Privacy Policy

Guessong - Music Quiz Game | Last updated: October 2026

1. Introduction

Guessong is operated by Muharrem Bektaş Çimen; in this document "we", "our" and "us" mean that person. We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our mobile application.

• Data controller: Muharrem Bektaş Çimen, who develops and operates the app
• Developer account: On the App Store the app is published under a developer account registered to Seray Çatıkkaş Çimen (shown as Seray Catikkas Cimen), and that is the name on the listing; App Store purchases go through that account. The app is also on Google Play
• Contact and requests: guessongapp@gmail.com

2. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Username and display name
• Password (stored securely using bcrypt hashing)
• Profile avatar (optional)

Your Own Photo as Your Avatar

If you use the photo avatar, you choose a photo from your device to use as your avatar. Only the photo you choose leaves your device; we do not see or upload the rest of your photo library. On iOS the app asks for access to your photos before the picker opens; on Android the system photo picker opens without asking for any permission.

• Our server turns the photo into a new square 256×256 image and keeps only that. Everything else in the original file is discarded, including its metadata (such as where and when it was taken and the camera used)
• It is stored with Supabase (see section 4) at a public address, and it is shown to other players wherever your avatar appears (see section 5)
• A new photo replaces the old one. Switching back to a built-in avatar does not delete your photo: it stays at its public address until you upload a new one, delete your account, or ask us to remove it. It is also deleted if the purchase is refunded, and we remove a photo that breaks the community rules after it is reported. Copies already loaded by other devices can take up to an hour to disappear

Chatting with Guessy

Subscribers can chat with Guessy once a day to get a round of songs picked for their mood. We keep what you tell Guessy (how you feel and what language you want the music in) and the songs picked for you, so we can show you today's conversation again and hold you to one round a day. The songs you then play are kept in your game history like any other round, which is how Guessy avoids repeating them. If a round fails, we keep what you typed without your account attached, to work out what went wrong; because it is not linked to your account, it is not deleted when you delete your account.

To pick the songs, your answers, your app language and the songs you have already heard in Guessy rounds are sent to an AI service (see section 4). Your name, email address and account ID are not sent. Please do not tell Guessy anything private.

Third-Party Authentication

If you sign in using third-party services, we collect:

• Google Sign-In: Your Google ID, email address, and profile name
• Apple Sign-In: Your Apple ID and associated email address

Game Data

We collect information about your gameplay:

• Game history (songs shown to you, correct/incorrect guesses, response times)
• Statistics (total games, accuracy rate, streaks)
• Level progress and XP (experience points)
• Daily challenge attempts and completion status
• Daily puzzle progress (the letters you have entered, which songs you have solved, and how long you have spent)
• Daily chest openings and the rewards received
• Diamond balance and transaction history
• Playlists you build, including the songs and artists you put in them
• Badges you have unlocked
• Events you enter, and any diamond entry fee paid
• A record of the push notifications we have sent you, including their text

Social Features Data

When you use social features, we collect:

• Friends list and friend requests
• Online/offline presence status
• Multiplayer room participation, and messages you send in a room
• Game statistics with friends (games played together, wins and losses)

Community Content

If you use the Community tab, we collect and store:

• Posts and comments you write, together with your username and avatar
• Posts and comments you like
• Reports you submit about other people's content
• The accounts you block or mute

Posts and comments are public: anyone using the app can see them, along with the username and avatar attached to them. Please do not include anything private in what you post. Reports are used to moderate the community and are not shown to other players; the only exception is the one in section 5, where the law requires us to disclose something.

Support Messages

If you contact us through the app, we keep the message you send and the email address you give us, so that we can reply and keep a record of the conversation.

Device Information

We automatically collect:

• Device type and operating system (iOS/Android)
• Device token for push notifications
• Advertising Identifiers: IDFA (iOS) and Advertising ID (Android)
• App usage data and crash reports
• Standard web server logs for every request our servers receive: your IP address, the address requested, and your device's user agent

Purchase Information

For in-app purchases, we collect:

• Subscription status and plan type
• Purchase history and transaction IDs
• Diamond purchase records

Note: We do not directly collect or store payment card information. All payments are processed through Apple App Store, Google Play Store, or RevenueCat.

3. How We Use Your Information

We use the collected information to:

• Provide and maintain our game services
• Authenticate your account and ensure security
• Track your game progress, achievements, and statistics
• Enable multiplayer features, leaderboards, and friend interactions
• Process in-app purchases and manage subscriptions
• Send push notifications (game invites, daily reminders, streak alerts)
• Pick songs for your Guessy round
• Provide customer support
• Improve our app performance and features
• Detect and prevent fraud, cheating, and abuse
• Comply with legal obligations

4. Third-Party Services

We integrate with the following third-party services:

Music Services

• Apple Music API: To provide music content, song previews, and album artwork for the game
• Deezer API: As an alternative music source for song data and previews

Authentication Services

• Google OAuth: For Google Sign-In functionality
• Apple Sign-In: For Sign in with Apple functionality

