Privacy policy

Version: 1.0 · Effective: 8 November 2026

This Privacy Policy (the “Policy”) explains how your personal data is processed when you use the Sayko! mobile application (the “App”). If you are in Türkiye, the KVKK Information Notice also applies; where the two differ, the KVKK Information Notice prevails for users in Türkiye.

1. Controller and contact

Outis Tech LLC A Pennsylvania (USA) limited liability company 250 N Columbus Blvd, Philadelphia, PA 19106, USA Email: info@outistech.com

For any privacy question or to exercise your rights, write to info@outistech.com or use the Contact Us form in the App.

2. Summary

You must be at least 13 years old to use the App (the minimum age is higher in some countries; see Section 6). For users under 18, usage analytics and personalized advertising are always off.
Usage analytics and personalized ads run only if you allow them. Both are off by default. You can change your choice at any time in Settings → Privacy.
Crash reports (Firebase Crashlytics) and app verification (Firebase App Check) run without waiting for consent because they keep the App working and secure; you can turn crash reports off in Settings.
Campaign and offer notifications arrive only if you opt in separately; they are off by default.
We do not sell your personal data for money.
You can delete your account at any time in the App or on the web.

3. What data we process

3.1 Account data

Sign in with Google: your Google account ID, email address and the link to your Google profile photo. Authentication is handled by Google Sign-In and Firebase Authentication.
Sign in with Apple: your Apple user identifier and the email address Apple shares with us (Apple’s relay address if you chose “Hide My Email”). If Apple shares no email address, your account is kept under the Apple user identifier only.
Guest login: a temporary guest ID and the username you choose. Guest login does not create a permanent account; if the App is not used for 24 hours since the last use, the guest ID becomes invalid and a new one is created on the next login.

3.2 Profile data

Your username and Sayko ID (your username, # and a 4-digit number, e.g. name#1234), profile photo or chosen avatar, level, experience points (XP), titles, statistics, recent matches, the cosmetics you own and use (frames, card backgrounds, sound sets), your Sayko Points (SP) balance and SP transactions. You can change your username once every 90 days; when you do, your Sayko ID changes too.

Your friend list, the friend requests you send and receive, room and game invites, and the entries in your in-app notifications inbox.
Your online status: while the App is open, whether you are online or away and which game you are playing is sent to our servers about every minute and shown to your friends. You can hide this from your friends with “Appear offline” in Settings.
Your privacy settings: whether your friends can see your recent matches, and your “Appear offline” choice.

3.4 Game data

Multiplayer rooms, room codes, game results, scores, votes and round logs. These records also include the usernames and avatars of other players in the same room.
Text you type during games (for example “Perfect Lie” statements, “Best Five” themes and picks, “Bullseye” guesses).
Single-device mode, playing with names: the player names typed by the host are sent to our servers with the game result. These names may belong to people who are not App users, so we recommend nicknames rather than full names. We use these names only to show the game result and to compute the host’s statistics.
Single-device mode, playing with real players: the host invites registered friends; each invitee confirms on their own phone. The game is played on the host’s phone; the result, XP, titles and statistics are written to every participant’s account. If the result cannot be sent at that moment, it is kept on the host’s device and sent again.

3.5 Purchase and SP data

The product you bought, price, currency, store transaction ID, subscription status and refund information, which the store passes to us through RevenueCat. Payments are processed by the Apple App Store or Google Play. We never see or store your card or payment details.
Cosmetics you bought with SP, the contents of your personal Today’s Shop, your daily Best Five AI allowance, and SP you earned from rewarded ads.

Your birth year (and, only if you are at the minimum-age boundary, your birth month; the month stays on your device and is not sent to our servers) and the age group derived from it.
If your device’s operating system shares an age range (Apple Declared Age Range, Google Play Age Signals), that age range.
The versions of the Terms of Use and this Policy you accepted; your privacy choices (usage analytics, personalized ads, crash reports, “Do not sell or share my personal information”); and the date, platform, app version, language and device region setting of each.

