Browse sections
1. Our approach
KELİME ŞİFRESİ: Kriptogram (formerly Zeka Kutusu) offers the Söz Şifresi, Kelime Şifresi and Hedef Kelime word games. No account, real name, phone number or email address is required.
Single-player puzzles and progress are stored on your device and can be played offline. Builds with Online Duel enabled exchange data with a server for online play. Advertising, analytics and crash reporting services may also process technical data. Not all app data therefore stays on your device.
2. Game information stored on your device
Depending on the modes and features you use, the following is kept in the app's local space:
- Game progress: Unlocked/completed levels, scores, statistics, unfinished games, puzzle boards, guesses and hints used.
- Rewards and goals: In-game Gold balance and reward records, achievements, badges, daily streaks, tasks, weekly goals and personalized level orders.
- Preferences: Theme, sound, vibration, hint confirmation, game settings, reminders and tutorial completion.
These records let you resume playing, calculate rewards, display goals and statistics, and retain preferences. Records from older games may be retained for compatibility. There is no developer-operated account or cloud synchronization service for single-player progress. The temporary Online Duel session record is stored separately from that progress.
3. Online Duel and public rooms
This section applies when you use Online Duel in builds where it is enabled. Matchmaking, rooms and multiplayer gameplay run on Cloudflare Workers and Durable Objects.
- Session and match data: The app creates a random session key. The server processes a hash of that key, room code, match identifier, visibility, chosen room name/nickname, ready and connection status, timing, guesses and their evaluations, results and rematch choices. These reconnect players, validate moves, run the match and limit abuse; no permanent user account is created.
- What others can see: The public waiting list includes the room name/nickname, room code, match identifier, game type and player count. Your opponent can see readiness/connectivity, attempt count, whether and when you solved the puzzle, and the result. Your typed guesses are not sent to your opponent; the correct answer is revealed when the game ends. There is no free-text chat.
- Network and security data: Cloudflare processes your IP address when connecting. The app server uses IP addresses for request limits and a daily-changing hash instead of the raw IP in room and waiting-list records. This hash limits rooms from the same network; it should not be considered fully anonymous. Cloudflare’s infrastructure processing is subject to its own policy.
Do not use your real name or contact information as a room name. Private rooms are joined by invitation code; someone with the code can join if a seat is available. Choosing a public room makes its listing visible to other users. Session keys are not included in public listings, invitations or the app’s custom Analytics events.
4. Advertising and Google AdMob
The app offers rewarded ads you may watch to earn in-game rewards. Google AdMob provides the ads. They may preload in the background at startup and after an ad is shown; choosing not to watch does not mean the advertising service processes no data.
Google Mobile Ads may process IP address and derived approximate location, ad/app interactions, performance/diagnostic data, and device identifiers such as advertising ID and app set ID. These are used for ad delivery, measurement and abuse prevention.
Ad personalization, available identifiers and processed data depend on the device, region and Google's current settings. Android advertising privacy settings let you manage your advertising ID and related preferences. These settings do not stop all technical processing.
Details: Google Privacy Policy and Google Mobile Ads data disclosures.
5. Usage analytics and crash reports
Google Analytics for Firebase helps understand feature use and improve the app. Custom events can include tutorial outcome, opened mode, game/session outcome, difficulty, active play time, hint count, rewarded-ad outcome and Online Duel action/result types. They do not include typed guesses, answers, room codes, nicknames, session keys or your full local save.
Analytics may also process app launches and sessions, version, device/OS information, language, approximate region and installation identifiers. When available, the SDK may process advertising ID; approximate region does not require GPS permission.
Firebase Crashlytics helps identify and fix crashes and errors. Error types, technical stack traces, app version, device/OS and installation-related diagnostics may be sent to Google. The app’s Flutter error-reporting layer sends the error type and stack trace; it does not attach dynamic error messages, guesses, backup contents or session keys. The SDK may also generate automatic technical reports.
The developer can review usage and error reports through these services. The current app has no separate in-app switch for Analytics or Crashlytics. Events and reports recorded offline may be sent when connectivity returns.
Details: Firebase privacy and security and Google Analytics data collection.
6. Device permissions and reminders
- Internet/network state: Used for ads, analytics and crash reports, and Online Duel in enabled builds. Single-player puzzles and local progress do not require a developer server.
- Notifications: If enabled, local daily game reminders are scheduled on the device, not sent remotely by the developer.
- Device restart: Used to restore scheduled reminders.
- Advertising ID: Android support for ad/analytics device identifiers; not camera or location permission.
- Backup selection: When restoring, the Android file picker provides access to the backup you select. There is no feature scanning all files.
