This policy applies only to the TONZ mobile game (iOS and Android, com.oyist.tonz). For our website, the site privacy notice applies. Additional information for players in Europe, the US and Türkiye is at the end: Europe · US states · Türkiye (KVKK).
In short
- You play as a guest. We never ask for your name, email address, phone number, date of birth, location or contacts.
- Online races and cloud saves use Unity Gaming Services. A random player ID, the username you choose if you create one, and your game progress are stored on Unity's servers.
- Google AdMob ads appear between levels, and you can choose to watch a short ad for a reward. Ads are not personalised, there is no tracking and your advertising ID is not read.
- If you add friends, your friend list and online status are stored at Unity. If you allow notifications, friend requests and invites reach your phone through Apple's or Google's notification service.
- Purchases are handled by Apple and Google. We never see your payment details.
- We do not sell your data. You can delete your account from inside the game: Deleting your account.
1. Personal information we collect
Information you provide
- Account data: if you create an account in Settings, the username and password you choose. The password is not kept on the device; Unity stores it and we cannot see it. Your username is visible to other players in online races.
- Game profile: credits, nitro canisters, the parts you own and fit to your truck, career progress and the number of races finished.
- Transaction data: the product you bought and the transaction number issued by the store, kept so a purchase is never delivered twice and can be restored.
- Friends: the friends you add with a friend code, the friend requests you send and receive, and room invites.
- Correspondence: your email address and message, if you write to us.
Information collected automatically
- Player ID: the random ID and session token of the guest player record created for your device when you tap CONTINUE on the first-launch notice.
- Install ID: a random number used during profile sync to tell which installation wrote the data. It is not a hardware identifier.
- Device and connection data: IP address, operating system and version, device model and language, processed by Unity and Google to provide their services. A coarse location (country or city) can be derived from the IP address.
- Online race data: when you join a room, game data such as your display name, your truck's design and its position during the race is relayed to the other players in that room through Unity's relay servers.
- Advertising data: device information, ad interactions and diagnostics that Google processes to show ads, cap how often the same ad appears, report on ads and prevent fraud.
- Online status: whether you appear online to your friends while the game is open.
- Notification token: if you allow notifications, the notification address Apple (APNs) or Google (Firebase Cloud Messaging) issues for this device. It is stored at Unity, linked to your player record, so friend request, accept and invite notifications can be sent. On Android, Google may process the information needed to deliver a notification as part of its own service.
What we do not collect
We do not collect your name, phone number, date of birth, address, precise location, contacts, photos or microphone data. There is no voice or text chat. Your advertising ID (IDFA/GAID) is not read: the game never asks for tracking permission (ATT) on iOS, and the Android build does not declare the advertising ID permission (AD_ID). The game contains no analytics or crash-reporting tools.
2. On-device storage and similar technologies
The game uses no web cookies. Your settings, local accounts and profile files, whether you have seen the privacy notice, and ad-frequency counters are stored on your device. The Google Mobile Ads SDK and Google's consent tool (UMP) may store your ad choice and the information needed to deliver ads on the device. We do not track you across apps or websites.
3. How we use personal information
- Providing the game: guest and username accounts, saving progress to the cloud and syncing it between devices.
- Online races: creating and joining rooms, relaying race data and showing your display name.
- Purchases: delivering, restoring and verifying purchases.
- Advertising: non-personalised ads that keep the game free. An ad appears at the end of every single-player level. Online races and leaving from the pause menu are ad-free. If you choose, you can watch a short ad after a race or in the credit shop for a reward (doubling the race credits, or up to three free nitro canisters a day); these rewarded ads only appear when you ask for them. “Remove ads” turns off the end-of-level ads, while optional rewarded ads stay available at your choice; other purchases do not turn ads off. Ad requests are capped at the PG content rating.
- Friends and notifications: adding friends, showing which friends are online, inviting a friend to a room and, if you allowed it, sending friend request, accept and invite notifications. We do not use notifications for marketing.
- Safety and compliance: filtering offensive words in usernames, reviewing abuse reports and meeting legal obligations.
- Support: answering your emails.
We do not use your data to send marketing emails, to build profiles or to train AI. We make no automated decisions about you that have legal or similarly significant effects.