3.7 Device and technical data

Device identifier: on first launch the App generates a device identifier from device information (“identifierForVendor” on iOS, the device build ID on Android) and the time it was created, and keeps it in the device’s secure storage.
Notification tokens: the push notification token (FCM) and, on iOS, the Live Activity token for showing a multiplayer game’s status on the Lock Screen and in the Dynamic Island while the game is running; we use it to update the game status through Apple’s push notification service.
Device region: the country code from your device’s region setting is sent to our servers with every request so that Today’s Shop can show content suited to your region. The region setting is also used to determine the minimum age for your country. This is not location data; we never ask for location permission.
App verification (Firebase App Check): to verify that requests come from the genuine Sayko! app, your device obtains a verification token from Apple (App Attest / DeviceCheck) or Google Play (Play Integrity).
Device model and brand, operating system, app version, language setting.
IP address: technically processed whenever you connect to our servers and service providers. We do not store your IP address linked to your account; it is kept in server access logs for the period in Section 10.
Error and crash logs (Crashlytics): the technical state at the time of a crash and device information. Your account ID, username and email address are not sent to Crashlytics; reports are linked only to Firebase’s installation ID and to whether you are a guest or a subscriber.

Which screens and games you use, events such as starting and finishing a game, steps in the purchase flow, your account ID and device information (Google Analytics for Firebase).

Advertising identifier (IDFA on iOS, only if you allow App Tracking Transparency; advertising ID on Android) and ad impression and click data. If you have not allowed personalized ads, ads are shown non-personalized using limited technical data only (e.g. device type, IP address for approximate location).
Rewarded ads: when you watch an ad to earn SP, your account ID is passed to Google AdMob so that the reward can be verified on our server, and AdMob sends it back to us with the verification request.

3.10 Safety and moderation data

Reports you submit and reports made about you, including a copy of the username and profile photo at the time of the report and the room concerned.
Users you have blocked.
Results of automated checks (image check of profile photos, word filter on usernames and game texts).
Moderation decisions (e.g. removal of a photo, reset of a username, suspension or closure of an account, a device block) and their reasons, abuse and fraud prevention records. A hash of the device identifier of a reported or banned guest.

3.11 Support communications

Information you send us through the Contact Us form (topic, your message, screenshots you attach, app version, platform and language) or by email, and our replies. The form is sent linked to the account you are signed in with.

3.12 Links

Add-friend and room invite links open on saykogames.com. An add-friend link carries your Sayko ID (which includes your username) and the link to your profile photo; a room invite link carries only the room code and the game. Anyone you send the link to can see this information.

We do not collect special categories of data. We do not knowingly process data such as health, religion, political opinions, ethnic origin or sex life. Please do not put them in game texts, your username or your profile photo.

We do not collect location data. The App never asks for your device’s location permission. The “Lost Tourist” game is about the places shown in the game, not your location.

