Legal

Privacy Policy

Last updated: August 24, 2026

Effective Date: January 1, 2026
Last Updated: August 24, 2026

1. Introduction

PF Games ("PF Games", "we", "us", or "our") operates the mobile game Zooyale and related services, including this website and the tester application program (collectively, the "Service"). This Privacy Policy explains how we collect, use, share, and protect your personal information when you use the Service.

This Privacy Policy applies to all users worldwide. Depending on your location, additional rights and obligations may apply under specific laws — see Section 14 (Regional Privacy Rights). Turkish users should also refer to our KVKK Aydınlatma Metni.

By using Zooyale, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

Controller: PF Games Yazılım Teknolojileri Anonim Şirketi ("PF Games")
Trade Register: Ankara Trade Registry, Reg. No. 497566 — MERSIS 0729127584000001
Tax Office / VKN: İvedik Tax Office / 7291275840
Website: https://pfgames.io
Email: info@pfgames.io
Postal address: İvedikosb Mah. 2224 Cad. No: 1 İç Kapı No: 116, Yenimahalle / Ankara, Türkiye

3. Information We Collect

We collect the following categories of personal information:

3.1. Account & Identity Information

In-game username / nickname (auto-generated and editable)
Unity Authentication PlayerId (anonymous identifier minted by Unity Gaming Services)
Third-party platform identifiers — Apple Game Center player ID (iOS) or Google Play Games player ID (Android), only if you choose to link your account to that provider
Age range or date of birth (for age verification only — collected only if you trigger an age gate)
Profile picture or avatar (selected from an in-app catalog; no user-uploaded photos)
For tester applicants: name, email address and the optional profile fields you choose to provide on the application form (country, age range, platforms, hours available, gaming background, free-text answers)
For feedback submitted through the feedback form: the category, summary and description you write, plus any optional context you choose to add (in-game nickname, platform, device model, game version, affected hero). An email address is optional on that form — leave it blank and the report is stored without any way to identify you

Note: Zooyale signs you in anonymously by default; we do not collect an email address or password during sign-up. Facebook login is not supported.

3.2. Gameplay Data

Progress, levels, experience points
Character / mutant selections and stats
Match history and performance metrics (KDA, kills, damage dealt, placement, survival time, win/loss)
Virtual items, cosmetics, and in-game currency balances (COIN, GEM)
Achievements and leaderboard rankings
Friends list, team / lobby memberships (via Unity Friends Service)
Voice chat metadata via Unity Vivox, when voice chat is enabled — channel participation (lobby / team / proximity), local mute/volume preferences, push-to-talk events. Voice audio itself is transported in real time by Vivox and is not stored on PF Games servers.
Reports filed by you or against you (moderation records)

Note: Zooyale does not provide a free-text in-game chat feature. Voice chat (Vivox) is the only direct player-to-player communication channel, and it may not be enabled in the initial release; where it is unavailable, the voice-related processing described in this Policy does not occur until the feature is activated.

3.3. Device & Technical Information

Device model, manufacturer, and hardware specs (CPU cores, RAM, GPU model, screen resolution)
Operating system and version (iOS, Android)
Firebase Cloud Messaging (FCM) push notification token — registered if you accept notification permission
IP address (server access logs only; not retained beyond operational log windows) and approximate region derived from it — no precise GPS coordinates are collected
Language and locale settings
Game version, build number, and graphics API in use
Crash logs, exception stack traces, error reports
Performance metrics — FPS samples, ping, quality-tier changes, scene load times
For tester applicants and feedback submissions: browser user-agent string and a salted, daily-rotating hash of your IP address used only for spam / abuse detection. Feedback submissions additionally store an approximate country derived from the IP at the time of submission; the address itself is not written to our database

Note: Zooyale uses advertising identifiers for advertising measurement. On iOS we ask for your permission through the system App Tracking Transparency (ATT) prompt shortly after launch; the advertising identifier (IDFA) is used only if you allow it, and if you decline we fall back to Apple's privacy-preserving SKAdNetwork, which reports installs to us in aggregate without identifying you. On Android we may read the Google advertising ID (GAID), subject to the analytics consent described in Section 3.4 and to your own "Delete advertising ID" / "Opt out of Ads Personalisation" setting. See Section 3.8 for exactly what we share and with whom.

