Privacy Policy

1. Operator and contact

Legal operator: Bünyamin Yıldız, publishing on Google Play as “Tacticus Analysis”

Registered address: Barbaros Mah. 7 Haziran Cad. No: 36 D: 1, Süleymanpaşa, Tekirdağ, Türkiye

Website: https://tacticus.net

Privacy contact: tacticusapp@gmail.com

Hosting provider and server country: Güzel Hosting, Türkiye

2. Data we process

On first launch the app creates a random installation identifier (UUID). The server creates a separate device security key; only a one-way hash of that key is stored on the server. These values authenticate the installation without asking for a name or account.

The service processes platform, app version, selected language, device time zone, notification preferences, last-seen time and limited request-count security signals. Theme and cached feed content remain on the device.

For the optional Gift days feature, the service also stores the calendar dates on which the app was opened (one entry per day; no time of use or screen activity), gift requests and the decision on each request. These records are linked only to the Support code.

For a Google Play subscription, the service processes the Google product ID, purchase token, order ID, subscription status, start and expiry times, auto-renewal state and verification timestamps. Payment-card and Google Account credentials are not received by TACTICUS.

The server and hosting infrastructure process IP addresses and standard request logs to deliver and secure the service. These logs are kept for up to 30 days (see section 6).

Website tacticus.net: it uses no cookies and no advertising or analytics scripts; the server keeps only the request logs described above. When someone posts a public review of TACTICUS on Google Play, we retrieve the review text, star rating, reviewer display name, language and date through the Google Play Developer API in order to read and reply to it; these review records are deleted after 12 months.

AI assistant: tacticus.net and the app (menu → AI Assistant) offer an optional AI chat assistant that answers questions about TACTICUS. The questions you type and the assistant's answers are sent to Google (Gemini API) to generate the reply and are kept on our server for 30 days to improve the answers; the IP address is stored only as a one-way hash. In the app, chats are linked to the installation's support code only to apply the daily limit of 10 questions and to let you report an answer; the chat is not stored on your device. Please do not type personal data into the chat.

3. Data we do not collect

The current app does not request names, email addresses, phone numbers, contacts, precise or approximate location, photos, files, microphone, camera, advertising identifiers or payment-card details.

Firebase Cloud Messaging is used only to deliver notifications. TACTICUS has two optional notification types, both off by default and switched on separately in the app: subscription offers and TACTICUS announcements. If the user opts in to either and grants the Android notification permission, the app obtains an FCM registration token and sends it with the selected app language and device time zone to TACTICUS. An installation with a token may also receive a one-off notice when a gift is activated. Turning both types off deletes that token from Firebase and TACTICUS. The app contains no advertising or analytics SDK and no crash-reporting service.

4. Purposes and legal grounds

Installation identifiers and security signals are used to operate the service, protect paid access and prevent abuse. If enabled, language, time zone, consent status and the FCM registration token are used to send two daily TACTICUS subscription marketing messages at approximately 09:00 and 22:00 device-local time. Marketing messages pause while a paid plan is active. If announcements are enabled, the same token and language are used to deliver TACTICUS announcements. Notifications are not used for cross-app advertising or behavioural profiling.

App-open dates and gift requests are used to count Gift days, activate the gift and prevent abuse of the feature. When a gift is activated, one notification may be sent to an installation that has already enabled notifications; otherwise the notice is shown inside the app.

Purchase information is used to verify, restore and provide the subscription contract. Any future optional feature that legally requires consent will stay off until the user gives it.

Legal bases: performance of the subscription contract (purchase verification, access, restore); legitimate interests in operating, securing and preventing abuse of the service (installation identifier, security signals, Gift days records, replies to public Google Play reviews); consent for optional notifications, which can be withdrawn at any time in the app; and compliance with legal obligations. Depending on where the user lives, this processing is governed by the General Data Protection Regulation (GDPR, EU/UK), Brazil's General Data Protection Law (LGPD) or Türkiye's Personal Data Protection Law No. 6698 (KVKK).

5. Service providers and sharing

Google Play Billing and the Google Play Developer API process purchase information to complete and verify subscriptions. Google handles payment credentials under its own terms and privacy notices.

Google Firebase Cloud Messaging delivers the optional notifications described above. It receives the registration token and the notification content; it is not used for advertising or analytics.

Google Gemini API generates the answers of the optional AI assistant on the website and in the app. It receives only the chat text you type.

Hosting provider: Güzel Hosting (Türkiye). The provider processes server traffic only to host, secure and deliver the service.

TACTICUS does not sell user data and does not share it with advertisers or data brokers.

6. Retention and deletion

Retention: installation data, Gift days records and saved matches are deleted 12 months after the installation was last used. A notification registration token is deleted as soon as notifications are turned off. Daily request counts are kept for 90 days. Subscription records are kept for the duration of the subscription and for 3 years after it ends, to handle disputes and prevent fraud, unless the law requires longer retention. Server logs are kept for up to 30 days.

Uninstalling removes local preferences and the installation credentials, but does not cancel a Google Play subscription. Active purchases can be recovered with Restore purchases.

A server-data access or deletion request can be sent to tacticusapp@gmail.com with the Support code shown in the app. Data that must be retained by law or for substantiated fraud prevention may be restricted or anonymised instead of immediately erased, with an explanation provided to the requester.

7. Security and transfers

All traffic between the app, the website and the server uses HTTPS. Purchase tokens and device security secrets are not returned in subscription-status responses; server-side device keys are stored as one-way hashes.

Primary server location: Türkiye. The operator is also established in Türkiye, and the app sends data directly to our server over HTTPS; no other server location is used for the TACTICUS service. The protections in this policy apply to all users wherever they live.

Google may process Play purchase data in multiple countries under its published data-protection terms.

8. Children, rights and changes

TACTICUS is intended only for users aged 18 or over. It is not directed to children and does not knowingly process children's data; if such data is identified, it is deleted.

Depending on applicable law, users may have rights of access, correction, deletion, restriction, objection and complaint to a supervisory authority. Requests must use the Support code because TACTICUS has no named user account.

Material changes will update the date above and, when appropriate, be announced in the app. The Data safety section of our Google Play listing follows this policy.