4. Why we process data and on what legal basis

Purpose	Data	Legal basis (GDPR / KVKK)
Account creation, login, profile, multiplayer and single-device games, in-game progress, statistics and titles	Account, profile, game, device data	Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c))
Friends, requests, invites, online status, notifications inbox, invite links	Friends and social data, profile data	Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c))
Processing names typed in single-device mode that belong to people who are not App users	Game data	Legitimate interest: showing the game result and statistics to the user (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f))
Managing purchases, SP and subscriptions, refunds, verifying rewarded-ad rewards	Purchase and SP data, account ID	Performance of a contract; legal obligation (record keeping) (GDPR Art. 6(1)(b), (c); KVKK Art. 5(2)(c), (ç))
Content suited to your region (Today’s Shop) and the minimum age for your country	Device region	Performance of a contract; legal obligation (GDPR Art. 6(1)(b), (c); KVKK Art. 5(2)(c), (ç))
Age check and consent records	Age and consent records	Legal obligation (protection of children, proof of consent) and legitimate interest (GDPR Art. 6(1)(c), (f), Art. 7(1); KVKK Art. 5(2)(ç), (e), (f))
Crash reports, app verification (App Check), information security, abuse and fraud prevention	Crash logs, device data, verification token, IP	Legitimate interest: keeping the App working and secure (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)). You can turn crash reports off in Settings.
Moderation, reporting and blocking, enforcing the Terms of Use	Safety and moderation data, user content	Legitimate interest; performance of a contract (GDPR Art. 6(1)(b), (f); KVKK Art. 5(2)(c), (f))
Usage analytics and product improvement	Usage data	Consent (GDPR Art. 6(1)(a); KVKK Art. 5(1) explicit consent)
Personalized advertising	Advertising data	Consent (GDPR Art. 6(1)(a); KVKK Art. 5(1) explicit consent)
Non-personalized advertising (to keep the App free)	Limited technical data (e.g. IP for approximate location, device type)	Legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)). In the EU/EEA, UK and Switzerland, Google’s “limited ads” mode is used when there is no consent.
Game notifications (friend requests, room invites, game, new packages and new game modes)	Notification tokens, language	Performance of a contract; legitimate interest; your device notification permission (GDPR Art. 6(1)(b), (f); KVKK Art. 5(2)(c), (f))
Campaign and offer notifications (discounts, offers, promotions)	Notification token, language	Consent (GDPR Art. 6(1)(a); KVKK Art. 5(1) explicit consent); separate opt-in, off by default
AI judging (“Best Five”)	Game theme, players’ picks and in-game display names	Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c))
Responding to support requests	Support communications	Performance of a contract; legitimate interest (GDPR Art. 6(1)(b), (f); KVKK Art. 5(2)(c), (f))
Establishing, exercising and defending legal claims; responding to competent authorities	Relevant data	Legitimate interest; establishment of a right; legal obligation (GDPR Art. 6(1)(c), (f); KVKK Art. 5(2)(ç), (e))

For processing based on consent, you can withdraw consent at any time in Settings → Privacy (for campaign notifications, in Settings → Notifications). Withdrawal does not affect the lawfulness of processing carried out before it. Not giving consent does not prevent you from using the App.

5. How your privacy choices work

On first sign-in, when you tap Google, Apple or Guest, we ask for your birth year (and your birth month if needed) and ask you to accept the Terms of Use and this Policy. If you are 18 or older, we then ask for your choice on usage analytics and personalized ads. Both are off by default. Until you make a choice, or if you refuse, no usage analytics is collected and ads are not personalized.
In the EU/EEA, UK and Switzerland, this choice is collected through Google’s certified consent management tool (Google User Messaging Platform) in line with the IAB Europe Transparency and Consent Framework (TCF). The list of advertising partners is shown on that screen.
On iOS, if you allow personalized ads, Apple’s App Tracking Transparency prompt is shown. If you decline, no cross-app tracking takes place and the IDFA is not used.
Your choices are stored per device (like cookie preferences in a browser). If you sign out on the same device and sign in with another account or as a guest, the same choices apply and are also recorded for that account. If you share the device with someone else, you can change the choices in Settings.
When a registered user moves to a new device, the choices are asked once more on that device.
Crash reports (Crashlytics) and app verification (App Check) do not depend on consent and also run before the choice screen; you can turn crash reports off in Settings → Privacy.
Notifications: game notifications (friend requests, room invites, game, new packages and new game modes) arrive once you give your device’s notification permission; you can turn them off in Settings → Notifications or in your phone’s settings. Campaign and offer notifications (discounts, offers, promotions) are a separate opt-in: they arrive only if you tick the unticked box under the notification permission request or switch on the option in Settings → Notifications. They are off by default and you can turn them off at any time.