3.4. Analytics & Behavioral Data

Collected via our proprietary analytics platform (PF Games Analytics, hosted at analytics.pfgames.io). Analytics is enabled by default and you can turn it off at any time from the in-game Settings ("Share gameplay data"); when it is off, nothing in this section is collected. This analytics data is pseudonymous — it is linked to your in-game account identifier (Unity Authentication PlayerId) rather than being fully anonymous:

Session start / end / duration
Match lifecycle events (start, end, leave, win/lose, reconnect attempts)
In-game position snapshots in map coordinates (X/Z) — used to build heatmaps; not real-world GPS
Matchmaking funnel (wait time, mode, team size, outcome)
Account-link funnel (attempted, succeeded, switched, declined, unlink)
Account-deletion funnel (requested, attempted, outcome)
Currency balance changes (COIN, GEM)
Version-gate prompt outcomes
FPS spike detection and auto quality-tier downgrades

You can turn analytics off at any time from the in-game Settings (the "Share gameplay data" toggle). When you turn it off, the analytics events already collected during your current session — together with a record that you opted out — are sent one final time, and we then stop collecting. After that, no new analytics or crash data is collected or transmitted, and the local event queue is cleared.

3.5. Purchase & Transaction Data

Zooyale offers in-app purchases through the in-game Shop. The purchasable items are consumable GEM packs (60, 340, 750, 1,600, 4,300 and 9,200 GEM). There are no subscriptions and no loot boxes or randomized reward purchases — every purchase delivers a fixed, known quantity of GEM. When you make a purchase, we collect:

Purchase history (item, amount, date)
Transaction amount and currency
Platform store transaction IDs (Apple App Store, Google Play)
We do NOT collect or store credit card or bank account information. All payment processing is handled directly by Apple or Google. We only receive the purchase confirmation and the transaction details listed above.

Purchases are validated server-side: the store receipt is verified and your currency balance is granted through Unity Gaming Services (Economy and Cloud Code). Your balances are held on our servers rather than on your device.

Refunds for in-app purchases are handled by Apple and Google under their own store policies; PF Games does not process payments or refunds directly. Refund requests must be submitted to the store you purchased from.

Virtual currencies. Zooyale uses two virtual currencies: GEM, which can be purchased with real money or earned in game, and COIN, which can only be earned in game. GEM can be spent on COIN and on cosmetic skins. Virtual currencies and virtual items are a limited license to use in-game content — they have no monetary value, cannot be exchanged for real money or transferred outside the Service, are non-refundable by PF Games, and are tied to your account and stored on our servers.

3.6. Support & Communication Data

Support tickets and correspondence
Email communications
Survey responses (voluntary)

3.7. User-Generated Content (UGC)

Usernames you choose / edit (subject to a profanity filter)
Real-time voice chat audio over Unity Vivox (lobby, team, and proximity channels), where voice chat is enabled — transported in real time, not recorded by PF Games
Any text you submit through support / report flows, tester applications, or the feedback form

3.8. Advertising Attribution & Campaign Measurement

We advertise Zooyale on Meta (Facebook and Instagram) and on TikTok. To understand which campaigns actually bring players to the game — and to avoid paying for advertising that does not work — we integrate the Meta SDK and the TikTok Business SDK. These SDKs are used exclusively for measurement and attribution. Zooyale shows no third-party advertisements, has no ad units, and we do not sell or license your data to advertising networks or data brokers.

When this processing is active, the following is shared with Meta Platforms and with TikTok:

The advertising identifier of your device (IDFA on iOS, only where you granted ATT permission; GAID on Android) and standard device and installation signals used to match an install to an ad
A pseudonymous account identifier (your Unity Authentication PlayerId), used to improve attribution matching — we never send your email address, phone number, or name, because we do not collect them
App events describing milestones rather than content: first launch, registration, tutorial completion, level reached, shop item viewed, checkout started, purchase completed (item, amount and currency), in-game currency spent, achievement unlocked, and rating submitted
On Android, the Google Play Install Referrer value that carries our own campaign parameters

The following is never shared with Meta or TikTok: your gameplay position data, match history, voice chat, friends list, support tickets, feedback submissions, moderation records, or crash logs.