The app does not request camera, microphone, contacts, SMS, call-log or precise-location access. Manage notification permission in device settings; denying it does not prevent playing. Depending on settings, notification content may appear on the lock screen.
7. Backups and result sharing
Progress backup: When you start a backup, game progress and transferable preferences are written to a JSON file. Some device-specific preferences such as notification permission are excluded. Choose a destination in the device share menu to save/send it. Email, messaging or cloud-storage selections transfer it to that service.
The backup is not password-encrypted. Anyone with access can read the game records. Keep backups secure. Restoration brings records onto your device and may replace existing progress.
Game result sharing: When you choose to share, an achievement/result card is created as an image and passed to your selected app. Images and text are subject to that service's privacy terms.
Android system backup/device transfer: Device and operating-system backup settings may allow local app data into system backups or onto another device. Manage these backups in device settings.
Online session and invitations: The Online Duel session key is excluded from progress JSON backups, Android system backups and device transfers. If you share an invitation, the room code and invitation text are passed to the app you choose. The session key is not included. Share the code only with people you want to join.
8. Third parties and data transfers
Google services process advertising, analytics and crash-report data; the developer’s Cloudflare infrastructure processes Online Duel data. Their infrastructure may process information on servers outside your country. Provider technical records and retention practices depend on their service terms and privacy disclosures.
Your full local save is not added to ads or Analytics events. Backups, results and invitations you choose to share are sent to the selected recipient. Google Play and ad links are subject to the destination service’s terms.
Provider information: Google Privacy Policy, Firebase privacy and security and Cloudflare Privacy Policy.
9. Retention and deletion
- Device records: Progress and preferences remain until the relevant reset or app-data deletion. “Reset Game” resets progress; some preferences may remain, and it does not delete all online/third-party records. For full local deletion, use Android Settings → Apps → KELİME ŞİFRESİ: Kriptogram → Storage → Clear data. Menu names vary. Uninstalling normally removes the local app area.
- Online room and match records: Automatic deletion is scheduled 15 minutes after a room finishes or is cancelled, with an overall limit of 1 hour from room creation. Rematches do not extend that total lifetime. Expired or unavailable rooms are removed from the public list. These are cleanup times for the app’s active room data; infrastructure delays and separate provider technical records/backups are not covered by the same deletion guarantee.
- Leaving an online session: Server-confirmed departure or clearing an expired session removes the relevant local session record. Disconnecting, closing the app or clearing local data does not instantly erase all server records; rooms follow the cleanup rules above.
- Backups and shared copies: Resetting or uninstalling does not automatically delete exported files, shared content or system backups. Delete them separately from the relevant service. Restoring an old backup may restore deleted progress.
Retention of technical records processed by Google and Cloudflare depends on service settings and policies. Local deletion does not automatically request deletion of those records. Send privacy/deletion requests to the address below; requests are assessed within the ability to link records to you and the provider’s deletion facilities. There is no permanent membership account to delete.
10. Security
Local records are stored in the app's operating-system storage space. There is no additional password/biometric lock, and progress backups are unencrypted. Google Mobile Ads uses TLS encryption for data transfers.
Use a screen lock, keep your operating system updated and protect backups. Someone with device access can see progress in the open app. No storage or transmission method guarantees absolute security.
Release builds use encrypted HTTPS/WSS connections for Online Duel. The reconnecting session key is stored with platform-backed secure storage; the server uses a hash for room access. A room code is an invitation, not a replacement for the secure session key.
11. Children’s privacy
There is no account registration, and no real name or contact information is required. Advertising, analytics, crash reporting and, when used, Online Duel can nevertheless process the data described above. Do not place a child’s name, contact details or other personal information in a public room name.
Parents and legal guardians can contact us below about a child's use or data. Do not send unnecessary personal information about a child or sensitive documents in support requests.
12. Contact and privacy requests
Send privacy questions and information, correction or deletion requests to the email address below. The developer cannot remotely access or delete local game records on your device.
If you email us, the developer and email service process your address, message and attachments you choose to send to answer your request. Local game records are not automatically attached. Correspondence is kept for as long as needed to resolve the request and meet any applicable retention duties.
Publisher: Piksela Studio
Developer and privacy contact: Hakkı Özkan
Email: hakkitrb@gmail.com
13. Policy changes
When features or data practices change, this policy and its date are updated. Where needed, changes are explained before the affected feature is used.
This policy covers the KELİME ŞİFRESİ: Kriptogram mobile app. Visitor logs or cookies of the website publishing it, if any, are governed by that site’s separate disclosures.