Colorama — Privacy Policy

Last updated: 13 August 2026

This page is an English translation of the Turkish original. If the two versions conflict, the Turkish version prevails.

1. Who and which app

App: Colorama (Android package com.colorama.app)
Data controller: Ahmet Sarıca
Contact: fetihcagioyun@gmail.com
Policy address: https://ahmetsarica.github.io/colorama-gizlilik/

2. Short summary

Colorama is a colour memory game. The whole game — categories, the daily challenge and duels against bots — can be played offline. If you never sign in, nothing is sent to any server.

Once you sign in (the anonymous or game-account sign-in needed for live duels), two things are sent:

Cloud backup: your statistics, daily streak, nickname and country are stored under your own identity so they survive a change of device. Only you can read that record.
Live duel records: the minimum needed to pair two players and run the match.

There is no ad network, no analytics, no crash reporter and no tracking library. The app does not access location, contacts, photos, microphone or camera, and it does not use an advertising ID (GAID/IDFA); it does not request permissions for any of these.

3. Stored on your device

The following is kept in your phone's app storage (AsyncStorage). Uninstalling the app deletes all of it. The backed up column shows whether a copy of that record also lives in the cloud backup once you have signed in (see 4.2).

What	Where	Why	Backed up
Category stats, duel record, daily stats, top 5 guesses	`colorama.kayit.v1`	Your progress on the profile screen	yes
Today's daily guesses (colour code + time) and streak	`colorama.gunluk.v2`	Resuming an unfinished daily challenge	yes
Nickname and country	`colorama.profil.v1`	The identity your opponent sees in a live duel	yes
Sound, vibration, high contrast	`colorama.ayarlar.v1`	Your preferences	no
Interface language	`colorama.dil.v1`	Your preference	no
Session id (uid) and display-name cache	`colorama.kimlik.v1`	Not having to sign in for every live match	no
Session ids of players you blocked	`colorama.engellenenler.v1`	Not being matched again with a player you reported	no
Firebase session token	Firebase Authentication SDK's own record	Keeping the session across restarts	no

About the nickname: you type it yourself. If you enter your real name, your email address or anything else that identifies you, that information will be visible to your opponent in a live duel and written to the match room on the server. A nickname is optional; leave it empty and your opponent sees a neutral label.

4. Sent to the server

Only once you have signed in. The server is Google's Firebase Realtime Database, and the data region is set to europe-west1 (Belgium).

4.1 Identity

A session is opened before a live duel. There are two paths:

Anonymous sign-in — the default. Firebase generates a random user id (uid). This id is not tied to a name, email address, phone number or hardware identifier; it is tied only to this installation of the app.
Game account sign-in — in builds that ship the Google Play Games (Android) or Game Center (iOS) module. In that case your player id and display name are taken from the platform; verification happens on the server and produces a Firebase identity. No access is made to your Google or Apple account password, email address or friend list.

4.2 Cloud backup

After you sign in, a copy of your progress is kept under your own identity (oyuncular/<uid>). It contains:

category stats, duel record, daily stats and the top five guesses (object id + score),
daily streak, last day played and that day's guesses (colour code + time),
your nickname, your country and when you last changed them.

The record is updated with a few seconds' delay as you play, and also when the app goes to the background. Server rules open this branch only to its owner: no other player can read or write it.

Its limit, plainly: with anonymous sign-in the identity is tied to this installation only. Uninstall the app and that identity is gone, together with access to the backup. For the backup to genuinely survive a change of device you need to sign in with a Play Games / Game Center account.

4.3 Matchmaking queue

While looking for an opponent, a temporary record is written to the queue: your session id, the code of the room you created, and a timestamp. The record is deleted when a match is found or the search ends; if your connection drops, the server deletes it automatically.

4.4 Match room

During a match the room holds:

both players' session ids,
your nicknames (if you set one),
timestamps of joining the room,
the match category and the object ids being asked,
for each guess, the colour you guessed (#RRGGBB) and your time (ms).

The correct colour of an object is never sent to the server; scores are computed separately on each device. Only the two players in a room can read it.

4.5 Reporting an offensive name

At the end of a match you can report your opponent's name. Doing so writes a single record to the server: the session id of the reported player, the name shown at that moment, and a timestamp. The record does not say who reported it — we do not need that and we do not store it. No player can read these records; they are used only to understand how a name got past the filter, and to fix the filter.

