID, and a random alias such as "Detective 4F2A9C1B" that the app does not show to anyone;
• a sign-in token, kept on your phone (we keep only a one-way hash of it);
• when it was created and when it expires: 180 days after you last used the app. Each use extends it.

A reinstall on the same phone brings back the same account. The account holds no name, email or phone number, and our service does not store your store account or advertising ID with it.

Game wallet. Your lives, hints, unlocked cases, ad credits and purchases are kept by our game service in a game wallet, so the app asks our service each time you use a life or a hint, start a case or finish an unlock ad, and shows "No internet connection" when it cannot reach it. The wallet is not stored under your device ID: its key is a one-way, secret-keyed code made from the device ID, which cannot be turned back into it. The wallet holds:

• your balance of lives and hints, the cases you unlocked and how (free, ad or gift), your ad credits, and the case packs RevenueCat reports for you;
• a record of each change: what changed, by how much, when, and the case it was for;
• a support ID such as S-7K2M9Q4XRT, shown in Profile, that support uses to find your wallet; it is not your device ID and cannot be turned into it;
• for each life pack, the store transaction ID and RevenueCat's purchase ID, the product, the store, whether it was a test purchase, and whether it was added or refunded;
• for a purchase still being confirmed, your device ID as RevenueCat's app user ID, so that we can ask RevenueCat about it, for up to 30 days;
• for each rewarded ad that counts towards unlocking a case, the ad's random reward number, the case, the ad unit and Google's verification transaction ID;
• gifts or corrections from support, with the reason.

RevenueCat tells our service about life-pack and case-pack purchases and refunds, and Google AdMob confirms finished unlock ads (section 7). If you move to a new phone and ask support, we can move your wallet after you prove it is yours, for example with the order number from a store receipt; we record that proof. A reinstall on the same phone brings back the same wallet; a new phone or a reset phone starts a new one.

Daily free case. When you start the day's free case, our service records a one-way, secret-keyed code made from your device ID and platform, with the day and the case. It is not linked to your game account and cannot be turned back into the device ID. We use it only to stop the free case from being claimed again on the same phone by deleting data or reinstalling (fraud prevention), and delete it after 2 days.

3. Answer checking

When you type an answer, the app sends it to our game service together with the case, its version, its language and the question. We compare it with the case's answer key and return correct or incorrect. We do not save your answer text.

For questions answered in words, if your answer is not exactly one of the approved answers, we ask TypeSafe, an AI service (TypeSafe privacy policy), whether it means the same thing. We send TypeSafe the question, the answer key (the intended answer, the approved short answers and our checking notes), the case language and your typed answer. We do not send your device ID, account ID, token or IP address, or any device information. Answers that need an exact match, such as codes and numbers, are never sent to TypeSafe. TypeSafe does not train or fine-tune AI models on what we send. It keeps it only as long as reasonably necessary to provide its service, on servers in the United States.

4. Game events

The app sends a short, fixed list of events to our game service so we can see where players get stuck, whether they come back, and how lives, ads, purchases and sharing are used: the app opened and a play session started or ended; a case viewed, started, resumed, left, replayed or completed; the first correct answer and each lead solved; every answer checked, right or wrong; a hint used; running out of lives and how lives came back; a locked case viewed; a rewarded ad started, completed, closed early or failed; a case unlocked; a case download started, finished or failed; your language changed; a case-pack purchase started, completed, cancelled or failed; a life-pack purchase started, completed, cancelled or failed; purchases restored; the share sheet opened, used or closed; the app opened from a shared link; and, on Android, the first start after installing from a shared link.

An event contains its name, the case ID (and the case's story, genre and content version), the time it happened, a random session number and small play details: which lead, right or wrong, hints and lives, stars, how long you played, whether it was a first play or a replay, the ad step, how many days since the install, which app you shared to (one of ten words such as "messages" or "mail", never the app's name on your phone) and a random invite code when you share a link or open one. Your invite code is random and is not made from your device ID. The service stores each event with your account ID and the time it arrived, keeps a list of the days you played and whether you solved a lead that day, the invite codes you shared, and a few totals for your account (first and last day seen, install day, sessions, cases completed, shares, ads completed, whether you bought anything, your language, your latest invite code and the code that invited you). When someone opens a shared link on the web, the service records the time, the invite code, the case and whether the link was opened on an iPhone, an Android phone or elsewhere; not the address or the device of the person who opened it. Events never contain your answers, your name, story text or device data. Section 12 says how long each of these is kept; Delete my data (section 13) removes all of it, including every link open of your invite codes. The same events, without the invite code, also go to Firebase Analytics (section 5).