4. Who we share it with
- Unity Technologies (Unity Gaming Services: Authentication, Cloud Save, Relay, Lobby, Friends, Cloud Code): our service provider, processing accounts, cloud saves, online races, friend lists and notification delivery on our behalf. Data is stored on Unity's Google Cloud infrastructure in regions that include the US and EU countries; the region cannot be chosen. Unity privacy policy.
- Google (Google LLC / Google Ireland Limited): AdMob ads and the ad consent form. Google processes this data under its own policy: Google privacy policy, how Google uses data from partner apps.
- Apple and Google (App Store, Google Play): they handle purchases and payment. Your payment details never reach us.
- Apple's and Google's notification services (Apple Push Notification service, Firebase Cloud Messaging): if you allowed notifications, they deliver friend notifications to your device.
- Other players: your display name and your truck's look are visible to players in the same race room. Your friends see your display name, whether you are online, and the requests and invites you send them.
- Authorities: when there is a lawful request, or where needed to protect our rights.
- Business transfers: if the game or the studio is transferred, your data may pass to the new owner, who remains bound by this policy.
We do not sell your personal information.
5. Your choices
- An account is optional: you can keep playing as a guest without a username and password.
- Ad privacy: in Europe and in US states with privacy laws, you can change your ad consent or opt-out at any time under Settings ▸ Purchases ▸ ADS ▸ AD PRIVACY.
- Removing ads: the “Remove ads” product turns end-of-level ads off permanently; rewarded ads only appear when you ask for them. Other purchases do not turn ads off.
- Friends and notifications are optional: notification permission is requested the first time you open the friends screen. You can turn notifications off at any time with the bell on the friends screen or in your phone's settings; turning the bell off deletes your notification token from the server.
- Deleting your account and data: see the next section.
6. Deleting your account and data
In the game: Settings ▸ DELETE ACCOUNT ▸ DELETE PERMANENTLY. This deletes your cloud profile, your friend relationships, your notification registration, your player record at Unity and the account on the device. Guest accounts are deleted the same way. Because the cloud record is deleted too, an internet connection is required; without one, nothing is deleted. Deleted credits, nitro canisters, career and garage cannot be recovered. Permanent purchases belong to your store account and come back with RESTORE on the same store account.
Uninstalling the app does not delete your cloud record. If you cannot open the game, email info@oyist.com with the subject “TONZ account deletion” and include your username. Requests are completed within 30 days.
7. Retention
Account and profile data is kept for as long as your account exists and is deleted from the cloud when you delete the account. On-device data stays until you delete the app or the account. Emails are kept for as long as the correspondence requires. Connection and advertising data processed by Unity and Google is subject to their own retention periods.
8. Security
We take technical and organisational measures to protect your data: your password is not kept on the device, account and save connections are encrypted, and usernames are filtered. Even so, no system on the internet is completely secure.
9. International transfers
Unity's and Google's servers are outside Türkiye, in regions that include the US and EU countries, so data processed in the game is transferred abroad. You can write to us for information on the safeguards the transfer relies on.
10. Children
TONZ is a racing game for a general audience. It is not directed to children and is not published in a children's category or with a children's target audience in the stores. If you are a parent and believe your child has created an account in TONZ, write to us and we will delete the account and its cloud record.
11. Changes
We update this policy when the game's data practices change. The date of the last update is at the top of the page. We announce material changes in the game or on this page.
12. Contact
Abdulkerim Atik (OYIST) — Türkiye
Email: info@oyist.com
13. Notice to players in Europe
This section applies to players in the European Economic Area, the United Kingdom and Switzerland (GDPR, UK GDPR and the Swiss data protection act). The controller is Abdulkerim Atik (OYIST); contact details are above.
Legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the game, the account and cloud saves | Account, game profile, player and install IDs, device and connection data | Contractual necessity (Art. 6(1)(b)) |
| Online races | Display name, player ID, race data, IP address | Contractual necessity (Art. 6(1)(b)) |
| Friends and notifications | Display name, player ID, friend list and requests, invites, online status, notification token | Contractual necessity (Art. 6(1)(b)); notifications also depend on the permission you give on your device |
| Purchases | Transaction data | Contractual necessity (Art. 6(1)(b)); legal obligation for record-keeping (Art. 6(1)(c)) |
| Advertising (end-of-level and optional rewarded ads) | Device and connection data, advertising data | Your consent in the consent form (Art. 6(1)(a)). You can object in the form to purposes for which Google relies on legitimate interests |
| Safety, username filtering, abuse prevention | Display name, player ID, IP address | Legitimate interests (Art. 6(1)(f)): protecting the game and its players |
| Legal obligations and claims | Relevant data | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
| Support | Email address and message | Contractual necessity (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
Your rights
You have the right to access your data, to have it corrected or erased, to restrict its processing and to receive a portable copy; to object to processing based on legitimate interests; and to withdraw consent at any time. You can withdraw ad consent with the AD PRIVACY button. For other requests, write to info@oyist.com.
If you are not satisfied with our response, you can complain to the supervisory authority where you live: EEA supervisory authorities, or the ICO in the UK.
Transfers outside Europe
The controller is in Türkiye, and some of Unity's and Google's servers are in the US. For transfers outside Europe, Unity and Google rely on the European Commission's standard contractual clauses in their data processing terms. Write to us for details.
14. Notice to players in US states
This section is for residents of US states with their own privacy laws (e.g. California). Personal information we process now and processed in the past 12 months:
| Category (CCPA) | Examples | Disclosed to |
|---|---|---|
| Identifiers | Player ID, username, IP address, notification token | Unity (service provider), Google (advertising), Apple and Google (notification delivery), other players and your friends (display name only) |
| In-game interactions | Friend list and requests, invites, online status | Unity (service provider), your friends |
| Commercial information | Products purchased, transaction numbers | Unity (cloud save), Apple and Google (stores) |
| Internet or network activity | Race data, ad interactions | Unity, Google |
| Coarse geolocation | Country or city derived from the IP address | Unity, Google |
We do not process sensitive personal information and draw no inferences (profiles) about you. We do not sell personal information for money and do not process it for targeted advertising; ads are not personalised. Because some state laws may treat disclosures to ad services as a “sale”, you can opt out with the AD PRIVACY button in those states. We have no actual knowledge of selling or sharing the personal information of consumers under 16.
To exercise your rights to know, access, correct, delete and opt out, write to info@oyist.com. To verify your identity we may ask for your username or details about your account. You may also use an authorised agent, and you may appeal a request we decline. You will not be discriminated against for exercising your rights. We do not share personal information with third parties for their direct marketing (California “Shine the Light”).
15. Notice for Türkiye (KVKK)
Prepared under Article 10 of Türkiye's Personal Data Protection Law No. 6698 (KVKK) for TONZ players. The Turkish version of this page is the binding notice.
- Controller: Abdulkerim Atik (OYIST), independent developer, Türkiye — info@oyist.com.
- Data categories: transaction security (player ID, session token, install ID, IP address, password stored at Unity), customer transactions (game profile, purchases, transaction numbers), marketing (device and ad-interaction data for non-personalised ads), contact (your email, only if you write to us), other (username, online race data, friend list and requests, invites, online status, notification token).
- Purposes: as in section 3.
- Method and legal grounds: collected electronically through the game, partly automatically, and through your emails; KVKK Art. 5/2-c (contract), 5/2-ç (legal obligation), 5/2-e (establishing, exercising or protecting a right), 5/2-f (legitimate interests: safety, username filtering, offering the game free with non-personalised ads).
- Transfers: to Unity Technologies, Google, Apple, players in the same race room (display name and truck look only), your friends (display name, online status, requests and invites) and, upon lawful request, competent authorities. Because Unity's and Google's servers are abroad, your data is transferred abroad; write to us for information on the safeguard relied on.
- Rights (KVKK Art. 11) and applications: you may apply to info@oyist.com under the Communiqué on the Procedures and Principles of Application to the Data Controller. Applications are concluded free of charge within 30 days; if rejected or answered inadequately you may complain to the Personal Data Protection Board.
Adapted for TONZ from the “Privacy Policy (GDPR Enhanced)” template released under CC0 by General Legal, PC. General Legal has not reviewed this adaptation; the template does not constitute legal advice.