Privacy Policy
1. Controller
Hakan Timur, Boyacıoğlu Mah. 979. Sokak No:14G Daire 6, 26350 Tepebaşı/Eskişehir, Türkiye is responsible for the personal data processed in Oltivra. Contact for privacy questions and requests: support@noriloop.net.
2. Data we collect
Account: your sign-in identifier from Google, Apple or email (and the email address the provider shares), the date you accepted these documents, and your 13+ confirmation. We do not collect your date of birth.
Profile: player name, chosen avatar, frame and badges, UI and question language, and notification preferences.
Gameplay: matches played, your answers and their server receive time, scores, placements, XP, level, league and ranking data, mission progress and per-category statistics.
Social and safety: friends and friend requests, private challenges, blocks, and reports you send or that concern you, plus moderation decisions and sanctions.
Fair-play signals: answer timing patterns, malformed or excessive requests, app integrity check results, and a keyed hash of your device's push token used to limit repeated account creation. These produce an internal risk score that is never shown to other players.
Device and technical: push notification token and platform, app version, and server logs that include IP address and request metadata.
Purchases and rewards: store transaction identifiers and status for Remove Ads, and rewarded-video completion records. We never receive your payment card details.
We do not collect precise location, contacts, photos or microphone data.
3. Why we use it
To provide the game (account, matchmaking, live matches, progress, leaderboards, social features): performance of our contract with you.
To keep matches fair and the community safe (anti-cheat, reports, moderation) and to secure the service: our legitimate interests and your safety.
To show ads and verify rewarded videos and purchases: contract and, where required (for example in the EEA, UK and Switzerland), your consent for personalised ads collected through Google's consent tool.
To send notifications you enabled (friend requests, challenges, reminders): your settings, which you can change at any time.
To improve questions (for example calibrating difficulty from anonymous answer statistics).
4. Who we share it with
Other players see only your public profile: player name, avatar, frame, featured badges, level, league and public achievements. They never see your email, sign-in provider or risk data.
Service providers acting for us: Google Cloud and Firebase (hosting, authentication, databases, push notifications), Google AdMob (advertising and rewarded-video verification), and Google Play or Apple (purchase processing). They process data under their terms and applicable data protection agreements.
Other participating Synova products using the shared sign-in receive your account identifier and question-exposure history so you are not shown the same questions repeatedly. Product-specific progress is not shared.
Authorities, where the law requires it. We do not sell your personal data.
5. Advertising
Ads are provided by Google AdMob, which may use device identifiers and similar technologies. Where required, we ask for your consent before showing personalised ads, and you can change your choice any time in Settings > Privacy & ads. If you do not consent, you may still see non-personalised ads. Buying Remove Ads stops interstitial ads.
6. International transfers
Our primary servers are in the European Union (Google Cloud, europe-west1). Some providers may process data in other countries; in that case transfers are protected by the safeguards required by law, such as standard contractual clauses.
7. How long we keep it
Account and profile data: while your account exists. Raw server logs: 30 days. Previous player names: a hashed reservation for 30 days after a change or deletion. Security and audit records: only as long as necessary for the purpose they serve. Match history: anonymised when you delete your account; anonymous aggregate statistics may be kept. Backups follow a documented retention period and deleted data is never restored into active systems.
8. Deleting your account
You can delete your account in Settings or on our web deletion page, which requires a fresh sign-in. Deletion starts immediately. If you are in a live match, the match finishes or is cancelled safely first. We then delete or anonymise your profile, friends, requests, blocks, devices and notification tokens, private settings and product records, anonymise your match history, and delete your sign-in. Because the sign-in is shared, this deletes the shared Synova account across participating products.
9. Your rights
Depending on where you live (including under the GDPR and Türkiye's KVKK), you may have the right to access, correct, delete or port your data, to object to or restrict processing, and to withdraw consent. Contact support@noriloop.net. You may also complain to your local data protection authority.
10. Children
Oltivra is not directed at children under 13 and we do not knowingly collect their data. If you believe a child under 13 uses Oltivra, contact support@noriloop.net and we will delete the account.
11. Security
Data is encrypted in transit, access is limited to authorised staff with multi-factor authentication, and sensitive identifiers are stored as keyed hashes where possible.
12. Changes
When we change this policy we update its version and ask you to review it in the app before you continue.
Effective date: 2026-09-27.