When you share a result, the message (the case title, your stars and time, and a link with your invite code) goes to the app you choose, under that app's terms.

5. App analytics and crash reports (Firebase)

The store versions of the app use three Google services, Firebase Analytics, Firebase Crashlytics and Firebase Remote Config. Analytics and Crashlytics are off in our development builds.

• Firebase Analytics receives the game events in section 4, with the same play details and the case ID but never the invite code, and your device ID as its user ID. It also receives four properties about you: the day you installed the app, how many cases you have completed, whether you play free, have watched a rewarded ad or have bought something, and your language setting. It also receives its own app instance ID, events it records by itself (such as the first open and app sessions), and device and app information such as the device model, system version, app version and language, and your IP address, from which Google estimates your general location. It also receives the store purchases made in the app (on iPhone the App Store transaction, on Android the Google Play purchase) and the purchase events RevenueCat sends it (section 8). Measurement runs for every player from the first open and does not depend on the ad choices in section 7. When advertising storage is allowed, Firebase Analytics also reads your device's advertising ID; on iPhone only if you allow tracking. In the EEA, the UK and Switzerland, Firebase does not use advertising storage, does not use your data for advertising and does not personalise ads until you choose in Google's consent message, and then follows that choice. Elsewhere these are allowed by default.
• Firebase Crashlytics receives a report when the app crashes: the stack trace, device model, system version, app version, the app's state at the time of the crash, and your device ID as its user ID.
• Firebase Remote Config tells the app whether its version is still supported. To do this, the app sends Google its Firebase installation ID, app version, platform, language and time zone, and no game data or advertising ID.

We use them to understand how cases are played, to fix crashes and to ask you to update an app version we no longer support. Google processes this data for us under the Firebase privacy and security terms.

6. Install and campaign measurement (Airbridge)

The app uses Airbridge, a measurement service from AB180 (Airbridge privacy policy), to measure which ads or links brought an install or opened the app. The Airbridge SDK sends nothing until Google's consent message in section 7 has been answered where it is shown and, on iPhone, until you have answered the tracking question. In the EEA, the UK and Switzerland it starts only if you agree, in Google's consent message, to storing or accessing information on your device and to measuring ad performance; if you later withdraw this in Profile → Privacy choices, it stops. Once started, it receives:

• install and app-open events, and the links that opened the app;
• your device ID, as its user ID;
• device and app information, and your IP address;
• on Android, the install referrer from Google Play and your device's advertising ID;
• on iPhone, the vendor ID (IDFV), Apple's SKAdNetwork data and, only if you allow tracking, the advertising ID (IDFA).

On Android the app itself also reads the Google Play install referrer once, on its first start, to see whether a shared Simsty link brought the install. It keeps only the random invite code and the case from that link, and sends them with the events in section 4.

We pass the Airbridge device ID to RevenueCat so that purchases can be matched to the campaign that brought the install. On iPhone, Airbridge sends nothing until you have answered the tracking question in section 7; if you say no, it reports the install without the advertising ID. When you allow tracking, this measurement counts as tracking under Apple's rules.

7. Ads

Ads in Simsty are optional rewarded videos. You choose to watch one to get 3 lives back, or to count towards unlocking a case. A reward is given only when the ad finishes.

The ads come from Google AdMob. The Google Mobile Ads SDK starts when you open the app and loads an ad in advance, after any consent step below. Google receives, through its SDK:

• your IP address, which it may use to estimate your general location;
• your device's advertising ID (on iPhone only if you allow tracking) and app- or developer-scoped device IDs;
• device and app information, which ads you saw and how you interacted with them, and ad performance and diagnostic data.

Android Privacy Sandbox. On Android, the Google Mobile Ads SDK and Firebase Analytics add three permissions for Android's ad services, also called the Privacy Sandbox on Android: ACCESS_ADSERVICES_AD_ID (the advertising ID through these services), ACCESS_ADSERVICES_ATTRIBUTION (the Attribution Reporting API) and, from the ads SDK only, ACCESS_ADSERVICES_TOPICS (the Topics API). They do something only on phones where Android offers these services and they are turned on. Then Google's SDKs can ask Android for a few broad interest topics that Android works out on your phone from the apps you use (to help choose ads), and can measure whether an ad led to an install or another action through Android rather than with an ID shared across apps. Simsty's own code does not call these services.

