Privacy Policy
Effective September 28, 2026. The Russian version of this policy prevails in case of discrepancy.
1. Who we are
The data controller is Vladimir Katenin (self-employed), taxpayer ID (INN) 773771850175, Moscow, Russia ("we", the Tinkerlight studio). Contact for privacy matters: support@tinkerlight.ru.
This policy covers the mobile game Purti (the "Game") and the website tinkerlight.ru. It is written under Russian Federal Law No. 152-FZ "On Personal Data" and also addresses the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA) and the US Children's Online Privacy Protection Act (COPPA).
2. What data we process
The Game does not need your name, phone number, email or documents, and does not ask for them.
| Data | Source | Purpose |
|---|---|---|
| Player identifier: a random code created by the Game on your device and kept in the iOS Keychain so the account survives reinstalling. The server only stores its hash | Game | Recognise your account when you connect |
| Apple ID identifier (if you choose "Continue with Apple"): a random code issued by Apple. We do not request your name or e-mail | Apple | Restore your account on a new device |
| Nickname and chosen avatar | You | Show you to other players at the table, in friends and in the rating |
| Game progress: coins, crystals, items, level, game statistics, quests, achievements, rating, friends and friend requests | Game | Operating the Game |
| Moves and in-game emotes (preset phrases and emoji) during a match | You | Running the match. There is no free-text chat |
| Purchase confirmation (App Store receipt: product, transaction ID, date) | Apple | Deliver and restore purchases. Card and payment details go to Apple only; we never see them |
| IP address and connection time | Device | Establish the connection and protect against attacks. Kept only in technical logs for up to 30 days |
| Advertising identifier (IDFA), device model and settings, language, approximate location derived from IP, ad impression data | Yandex ads SDK | Serving ads, counting impressions, fraud prevention. The IDFA is shared only if you allow tracking in the iOS prompt |
The website tinkerlight.ru uses no cookies, analytics or third-party scripts. The web server may keep technical logs with IP addresses for up to 30 days to protect against attacks.
3. Legal bases and consent
- Running the Game, your account and purchases: performance of the Terms of Use you accept (Art. 6(1)(b) GDPR; Art. 6(1)(5) of 152-FZ).
- Security, anti-cheat and fraud prevention: our legitimate interest (Art. 6(1)(f) GDPR) and performance of the Terms.
- Personalised advertising: your consent. On iOS the system asks for permission to track (App Tracking Transparency); in the EEA, the UK and Switzerland the Game also asks for consent to interest-based ads. Without consent you see non-personalised ads. You can withdraw consent in iOS Settings (Privacy → Tracking) or in the Game settings.
4. Who receives data
We do not sell personal data. Data is shared only with parties the Game cannot work without:
- Yandex LLC (Russia) — the Yandex Mobile Ads network and its AppMetrica component, under the Yandex privacy policy. If we add other ad networks, we will list them here.
- Apple — purchases are processed by the App Store under Apple's privacy policy.
- Our hosting provider (FirstVDS LLC, servers in Moscow) — stores data on our servers on our behalf and does not use it for its own purposes.
- Public authorities — only when required by law.
Other players see your nickname, avatar, rating and game statistics at the table and in the rating.
5. Where and how long data is stored
The Game's databases are located on servers in Moscow, Russia. If you play from another country, your data is transferred to our servers in Russia. For users in the EEA and the UK, Russia does not have an adequacy decision; the transfer is necessary to provide the Game you request (Art. 49(1)(b) GDPR).
Account data is kept for as long as the account exists and is deleted from the server immediately when you delete the account. Accounts inactive for 3 years may be deleted. Technical logs are kept for up to 30 days.
6. Security
Connections to the server are encrypted (TLS). Player identifiers are stored as hashes, and only we have access to the servers. We collect no more data than the Game needs.
7. Children
The Game is rated 12+ and is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you are a parent and believe your child has given us data, contact us and we will delete the account.
8. Your rights
You may request access to your data, correction, restriction or deletion, a copy in a machine-readable format, object to processing, withdraw consent, and lodge a complaint with a supervisory authority (in Russia, Roskomnadzor; in the EU, your local data protection authority).
- Delete your account in the Game: Settings → Account → Delete account. Data is deleted immediately.
- Send other requests to support@tinkerlight.ru with your in-game nickname. We reply within 10 business days.
California residents (CCPA/CPRA): we do not sell personal information. Data is shared for cross-context behavioural advertising only if you allow tracking; you can opt out at any time in iOS settings. We do not discriminate against users who exercise their rights.
9. Changes
We may update this policy. The new version is published on this page with its date. We will announce material changes in the Game.