Reporting also blocks that player, and the block list is kept only on your device (see 3). The "Delete my data" flow deletes that list as well; the report record on the server remains, because it does not identify you.

4.6 Firebase's own processing

While providing the service, Firebase processes connection metadata (IP address, connection time) and authentication records (creation and last sign-in time of the identity). This processing is carried out by Google LLC under its own privacy policy and data processing terms:

Firebase privacy and security: <https://firebase.google.com/support/privacy>
Google privacy policy: <https://policies.google.com/privacy>

The app does not use Google Analytics for Firebase, Crashlytics or any similar measurement service; the Firebase project deliberately has no Analytics measurement id configured.

5. Not collected

Location (coarse or precise)
Contacts, call or message logs
Photos, microphone, camera
Email address, phone number, real name
Advertising ID (GAID/IDFA), device fingerprint
Special-category data such as health, finance, sexual orientation or beliefs

No data is sold, shared for advertising, or used for marketing.

6. Legal basis

Performance of a contract: processing the session id, nickname and guesses in order to pair players and run a live duel.
Consent (KVKK art. 5/1) and legitimate interest (GDPR art. 6(1)(f)): storing your progress in the cloud backup so that it survives a change of device.
Preferences kept on the device (sound, vibration, contrast, language) never leave it; no transfer takes place for those.

7. Retention

Record	Duration
Everything stored on the device	Until you delete it or uninstall the app
Queue record	Until the search or match ends; at most a few minutes
Cloud backup	Until you delete it
Match room	Until manually deleted; automatic cleanup is planned
Firebase identity	Until you delete it

8. Your rights

Under GDPR Art. 15–22 and KVKK Art. 11 you have the right to access your data, to have it corrected or erased, to restrict processing, to object to processing, and to data portability. To exercise these rights, write to fetihcagioyun@gmail.com. We respond within 30 days.

9. Deleting your data

9.1 From inside the app

Settings → Data → Delete my data (the same button is also on the Settings → About → Privacy screen). When you confirm:

your cloud backup (oyuncular/<uid>) on the server is deleted,
your Firebase identity on the server is deleted,
your queue record and your record in the currently open match room are deleted,
your statistics, daily history and streak, nickname and country on the device are deleted.

Deliberately kept: sound, vibration, high contrast and language. These describe how the interface behaves rather than who you are, never leave the device, and are not tied to any identity.

What cannot be deleted from inside the app — stated plainly:

Rooms of matches already played. The app keeps no list of the rooms you played in, and room codes cannot be enumerated from the server. Your nickname, guesses and times may remain in those rooms. To have them removed, write to fetihcagioyun@gmail.com.
The second-player field in a room someone else created. By design this field is written once: after it is set it cannot be changed or removed, because it is the very mechanism that locks the second player slot. What remains is a raw identifier string, and after deletion that identifier no longer belongs to any account.

After your identity is deleted the app keeps working; a new identity is created if you enter a live duel again.

9.2 From outside the app (web)

If you have uninstalled the app or the in-app path does not work for you, use the form at https://ahmetsarica.github.io/colorama-gizlilik/veri-silme.html or write to fetihcagioyun@gmail.com. To process the request we need your session id (uid); you can find it at Settings → Player → Account.

10. Children

Colorama is not directed at children under 13 and does not knowingly collect personal data from children under 13. If we learn that such data has been collected, we delete it and give notice. The app is not part of the Google Play "Families" programme.

11. International transfers

Data is held on Google's infrastructure inside the European Union (europe-west1). Some metadata may be transferred outside the EU as part of Google's operation; Google relies on standard contractual clauses for such transfers (see Google's data processing terms).

12. Security

All communication with the server is encrypted with TLS; the Firebase SDK does not open unencrypted connections.
Database access is restricted by server-side security rules: a player can only write to their own record, cannot change or delete another player's guesses, and a third player cannot join a full room.
The client-side API key is not a secret (this is Google's design); security is provided by the server rules, not by the key.

13. Changes

If this policy changes, the date at the top is updated. For a significant change (for example collecting a new type of data) a notice is also shown in the app.

14. Contact

fetihcagioyun@gmail.com