Google uses this to show, measure and, where allowed, personalise ads and to prevent fraud. Google acts under its own policies: see How Google uses information from sites or apps that use its services and Google's Privacy Policy. We do not send AdMob your name, your answers or your device ID. For an ad that counts towards unlocking a case, the app gives AdMob your support ID and a random reward number, and Google sends them back to our game service with its own verification transaction ID, so that we can confirm the ad finished.

Your choices

• EEA, UK and Switzerland: Google's consent message asks for your ad choices when you first open the app. Change them later in Profile → Privacy choices.
• iPhone: when you first open the app, after Google's consent message where it is shown, Simsty explains in one screen why it asks, and then iOS asks whether Simsty may track you. In the EEA, the UK and Switzerland, if Google's consent message could not be shown (for example when you first open the app offline), the tracking question waits until you have answered the consent message on a later open. If you say no, neither Google, Firebase, RevenueCat nor Airbridge receives your advertising ID. You can change this in Settings → Privacy & Security → Tracking.
• Android: delete or reset your advertising ID in your phone's settings under Privacy → Ads or Google → Ads, depending on the phone. Where your phone has Ads → Ad privacy, you can also turn off Ad topics, App-suggested ads and Ad measurement there.
• Where Google shows a privacy options link for your region, it appears in Profile as Privacy choices.

8. Purchases

Simsty sells case packs, one-time purchases that unlock a set of cases for good, and life packs, consumable purchases that add lives to your game wallet (the pack sizes can change). Both are bought through the App Store or Google Play. Apple or Google handles the payment under its own terms; we never see your card or payment details.

RevenueCat (RevenueCat privacy policy) checks each purchase with the store and records the purchases of this app under your device ID (as its app user ID and as a device_id attribute), together with the Airbridge device ID. It receives the purchase history (product, store transaction, date and price) and the device and app information its SDK needs. It also receives the Firebase app instance ID, for every player, so that it can send purchase events (product, price and date) to Firebase Analytics; it sends the same purchase events to Airbridge. Under the same conditions as Airbridge (section 6), RevenueCat also receives your device's advertising ID (on iPhone only if you allow tracking), on iPhone the vendor ID (IDFV) and Apple's Search Ads attribution token, and your IP address, so that purchases can be matched to ad campaigns. Restore purchases in Profile asks the store again and unlocks the case packs you own. Life packs are used up when you play, so they are not restored. Our game service receives each purchase and refund from RevenueCat, and asks RevenueCat about a purchase the app reports, to add the lives to your game wallet once (section 2).

9. Downloads and web pages

Cases and their images download from simsty.com, which runs on Cloudflare (Cloudflare privacy policy), like these pages. These requests carry no account or device ID. Like any web server, Cloudflare sees your IP address, the time and the app's network details when your phone connects. We do not keep download logs.

10. Our game service, IP addresses and security

Our game service runs on Cloudflare Workers on simsty.com, in the same Cloudflare service as these pages. Its database is Cloudflare D1, located in eastern North America (United States). The service uses your IP address briefly, in memory and in Cloudflare's rate limiter, to limit request floods and does not store it in its database. Our own error log lines contain no IP addresses, answers or IDs. Cloudflare Workers Logs keep the service's request logs for 3 days on our current plan. All connections use HTTPS.

11. What we do not collect

Simsty does not ask for your email, phone number or real name, and has no social or email sign-in. It does not access your location (GPS), contacts, photos, camera or microphone, and sends no push notifications. If this changes, we will update this policy and the store privacy details before the change ships.

12. How long we keep data

13. Delete your data

1. In the app: open Profile, tap Delete my data, then Delete. This first sends any waiting events, then deletes your game account and everything linked to it on our game service: game events, the days you played, your account totals, the invite codes you shared and every link open of them, duplicate-request records, and your game wallet with its lives, hints, unlocks, ad credits, change records, ad verification records and gifts. Then it clears this phone: progress and typed answers, name, play time, recent cases, stars, lives, items, unlocks, waiting events, the sign-in token, your invite code, install day and session counter. Purchases still being confirmed stay on the phone so that the lives you paid for still arrive. On iPhone it also clears the iCloud copy. Downloaded cases, your language setting and the device ID stay; if you play again, the app creates a new, empty game account and game wallet, without the starting lives and hints. Bought case packs come back with Restore purchases; life items you bought and did not use do not come back. If our service cannot be reached, nothing is deleted and you can try again.
2. Data at RevenueCat, Airbridge and Firebase: the button does not delete it. Email support@simsty.com and ask us to delete it. These providers know your data by your device ID, so send the email from Profile → Help & contact: the app writes your device ID and app version into it. The app does not show the device ID anywhere else, and it stays the same after Delete my data, so you can send the email before or after. If you bought something, also add the order number from your App Store or Google Play receipt. We delete your data at those providers within 30 days. Apple and Google keep their own purchase history.
3. Ad data: use the choices in section 7, or Google's own controls.
4. On your phone: deleting the app removes everything stored on it except, on iPhone, the device ID in the Keychain. To remove backup copies, delete Simsty's backup in your iCloud or Google account settings.