This processing is subject to the same consent control as analytics (Section 3.4): if you turn off "Share gameplay data" in the in-game Settings, both SDKs stop. Purchases flagged as store test transactions are never reported to Meta or TikTok. We additionally operate a remote kill switch for each SDK, which lets us disable them entirely without shipping an app update.

Meta and TikTok act as independent controllers for the data they receive. Their handling is governed by their own policies: Meta Privacy Policy and TikTok Business Products Privacy Policy. We cannot delete data from their systems on your behalf; requests must be made to them directly, using the links in Section 15.

4. How We Collect Information

Directly from you when you create an account, fill profile fields, contact support, submit a tester application, send us feedback through the feedback form, or make purchases.
Automatically as you use the Service (gameplay events, device data, analytics).
From third parties such as Apple (Game Center) or Google (Play Games) when you choose to link your account, from Unity Gaming Services (Authentication, Cloud Save, Friends, etc.), and from anti-cheat or fraud-prevention services.

5. Why We Process Your Data (Purposes and Legal Bases)

Purpose	Legal Basis (GDPR Art. 6)
Create and manage your account	Contract performance
Provide and maintain the Service	Contract performance
Matchmaking and game sessions	Contract performance
Process in-game purchases	Contract performance, legal obligation
Evaluate tester applications	Consent, legitimate interest
Customer support	Legitimate interest
Fraud, cheating, and abuse prevention	Legitimate interest, legal obligation
Service improvement and bug fixing	Legitimate interest
Review and act on feedback you submit	Consent, legitimate interest
Security and integrity	Legitimate interest, legal obligation
Comply with legal obligations	Legal obligation
Marketing communications	Consent
Personalized content & offers	Consent
Aggregated/anonymized analytics	Legitimate interest
Advertising attribution and campaign measurement (Meta, TikTok)	Consent
Reading the device advertising identifier (IDFA / GAID)	Consent

6. How We Share Your Data

We do not sell your personal information. We share data only in the following circumstances:

6.1. Service Providers (Processors)

We use trusted vendors for:

Cloud infrastructure and hosting (CDN, game servers, Addressables asset delivery)
Unity Gaming Services — Authentication, Cloud Save, Economy, Friends, Multiplayer, Leaderboards, Cloud Code, Remote Config
Unity Vivox — real-time voice chat
Google Firebase Cloud Messaging — push notification delivery
Our proprietary analytics (PF Games Analytics at analytics.pfgames.io) — telemetry, crash reporting
Customer support tools
Email delivery
Anti-cheat and fraud detection
Meta Platforms — advertising attribution and campaign measurement (independent controller, not a processor)
TikTok (ByteDance) — advertising attribution and campaign measurement (independent controller, not a processor)

These providers process data on our behalf under written contracts.

6.2. Platform Providers

Apple — App Store, Apple Game Center (only if you choose to link your account)
Google — Google Play, Google Play Games (only if you choose to link your account), Firebase Cloud Messaging

We do not integrate Facebook / Meta login, Facebook Share, or any social login through these providers, and Zooyale displays no third-party advertisements. We do integrate the Meta and TikTok measurement SDKs so that we can tell which of our own advertising campaigns brought players to the game — see Section 3.8 and Section 6.1.

6.3. Legal Requirements

We may disclose data:

To comply with court orders, subpoenas, or legal requests
To protect our rights, safety, and property
In response to lawful government requests
To investigate fraud, abuse, or violations of our Terms

6.4. Business Transfers

If PF Games is involved in a merger, acquisition, or asset sale, your data may be transferred. You will be notified before any such transfer changes how your data is handled.

6.5. With Your Consent

For any other purpose disclosed to you with your consent.

7. International Data Transfers

We may transfer, store, and process your information in countries other than your own, including Türkiye, the European Union, the United States, and other regions where our service providers operate.

For transfers out of the EEA, UK, or Switzerland, we rely on:

Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions where applicable
Other lawful mechanisms under GDPR Chapter V

For users in Türkiye, transfers comply with KVKK Article 9 (see KVKK Aydınlatma Metni for details).

