2048 Clash2048 Clash — Privacy Policy
Last updated: 27 October 2026
This policy explains what data 2048 Clash: Puzzle Duel ("2048 Clash", "the game") collects, why, and what you can do about it.
1. Who we are
The data controller is GONEXTSO YAZILIM ÜRÜNLERİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ ("GONEXTSO", "we"), Mecidiyeköy Mah. Selahattin Pınar Aralığı Sk. Hüseyin Özer İş Merkezi No: 3 İç Kapı No: 8, Şişli / İstanbul, Türkiye.
Contact for any privacy request: support@gonextso.com
2. Age
The game is intended for players aged 16 and over. We do not knowingly collect data from children under 16. If you believe a child under 16 has an account, contact us and we will delete it.
3. What we collect and why
We do not ask for your name, e-mail address, phone number or precise location to play the game. Solo games can be played offline; the data below reaches our servers when you play online.
| Data | Why | Legal basis |
|---|---|---|
| Device credential: a random secret our server creates on first launch and stores on your device; on Android it is also kept in Google Block Store. We keep only a one-way hash of it. | To open your account on this device without a password. | Performance of contract |
| Linked sign-in identifier: only if you link an account (Google or Google Play Games on Android, Sign in with Apple or Game Center on iPhone and iPad). We store only that service's account ID. We do not store your e-mail, name or photo. For Sign in with Apple we also keep, encrypted, the token Apple gives us so we can revoke it when you delete your account. | To let you open the same account on another device. | Performance of contract |
| Session tokens (stored as hashes) | To keep you signed in securely. | Performance of contract |
| Player tag, display name, avatar and cosmetics | Shown to other players: on your profile, in duels and rooms, and on public leaderboards. | Performance of contract |
| Country / continent: suggested from your device's time zone or language; you confirm or change it. We do not use your IP address to locate you. | Country and continent leaderboards. | Performance of contract |
| Device time zone and UTC offset | So daily and weekly limits, rewards and seasons reset on your local day; to suggest your country. | Performance of contract |
| Game data: coins, inventory, powers, purchases of cosmetics, season progress, achievements, statistics, solo and duel results, and the moves of your games (replays) | To run the game, settle duels on our server and check scores. | Performance of contract |
| Social data: friends, friend requests, blocks, online status and last seen time, room invites, emotes you send in a match, and reports you make or that are made about you | Friends, rooms and fair play. There is no free-text chat. | Performance of contract; legitimate interest (safety) |
| Ghost duels: your recorded moves from a duel played without powers may be replayed as a "ghost" opponent for other players, showing your player tag | So players get an opponent at once. | Performance of contract |
| Purchase records: store (Google Play or App Store), transaction ID, product, amount, currency, country | To deliver and restore purchases and prevent fraud; accounting obligations. | Contract; legal obligation |
| Push notification token and the game's language setting: only if you allow notifications | To send game notifications (room invites, friend requests, results) in your language. You can turn each kind off in the game, or all of them in your device settings. | Consent |
| App usage events: which screens you open and which buttons you choose, ad load failures, cancelled matchmaking, the end of a game; with your account ID, app version and platform | To understand how the game is used and fix problems. We use our own servers for this, not a third-party analytics service. Kept for 90 days. | Legitimate interest |
| Crash reports: if the game crashes, Firebase Crashlytics collects the crash details, device model, operating system and app version | To find and fix crashes. | Legitimate interest |
| IP address | Rate limiting and security. Kept in short-lived counters. | Legitimate interest (security) |
| App integrity checks: on Android, Google Play Integrity; on iPhone and iPad, Apple App Attest. They confirm that requests come from the genuine game on a genuine device. Google and Apple collect the device and app information they need for this under their own privacy policies. We receive only the result; for App Attest we keep the key Apple creates for the app on your device, without a link to your account. | To prevent cheating, account abuse and fraud. | Legitimate interest (security) |
| Fair-play signals: our server replays your games to check scores; unusual results or repeated disconnects can flag an account for review. A flagged account is matched with other flagged accounts and hidden from leaderboards until a person reviews it. | To keep duels and leaderboards fair. | Legitimate interest (fair play) |
| Security events: e.g. suspected session-token theft | To protect accounts. | Legitimate interest (security) |
| Support correspondence: if you e-mail us (e.g. an account deletion request), your e-mail address and what you write | To answer your request; for a deletion request, to confirm the account is yours. | Legal obligation; legitimate interest |
We do not sell your data.
4. Advertising
The game shows optional rewarded ads that you choose to watch, and occasional full-screen ads between casual matches; ranked duels never show ads, and the "No ads" purchase removes the full-screen ones. Ads are served and managed by Google AdMob. Ads are personalised: to show you ads that match your interests, AdMob may use device identifiers (such as the advertising ID), IP address and ad interaction data under Google's own policies. Where the law requires it, we use Google's consent message (UMP): in the EEA, UK and Switzerland we ask for your consent before showing personalised ads, and in US states with their own privacy laws you can opt out of personalised ads. On iPhone and iPad, we do not track you across other companies' apps and websites: we do not use the advertising identifier (IDFA), so ads there are not based on your activity in other apps. Watching ads and their rewards never depend on your consent choice.