What stays after Delete my data until you email us or it expires:

• RevenueCat: the purchase records of this app under your device ID, with the Airbridge device ID.
• Airbridge: install and app-open events, the links that opened the app, and the device information it received.
• Firebase Analytics: the events and the four properties already sent, for up to 14 months; Firebase Crashlytics: crash reports, for up to 90 days.
• Google AdMob: ad data, under Google's retention policy; use Google's own controls.
• Apple and Google: your purchase history, and any iCloud or Google backup you keep.
• Cloudflare: our game service's request logs, for up to 3 days.
• Our game service: the daily free case record (section 2), for up to 2 days, so deleting data does not give back the day's free case.
• Our game service: the life-pack records for up to 400 days and a one-way hash of each store transaction ID for up to 3 years, so a purchase is never added twice and refunds can be handled, and the record that this phone already received its starting lives and hints, for up to 3 years. A life pack bought but not yet added when you delete is added to your new wallet.

Deletion on our game service happens straight away; Cloudflare's logs age out within 3 days. Our service holds no contact details, so we cannot find a game account from an email. If you stop using the app, your game account is deleted automatically 180 days after you last used it, and your game wallet 400 days after if it is empty. A wallet with lives, hints, unlocks or case packs is never deleted for inactivity, only with Delete my data.

14. Why we use data (EEA, UK and similar laws)

• To provide the game (device ID, game account, game wallet, answer checking, downloads, purchases and restore): necessary to perform our agreement with you.
• Game events and Firebase Analytics: our legitimate interest in improving the cases, balancing lives, ads and prices, and knowing whether shared links bring new players. In the EEA, the UK and Switzerland, Firebase's advertising storage, use of data for advertising and ad personalisation rely on your consent in Google's consent message.
• Crash reports: our legitimate interest in finding and fixing errors in the app.
• Install and campaign measurement (Airbridge, and the campaign identifiers at RevenueCat): in the EEA, the UK and Switzerland, your consent in Google's consent message; elsewhere, our legitimate interest in knowing which campaigns bring players. On iPhone, the advertising ID is used only with your permission in the iOS tracking prompt.
• Ads: your consent where the law requires it, collected by Google's consent message; otherwise our legitimate interest in keeping the game free to play.
• Security and abuse prevention (rate limits, hashed tokens, logs, purchase and ad verification, and the starting-lives record): our legitimate interest in keeping the service available.

15. Who receives data

Some providers process data outside your country, including in the United States. When data from the EEA, the UK or Switzerland goes to a country without an adequacy decision, the transfer is protected by the European Commission's Standard Contractual Clauses (with the UK and Swiss additions where they apply) and, where a provider is certified, by the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, as each provider states in its own terms.

We do not sell personal data for money. When personalised ads are allowed, Google can use your advertising ID to personalise ads, and Airbridge, RevenueCat and Firebase use it, where you allow it, to measure our ad campaigns. Some US state laws call this "sharing" or "targeted advertising". You can opt out at any time with the choices in section 7.

16. Your rights

Depending on where you live (for example under the GDPR, UK GDPR, LGPD in Brazil, KVKK in Türkiye, or California and other US state laws), you may have the right to access, correct, delete or port your data, to object to or restrict processing, to opt out of targeted advertising and to withdraw consent. Use Delete my data, or email support@simsty.com. You may also complain to your local data protection authority.

17. Children

Simsty is for players aged 13 and older. It contains mature story themes such as infidelity, crime and fraud, and is not directed to children. We do not knowingly collect personal data from children under 13. If the law in your country sets a higher age for agreeing to data use on your own, a parent or guardian must make the choices in Google's consent message for a younger player. If you believe a child under 13 has used Simsty, contact us and we will delete what our game service and our providers hold.

18. Changes

We will post changes here and update the effective date. If a change adds new data collection, we will update this policy and the store privacy details before the change ships.