6. Children and teens

The App is not intended for children under 13 and is not directed to children. All content is made for ages 13 and up; there are no adult content packages.
People whose birth year (and month, if asked) shows they are below the minimum age are not allowed to use the App; no data about them is collected or sent to our servers. The birth year and month entered are kept only on the device, and the App opens automatically once the age limit is reached.
Ages 13–17 (restricted mode): usage analytics and personalized advertising are always off; ads are shown non-personalized with an age-appropriate content setting; App Tracking Transparency is not requested; profile photos cannot be uploaded (preset avatars are available); no campaign and offer notifications are sent.
The minimum age is higher in some countries. Where local law requires parental consent to process children’s data, we raise the minimum age in that country instead of offering a parental consent flow. For example, in India (Digital Personal Data Protection Act) the minimum age is 18. The applicable minimum age is determined by your device’s region setting and shown on the sign-in screen.
Store age signals: when Apple (Declared Age Range) or Google Play (Age Signals) shares an age range, we use it and apply whichever is more protective of your declaration and that signal. Apart from this, we collect no age information and do not request your date of birth from your Google or Apple account.
If we learn that someone below the minimum age is using the App, we delete the account and its data. Accounts found to belong to someone under 18 are moved to restricted mode. Parents and guardians can contact us at info@outistech.com.

7. What other players see

In games: players in the same room or the same single-device game see your username, profile photo or avatar, level, title, cosmetics and what you type during the game.
On your profile: anyone can see your username, Sayko ID, profile photo or avatar, level, title and cosmetics. Only your friends see your statistics. Your friends also see your recent matches by default; you can hide them in Settings → Privacy. People who are not your friends can see neither.
Your friends see whether you are online or away and which game you are playing, unless you turn on “Appear offline”.
Your username and avatar may appear in the statistics and recent matches of registered users you have played with.
Anyone who opens an add-friend link you shared sees your name, Sayko ID and profile photo.

Moderation:

We may use automated tools and human review to detect content that breaks the rules. Uploaded profile photos pass an automated image check before they are shown (Amazon Rekognition, AWS Frankfurt). Usernames and in-game texts are automatically filtered with our own word list in 16 languages. Location and other metadata (EXIF) are removed from photos.
You can report and block other players from the menu on their profile. Our team reviews reports.
Blocking: a player you block cannot send you friend requests or game invites and is removed from your friends. The blocked person is not notified. You can see the players you blocked in your Blocked Users list and unblock them there.
If the rules are broken, we may remove a photo, reset a username, suspend or close an account, and block sign-in from a device; in that case we show you the reason.
Automated decisions: automated checks may reject a photo or a text at the moment it is submitted. Decisions such as suspending or closing an account or blocking a device are made by our team. To contest a decision, write to info@outistech.com or use the Contact Us form; a human will review your appeal.

We do not sell your personal data for money. We share data only with the recipients below, for the purposes in this Policy, under data processing agreements:

Recipient	Service	Location
Amazon Web Services (AWS)	Servers, database, backups; image check of profile photos (Amazon Rekognition)	Germany (Frankfurt)
Cloudflare, Inc.	Domain name system (DNS), security and attack protection (DDoS), content delivery and storage including images (CDN, R2), the saykogames.com website	USA and Cloudflare’s global network
Google LLC / Google Ireland Ltd.	Google Sign-In and Firebase Authentication (sign-in), Firebase Cloud Messaging (notifications), Firebase Crashlytics (crash reports), Firebase App Check (app verification), Google Analytics for Firebase (consent only), Google AdMob (ads, rewarded-ad verification), Google User Messaging Platform (consent), Google Maps (maps, “Lost Tourist”)	USA and other countries
Google Play (Google LLC)	Google Play purchases, Google Play Services, Play Integrity (app verification), Age Signals (age signal)	USA and other countries
Apple Inc.	Sign in with Apple, App Store purchases, Apple Push Notification service and Live Activities, App Attest / DeviceCheck (app verification), Declared Age Range (age signal)	USA and other countries
RevenueCat, Inc.	Purchase and subscription management	USA
Anthropic, PBC	Claude API: AI judging in the “Best Five” game	USA
Competent authorities and courts	Where required by law, for legal claims or for safety	—
An acquirer in a merger, acquisition or reorganization	Subject to the safeguards in this Policy; you will be informed in advance	—