Payment Processing

• RevenueCat: For managing in-app purchases, subscriptions, and purchase verification
• Apple App Store / Google Play Store: For processing payments

Communication Services

• Expo Push Notifications: For delivering push notifications to your device
• Expo Updates: Contacted each time the app starts, to check for an app update. It receives your platform, the app build you are running, and an identifier that stays the same for as long as the app is installed
• Resend: For sending transactional emails (verification codes, password resets)

Security & Analytics

• Google reCAPTCHA v3: For bot protection during account registration
• Appodeal: For serving advertisements to free users. On iOS, Appodeal passes requests to its partner networks: Unity Ads, AppLovin, Vungle, IronSource, Mintegral, InMobi, BidMachine, Yandex and MyTarget. On Android it uses its own ad adapter
• Yandex AppMetrica: Comes with Yandex's advertising library on iOS. We do not send it anything; Yandex uses it for its own ad measurement and crash reporting, and it keeps an identifier on your device that survives reinstalling the app
• Firebase/Google Analytics: For app analytics and crash reporting

AI Services

• OpenRouter: Receives what you tell Guessy, as described in section 2, and passes it to the AI model that picks your songs. That model is currently Google's Gemini, with OpenAI's models as a backup when it is unavailable

Infrastructure

• Supabase: For database storage, real-time features, and storing avatar photos. The database runs on Amazon Web Services infrastructure inside the European Union
• Telegram: Our error alerts are sent to a private Telegram channel we control. An alert can contain your user ID, the address of the request that failed, the error our database or a service returned, and a stack trace
• Hetzner Online GmbH: The server our backend runs on, located in Finland

5. Data Sharing

We do not sell your personal information. We may share data with:

• Third-party service providers listed above, solely to provide our services
• Other users: see "What Other Players Can See" below
• Legal authorities: When required by law or to protect our rights

What Other Players Can See

Some information is visible to other people using the app by design:

• Your username and avatar, including your own photo if you use one, wherever you appear — leaderboards, events, multiplayer rooms and the Community tab
• Your scores, level and streak on leaderboards
• Anything you post or comment in the Community tab

Your email address is never shown to other players.

6. Advertising and Tracking

We use Appodeal, a mobile ad mediation platform, to display advertisements in our app. Appodeal and its ad network partners may collect and use the following information to serve personalized ads:

• Advertising ID: IDFA (iOS) or Advertising ID (Android)
• IP Address: Used for approximate location targeting
• Device Information: Device type, operating system, screen size

For more information about how Appodeal handles your data, please see the Appodeal Privacy Policy.

iOS Users: You will be prompted with Apple's App Tracking Transparency (ATT) dialog. You can choose to allow or deny tracking for personalized advertising.

EU/EEA Users: We comply with GDPR requirements. Appodeal's Consent Management Platform (CMP) will request your consent for personalized advertising.

Opt-out Options:

• iOS: Settings > Privacy > Tracking
• Android: Settings > Google > Ads > Opt out of Ads Personalization

Premium Users: Subscribers enjoy an ad-free experience.

7. Push Notifications

We send push notifications for:

• Daily song challenges
• Multiplayer game invitations
• Streak reminders
• Friend requests

You can manage notification preferences in the app settings or disable them entirely through your device settings.

8. Data Security

We implement appropriate security measures to protect your data:

• Passwords are hashed using bcrypt with secure salt rounds
• Signed authentication tokens, checked against your account on every request; where a session is tied to a device, signing in on another device ends it
• Encrypted data transmission (HTTPS/TLS)
• Secure server infrastructure with rate limiting
• Device token verification to prevent unauthorized access
• reCAPTCHA protection against automated attacks

9. Your Rights

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate data
• Deletion: Request deletion of your account and data
• Export: Export your data in a portable format
• Opt-out: Disable personalized advertising
• Withdraw consent: Revoke permissions at any time

To exercise these rights, use the account deletion feature in the app or contact us at guessongapp@gmail.com.

10. GDPR Rights (EU/EEA Users)

If you are in the EU/EEA, the rights in section 9 are guaranteed to you under GDPR, along with:

• Right to restrict processing
• Right to object
• Rights related to automated decision making

You may also lodge a complaint with your local data protection authority.

11. Children's Privacy

Our app is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected data from a child under 13, please contact us immediately and we will delete the information.

12. Data Retention

We retain your data for as long as your account is active. Upon account deletion:

• Personal data is deleted within 30 days
• Figures that count all players together, and cannot be traced back to you, remain in our totals

13. International Data Transfers

Your data is processed outside your own country. Our backend runs on a server in Finland and the database is inside the European Union. Some of the services listed in section 4 — among them Apple, Google, RevenueCat, Firebase, Appodeal, OpenRouter and OpenAI — process data in the United States and elsewhere. We ensure appropriate safeguards are in place for such transfers, including standard contractual clauses where required.

14. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes through the app or via email. Continued use of the app after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have any questions about this privacy policy or wish to exercise your rights, please contact us at:

Email: guessongapp@gmail.com

We will respond to your request within 30 days.