Privacy Policy — Trovixa

Last updated: August 23, 2026

Applicable to: This policy applies to the mobile games "Trovixa: Shelf Quest" (Free) and "Trovixa: Shelf Quest+" (paid iOS/Android Plus; Apple Arcade application evaluated separately) on Android and iOS, including iPadOS. For our website and SaaS products, see the Website Privacy Policy / KVKK.

1. Controller

The data controller responsible for your personal data in Trovixa is:

Mev E-Ticaret Limited Company ("Mevvsoft")
Address: Fenerbahçe Mah. İğrip Sok. No:13 Kadıköy / İstanbul 34726
MERSIS: 0620166247200001
Tax ID: 6201662472
E-mail: iletisim@mevvsoft.com

2. Information We Collect

2.1 Data you provide

• Support correspondence — if you e-mail us, we keep your message and reply address to resolve your request.
• In-app purchases — processed by Google Play Billing and Apple App Store; we never see or store your full payment instrument.
• Optional team profile — if you use Teams, you choose a short player label and may create a team name. Do not use your legal name or other identifying information.

2.2 Data collected automatically

• Game progress & cloud save — levels completed, coins, boosters, event progress, win streak and settings remain on your device unless you explicitly enable Cloud Backup. If enabled, they sync under an anonymous device identifier + secret pair (see §4). No e-mail or platform account is attached; an optional team label can be included if you use Teams.
• Leaderboard data — a generic player label, score, and anonymous device identifier for the optional Mevvsoft leaderboard. Game Center or Play Games data is handled by the platform provider when you enable those services.
• Team data — team name and invite code, chosen player label, anonymous device identifier, membership date, and weekly/lifetime contribution scores.
• Device and ad interaction data — if you choose an optional rewarded ad, Google AdMob may process device model, OS/app version, coarse region, ad interactions and an advertising identifier where permitted. Trovixa keeps short crash breadcrumbs locally on your device and does not upload them automatically.
• Device-link codes — when you transfer progress to a new device, a 6-digit code is generated and kept for at most 10 minutes, then deleted.

3. How We Use Information

• Provide and operate Trovixa (gameplay, cloud save, leaderboards, teams, live events, daily rewards, wonder wheel, quests, collections and seasons);
• Restore your progress across devices via device-link codes;
• Serve and measure advertising (including rewarded ads) through Google AdMob and its certified ad networks;
• Process in-app purchases via Google Play Billing and Apple App Store;
• Detect and prevent fraud, cheating or abuse of cloud save and leaderboard services;
• Comply with legal obligations.

4. Cloud Save & Account Model

Trovixa does not require an e-mail account or social login. When cloud backup or Teams is first used, the app receives a random anonymous device identifier and long secret token. Progress and optional team membership are stored under this pair. A one-time 6-digit link code, valid for 10 minutes, can link another device. Keep transfer and team invite codes private; we do not require you to link this identifier to your real identity.

5. Third-Party Services

The Free edition includes the following optional third-party service integrations. Each processes data under its own privacy policy when the related feature is configured and used. The paid Plus / Arcade-candidate Build 7 contains no AdMob, RevenueCat, advertising identifier permission, tracking prompt or in-app-purchase framework; its optional anonymous cloud, team and platform game-service features remain covered by this policy.

• Google AdMob — advertising SDK. May collect Android Advertising ID, coarse location (country), device info, and interaction data to serve and measure ads. Uses an advertising identifier to personalize ads where permitted. Subject to Google Privacy Policy.
• RevenueCat — in-app purchase management. Receives an anonymous app user ID, store product identifiers, and purchase/entitlement status to unlock purchases. Does not receive your payment details. Subject to RevenueCat Privacy Policy.
• Google Play Billing / Apple App Store — process payments for in-app purchases. Mevvsoft does not receive your card or full payment instrument.
• Google Play Games / Apple Game Center — (when enabled) provide leaderboards and achievements via your OS-level game account; you control this connection from device settings.
• mevvshop.com — an external commerce website opened only when you tap its popup link. Trovixa does not send your save or anonymous cloud credential to the shop; the website receives the normal browser request and applies its own privacy/cookie terms. mevvshop.com.