Specific cases:

Anthropic (Claude API): in “Best Five”, the game theme (including a theme you typed yourself), players’ picks and their in-game display names (username or the name typed in single-device mode) are sent to the AI; players are matched by codes such as P1, P2. Your account ID and email address are not sent. Anthropic processes this data as our service provider under its commercial API terms and does not use it to train its models.
Google Maps: in the “Lost Tourist” game the map loads from Google’s servers, which receive your IP address and device information. This is part of a game feature you start. We never ask for or use your location.
Mapillary imagery: the street-level images in the same game belong to Mapillary contributors and are served from our servers; no data is sent to Mapillary when images load. If you tap the source link, Mapillary’s website opens in your browser.
Advertising partners: if you allow personalized ads, Google AdMob and Google’s certified ad partners may process your advertising identifier. The list of partners for the EU/EEA and UK is shown on the consent screen. This may count as “sharing” or a “sale” under some US state laws; it happens only with your consent and can be turned off in Settings.
Google’s own policies: for how Google uses data, see https://policies.google.com/technologies/partner-sites

9. Countries where data is processed

Our servers, database and backups, which hold account, profile and game data, are in the European Union, in Germany (Frankfurt). Profile photos and other images are stored at Cloudflare and delivered through Cloudflare’s global network.
Our other service providers (Cloudflare, Google, Apple, RevenueCat, Anthropic) may process data outside your country, in the USA or other countries. For users in the EU/EEA, UK and Switzerland, our data processing agreements with these providers include the European Commission’s Standard Contractual Clauses (SCCs) and, for the UK, the UK Addendum / IDTA; where the recipient is certified, the EU-U.S. Data Privacy Framework (DPF), its UK extension and the Swiss-U.S. DPF also apply.
For users in Türkiye, the countries where data is processed and the recipients are described separately in the KVKK Information Notice.
Our company is based in the USA. Our team may access data from the USA and from Türkiye for support, maintenance and moderation. As a US company that collects your data directly from you, we may be required to respond to lawful requests from authorities under US law; if we receive such a request, we will seek to limit its scope to the extent the law allows.
You can ask for information about these safeguards at info@outistech.com.

10. Retention periods

Data	Period
Account and profile data, friendships and blocks	Until you delete your account. If we decide in the future to delete accounts that have not been used for a long time, we will announce it in advance.
Guest session data	24 hours after the last use; the guest ID becomes invalid at the end of that period. A guest’s name remains in the game records of the players they played with for the “detailed game logs” period below. The hash of a reported or banned guest’s device identifier is kept for the duration of the report or ban.
Multiplayer room records	30 days
Detailed game logs (including other players’ names and in-game texts)	90 days. After that, only the summaries needed for statistics, recent matches and titles are kept, and other players’ names are removed from those summaries.
Purchase and transaction records	7 years for tax, accounting and refund disputes. If the account is deleted, the link to your account is removed.
Consent records (age group, accepted versions, choices and their dates)	For the life of the account; deleted when you delete your account
Reports and moderation records	12 months after closure; copies of reported photos and AI outputs 30 days
Ban and suspension records	As long as needed to enforce the ban; for permanent bans only the device/account identifier is kept
Crash logs (Crashlytics)	90 days (by Google)
Usage analytics data (Google Analytics for Firebase)	14 months (user-level data at Google)
Server access logs (including IP)	400 days, for security and abuse prevention
Support communications	2 years after the request is closed
Backups	Deleted data may remain in backups for up to 30 days; during that time backups are used only for disaster recovery.

When a period ends, data is deleted, destroyed or anonymized.

