Privacy Policy
Last updated: 1 August 2026
This policy explains what the +3−1 mobile app (“the app”) collects, why, and what you can do about it. It applies to the app and to this website.
1. Who we are
The app is operated by Lafonten Finansal Yazılım Limited Şirketi (“we”, “us”), a company registered in Türkiye. We are the data controller for the personal data described here.
Contact for any privacy question or request: info@lafon10.com.
2. The short version
- You can play without giving us an email address — a guest account is created for you automatically.
- We do not run ads, and we do not track you across other apps or websites. There is no advertising SDK in the app.
- We never see your payment card. Subscriptions are handled by Apple.
- You can delete your account, and everything attached to it, from inside the app.
3. What we collect
| Category | What it is | Why |
|---|---|---|
| Account | An anonymous user ID created when you first open the app. If you choose to save your progress: your email address, or the identifier and email supplied by Sign in with Apple (which may be Apple's private relay address) or Google Sign-In. | To keep your progress on one account and let you sign back in on another device. |
| Profile | Username, chosen avatar, country, ELO rating, and play statistics (matches played, won, lost, streaks, average guesses, average turn time, total play time, last active time). | To run matchmaking and the leaderboard, and to show your profile to opponents. |
| Gameplay | Your matches (who played, when they started and ended, who won and how) and every guess you make with its score. | The game is server-authoritative: guesses are scored on our server so neither player can cheat. History is also shown back to you in the match. |
| Social | Friend requests and friendships, game invites, and private room invite codes you create or join. | To let you add friends and challenge them. |
| Notifications | A push notification token for your device, plus the platform (iOS/Android). Only if you allow notifications. | To tell you it's your turn, or that a friend has challenged you. |
| Purchases | Whether you have an active subscription and when it expires, plus the anonymous purchase identifiers our billing provider uses. | To unlock unlimited matches. We never receive your card number or billing address — Apple handles the payment. |
| Diagnostics | Crash reports and error traces: device model, OS version, app version, and what the app was doing when it failed. | To find and fix bugs. |
We do not collect your contacts, photos, precise location, or advertising identifier. The country shown on your profile is one you select, not one we derive from your IP address.
4. Legal basis
Where the GDPR applies, we rely on: performance of a contract (running your account, matches and subscription), legitimate interests (keeping the game fair, fixing crashes, preventing abuse), and consent (push notifications — you can withdraw it at any time in your device settings). Where the Turkish Personal Data Protection Law (KVKK) applies, we process data on the equivalent grounds in Article 5.
5. Who we share it with
We do not sell your data and we do not share it for advertising. We use the following service providers, who process data only on our instructions:
- Supabase — database, authentication and realtime infrastructure. This is where your account, profile and match data live.
- Apple — App Store distribution, Sign in with Apple, subscription billing, and push notification delivery (APNs).
- Google — Google Sign-In, if you use it, and push notification delivery on Android.
- RevenueCat — subscription status management.
- Sentry — crash and error reporting.
- Expo — app delivery and the push notification service.
Some of these providers operate outside your country, which may involve an international transfer of your data. Where required, such transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard.
We may also disclose data where we are legally required to, or to establish or defend legal claims.
6. What other players see
Your username, avatar, country, ELO rating and public play statistics are visible to your opponents and on the leaderboard. Your email address is never shown to other players. Your secret code in a match is stored in a protected table that your opponent's app cannot read — only the score of each guess is returned to them.
7. How long we keep it
- Account and profile — until you delete your account.
- Match and guess history — kept while your account exists, so ratings and statistics stay meaningful.
- Push tokens — until the token stops working or you turn notifications off.
- Crash reports — retained by our diagnostics provider on a rolling window, typically 90 days.
- Abandoned invite codes — cleared automatically after 7 days.
8. Deleting your account
Open the app, go to Profile → Delete Account, and confirm. This removes your account, profile, statistics, friendships, invites and push tokens. Matches you played may be retained in anonymised form so your former opponents' records stay consistent, with no data that identifies you.
You can also email info@lafon10.com and we will do it for you.
Deleting the app from your phone does not delete your account.
9. Your rights
You have the right to ask us to confirm whether we process your data, to access it, to correct it, to delete it, to restrict or object to processing, and to receive a copy in a portable format. Under KVKK Article 11 you additionally have the right to learn the purpose of processing and the third parties to whom data is transferred, and to request compensation for damage caused by unlawful processing.
Write to info@lafon10.com and we will respond within 30 days. If you are unhappy with our answer, you can complain to your national data protection authority — in Türkiye, the Kişisel Verileri Koruma Kurumu (KVKK).
10. Security
All traffic between the app and our servers is encrypted with TLS. Access to the database is governed by row-level security policies: your account can only read the rows that belong to you or to matches you are playing. Secret codes are held in a separate protected schema that is never exposed to the other player.
11. Children
The app is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
12. Changes to this policy
If we change this policy we will update the date at the top of this page. Significant changes will also be announced in the app.
13. Contact
Lafonten Finansal Yazılım Limited Şirketi
info@lafon10.com