6. Advertising & Tracking (IDFA / Advertising ID)

In the Free edition, Trovixa follows Apple's App Tracking Transparency framework and accesses IDFA only after system-level permission where required. On Android, you can reset or delete your Advertising ID and control ad personalization in device settings. Declining tracking does not block the offline campaign or other core gameplay. Plus / Arcade Build 7 does not request or use an advertising identifier.

7. Legal Basis (GDPR / KVKK)

• Consent — advertising identifier use and ATT prompts where applicable;
• Contract performance — providing the game, cloud save, teams, leaderboard and purchases you requested;
• Legitimate interests — fraud and cheating prevention and service security;
• Legal obligation — tax/record-keeping where required by law.

8. Data Sharing

We do not sell personal data. Data is shared only with the processors listed in §5 for features you use, our hosting provider for cloud functions, and public authorities where required by law.

9. Data Retention

• Cloud save, leaderboard and team membership records — kept until you delete them from Settings → Cloud, leave the team, or request erasure under §11. Deleting cloud data also removes the device’s team membership.
• Device-link codes — deleted after at most 10 minutes.
• Free-edition purchase records — retained by the relevant store/processor only as long as required for entitlement, tax, commerce or fraud-prevention obligations. Plus / Arcade has no in-app purchases.

10. Children

Trovixa is a general-audience puzzle game and is not designed to request a child's name, e-mail address or other direct contact details. We do not knowingly collect personal data from children without the consent required by local law. Contact us if you believe a child submitted personal data so we can investigate and delete it.

11. Your Rights & Data Deletion

Depending on your jurisdiction (GDPR, KVKK Art. 11, CCPA, etc.), you may have the right to:

• Access, correct, port or delete your personal data;
• Withdraw consent for advertising identifier use and personalized ads at any time (device settings);
• Object to or restrict certain processing;
• Lodge a complaint with your local data protection authority (e.g. KVKK Board in Türkiye).

Delete Trovixa data

1. Fastest method: in Trovixa open Settings → Cloud, choose Delete Cloud Data, and confirm. The authenticated request deletes the anonymous cloud save, device-link codes, leaderboard entry, player/team label and team membership tied to that device.
2. If the app is unavailable, e-mail iletisim@mevvsoft.com with the subject “Trovixa — Data Deletion Request”. State that the request is for Trovixa and include the anonymous device ID only if it is available. Never e-mail the long cloud secret. We may provide an in-app verification step before erasure.

Deleted data cannot be recovered. Aggregate telemetry has no device identifier and therefore cannot be linked back to or selectively deleted for one player. Support correspondence and Free-edition store/processor records may be retained only for applicable legal, tax, security or dispute periods; after those periods they are deleted or anonymized. A deletion request does not delete local progress on another device unless you also remove the app data there.

To exercise these rights, e-mail iletisim@mevvsoft.com with the subject "Trovixa — Data Request". We may ask you to verify control of the anonymous save from inside the app; never send your long cloud secret by e-mail. We respond within the period required by applicable law.

12. Security

Cloud traffic is encrypted in transit with HTTPS/TLS. Long-lived save credentials are stored as one-way hashes; the short-lived transfer grant is encrypted at rest with AES-256-GCM and retained only until its 10-minute expiry or first use. Production access is limited to authorized personnel. No transmission or storage method is completely secure, but we apply reasonable industry measures.

13. International Transfers

Your data may be processed by the third-party providers in §5 on servers located outside your country (including the EU/EEA, UK, USA and Türkiye). Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses or your explicit consent.

14. Changes to This Policy

We may update this policy from time to time. The latest version is always available at this URL. Material changes will be reflected in the "Last updated" date above.

15. Contact

For questions regarding this policy or your data in Trovixa:
Mev E-Ticaret Limited Company
Authorized person: Ali Dayan
E-mail: iletisim@mevvsoft.com
Phone: +90 532 134 35 42
Address: Fenerbahçe Mah. İğrip Sok. No:13 Kadıköy / İstanbul 34726