11. Account deletion

In the App: Settings → Account → Delete My Account.
On the web: if you cannot access the App, follow the steps on the Account Deletion page on saykogames.com, or send an email with the subject “Account deletion request” to info@outistech.com giving your username or Sayko ID (you can write from any email address). We complete these requests within 30 days at the latest.
Deletion in the App is processed immediately; copies in backups are cleared within 30 days at most.
When you delete your account, your email address, login identifiers, username and Sayko ID, profile photo, devices and notification tokens, level, titles, statistics and cosmetics, SP balance, friendships, blocks and notifications are deleted. In other players’ game records your name is replaced with “Deleted player” and your photo is removed. Your authentication record at Firebase and your subscriber record at RevenueCat are deleted; the App’s link to your Apple or Google sign-in is removed (if you signed in with Apple, it is also revoked with Apple).
Purchase records we are legally required to keep are retained for the periods in Section 10 with the link to your account removed. Identifiers of a banned account may be kept to enforce the ban.
Deleting your account does not cancel your App Store or Google Play subscription. You must cancel it separately in your store account settings.
Your SP balance and the cosmetics you bought with SP are permanently lost when the account is deleted. Because the Premium subscription and game mode purchases are tied to your store account, they can be restored under the store’s rules with “Restore Purchases” on a new Sayko! account using the same store account.
Without deleting your account, you can also remove your profile photo, change your username and withdraw your privacy choices.

12. Your rights

Depending on where you live, you have the right to:

access your data and get a copy,
ask us to correct inaccurate data,
ask us to delete your data,
ask us to restrict processing,
object to processing based on legitimate interest,
receive your data in a structured format (portability),
withdraw consent,
contest decisions based solely on automated processing and ask for human review,
lodge a complaint with a supervisory authority: the data protection authority of your country in the EU, the ICO in the UK, the Personal Data Protection Board (KVKK) in Türkiye, or your local data protection authority elsewhere.

Users in Türkiye may exercise their rights under KVKK Art. 11 (details and the application procedure are in the KVKK Information Notice).

Users in the USA: your state’s privacy law (e.g. California CCPA/CPRA, Virginia, Colorado, Connecticut, Texas and others) may give you rights to access, delete and correct your data and to opt out of the sale of personal data or its sharing for targeted advertising. We do not sell personal data. Your advertising identifier is shared for targeted advertising only with your consent; you can turn this off with “Do not sell or share my personal information” in Settings → Privacy. You may also submit requests through an authorized agent. If we deny a request, you can appeal by replying to our response; we will decide on your appeal within 45 days. We will not treat you differently for exercising these rights.

Users in other countries (e.g. Brazil, South Korea, Japan, Switzerland, Indonesia) may exercise the rights provided by their data protection law through the same contact channels.

How to apply: send your request to info@outistech.com or through the Contact Us form in the App. We may ask for additional information to verify your identity and account (for example, writing from the email address linked to your account, or your Sayko ID). We respond within 30 days at the latest; for complex requests we may extend this period to the extent the law allows and will tell you. Requests are free of charge; for manifestly unfounded or repetitive requests we may charge a fee or refuse the request within legal limits.

13. Security

We encrypt data in transit (TLS). We verify with Firebase App Check that requests come from the genuine App. Access to our servers is limited to authorized team members, administration tools are protected with separate authentication, and administrative actions are logged. No system is completely secure. If a data breach occurs, we will notify the relevant authorities and, where required, you within the time limits set by law.

14. Service regions

The App is not offered in the Russian Federation or the People’s Republic of China (mainland). The Russian and Chinese language options are for users in other countries who speak those languages.

15. Third-party links

The App contains links to content sources (e.g. Mapillary, Wikipedia), license pages and store pages. When you tap such a link, the site opens in your browser; we are not responsible for the privacy practices of those sites.

16. Changes

We may update this Policy. The version number and effective date of each version appear at the top. For material changes we will inform you in the App before they take effect and ask for your consent again where required. Previous versions are published in the archive of the legal pages on saykogames.com.