Google's policy: https://policies.google.com/technologies/ads
5. Service providers and international transfers
- Google: Google Play Billing (payments), Block Store, Sign in with Google and Google Play Games Services (sign-in), the Play Integrity API (app and device integrity checks), Firebase Cloud Messaging (notifications), Firebase Crashlytics (crash reports), AdMob and UMP (ads), and Google Workspace (Gmail) for our support mailbox, support@gonextso.com. For your Google account and your Play Games profile, Google is a separate controller under its own privacy policy: https://policies.google.com/privacy
- Apple: the App Store and In-App Purchase (payments), Sign in with Apple and Game Center (sign-in), App Attest (integrity checks), and the Apple Push Notification service (APNs): on iPhone and iPad, Firebase Cloud Messaging hands notifications to APNs, which delivers them to your device. For your Apple Account, Game Center profile and payment data, Apple is a separate controller under its own privacy policy: https://www.apple.com/legal/privacy/
- Railway: hosting of our servers and databases. Railway manages the infrastructure; the servers are currently in its EU West region, and the region may change.
Google Play and the App Store take the payments; we never see your card or bank details, only the purchase record in §3. The service providers we share your data with protect it to the same or an equal level as described in this policy.
International transfers. 2048 Clash is one online game in which players from all over the world play each other and share the same leaderboards. So every player's data, wherever they live, is kept in a single shared database. That single database is kept outside Türkiye, on servers managed by Railway (a US-based company); the region where they are located may change. The data in §3, except support correspondence, is transferred there and stored there; support e-mails are kept in Google Workspace. The Google and Apple services above may also process data outside Türkiye, for example in the United States.
Türkiye has not yet issued an adequacy decision for any country, so in the countries where your data is processed it may not be protected to the same level as in Türkiye or the EU.
When you tick "I have read and accept" under the Terms of Service and this policy on your first start, you agree to your data being transferred and stored outside Türkiye in this way (Terms of Service §3).
6. How we collect data
Data is collected electronically and automatically, through the app and our servers, when you use the game. If you e-mail us, what you write is collected electronically, by non-automated means.
7. What other players see
Other players can see your player tag, display name, avatar, cosmetics, country and leaderboard results. Your friends can also see whether you are online. Who can see your full profile and match history is set in the game. Opponents see your moves during a duel, and players who meet your ghost see a replay of your recorded duel.
8. Retention
- Account data is kept while your account exists and deleted when you delete it (§9).
- If you link a sign-in that already belongs to another 2048 Clash account and choose to keep that account's progress, the account you leave is kept for 90 days, then deleted automatically.
- App usage events are deleted after 90 days.
- Ghosts stop being used after a limited number of duels or days.
- Purchase records are kept after account deletion, with the link to your account removed, for as long as accounting and tax obligations require.
- Security event records, reports, the player tags you used before a rename, and other players' match history (in which you then appear without a link to your account) are kept with the link to your account removed.
- When you change your tag, the old one is reserved for 48 hours so no one else can take it immediately.
- Support correspondence is kept for as long as we need it to show how your request was handled.
- Backups of the database are kept for up to three months and are then overwritten; data you deleted disappears from them within that time.
9. Deleting your account and data
- In the game: Settings → Danger zone → Delete account. This permanently deletes your account and its data from our servers.
- Without the game: at https://www.gonextso.com/2048clash/delete-account or by e-mailing support@gonextso.com.
- Uninstalling the game does not delete your account.
10. Your rights
Under Article 11 of the Turkish Personal Data Protection Law (KVKK), you may apply to the data controller to:
- learn whether your data is processed and, if so, ask for information about it;
- learn the purpose of the processing and whether the data is used for that purpose;
- know the third parties in Türkiye or abroad to whom it is transferred;
- ask for incomplete or incorrect data to be corrected;
- ask for it to be erased or destroyed under KVKK Article 7;
- ask for corrections and erasures to be passed on to the third parties who received it;
- object to an outcome against you that results solely from automated analysis;
- claim compensation if you suffer damage from unlawful processing.
If you live in the European Union, your rights under the GDPR (for example restriction of processing, data portability, objection and withdrawal of consent) also apply.
Send requests in writing by post to the address in §1, or by e-mail to support@gonextso.com. We answer within 30 days. You may also complain to the Turkish Personal Data Protection Board (KVKK Kurulu) and, if you live in the EU, to the data protection authority of your country.
11. Security
Credentials are stored only as hashes. All traffic is encrypted (HTTPS). Access to servers is restricted.
12. Changes
We will post changes here and update the date above. For material changes, we will also tell you in the game and ask you to accept the new version.