8. Data Retention

We retain personal data only as long as necessary:

Data Category	Retention Period
Active account data (Unity Cloud Save — profile, progression, match history)	While account is active
Inactive account data	3 years after last activity
In-app purchase (IAP) records	10 years (tax law)
Voice chat audio (Vivox)	Not stored — real-time transport only
Report / moderation logs	90 days
Crash logs and diagnostics	90 days
Analytics events	24 months, then anonymized
Push notification tokens (FCM)	Until invalidated by the OS or until account deletion
Support tickets	2 years after closure
Anti-cheat / ban records	5 years
Marketing consent records	Until consent withdrawn
Tester application data	Programme closed in August 2026 — 12 months from closure
Feedback form submissions	3 years, or until the report is closed + 12 months, whichever is shorter
Advertising attribution events shared with Meta / TikTok	Held by Meta and TikTok under their own retention policies; PF Games keeps no separate copy beyond the analytics retention above

After retention periods expire, data is deleted, anonymized, or destroyed.

9. Account Deletion

You have the right to delete your account and associated personal data at any time:

In-app: Settings → Account → Delete Account
Web: zooyale.com/account-deletion
Email: Send a deletion request to info@pfgames.io

Upon deletion:

Your current Unity Authentication PlayerId is signed out and your session is invalidated
If your account is linked to Apple Game Center or Google Play Games, that link is automatically removed
Cloud Save data (profile, progression, image ID) is archived and then deleted — the short-lived archive exists only for support / audit purposes and is destroyed thereafter
Personal data is deleted or anonymized within 30 days
Virtual items, currency (COIN, GEM), and progress are permanently lost and cannot be restored
Records required by law (IAP / purchase records, ban records, tax-required data) are retained per Section 8
Aggregated / anonymized analytics may be retained
A fresh anonymous session is created on the device so you can start over; uninstalling the app fully clears local data

Account deletion is irreversible.

10. Children's Privacy

Zooyale is rated 13+ on the App Store (12+ or 16+ in some countries or regions) and is intended for players who are at least 13 years old. The Service is not directed at children under 13 (or the higher minimum age set by your country or jurisdiction).

We do not knowingly collect personal information from children under the applicable minimum age.
If you are a parent or guardian and believe your child has provided us with personal information, please contact info@pfgames.io and we will delete it.
For users below the age of digital consent in their jurisdiction (for example, 13 in the United States under COPPA, or up to 16 in some EU member states under GDPR-K), verifiable parental or guardian consent is required, and certain features (voice chat, social interaction, purchases) may be restricted.
In-app purchases: where a user is below the age of digital consent in their jurisdiction, in-app purchases are subject to parental or guardian consent. Parents and guardians can restrict or disable purchases entirely using the platform's own controls — Apple "Ask to Buy" and Screen Time restrictions on iOS, and Google Play family approval and purchase authentication settings on Android. All payments are processed by Apple or Google, so these platform controls apply to every purchase made in Zooyale.

For California users, we comply with the California Consumer Privacy Act (CCPA) requirements for minors under 16.

11. Data Security

We use technical and organizational measures to protect your data:

TLS/SSL encryption in transit
Encryption of sensitive data at rest
Access controls and authentication
Regular security audits and penetration testing
Backup and disaster recovery
Employee confidentiality agreements
Incident response plan

No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Data Breach Notification: In the event of a data breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law (within 72 hours under GDPR).

12. Your Privacy Choices and Controls

You can manage your privacy through:

In-game settings: Update your username and avatar, toggle push notifications (Settings → Push Alarm), withdraw analytics consent (Settings → Share gameplay data), and request account deletion (Settings → Account).
Microphone permission (iOS / Android): Requested only if and when voice chat is enabled and you first join a voice-chat-enabled lobby. Revoke any time via your OS settings; voice chat will remain receive-only.
Notification permission (iOS / Android 13+): Toggle from your OS notification settings or the in-game Settings → Push Alarm toggle.
Account link / unlink: Settings → Account lets you link or remove an Apple Game Center / Google Play Games connection without losing in-game progress.
Marketing emails: Unsubscribe link in every email (if and when sent).
Friend & social settings: Control visibility, friend requests, and per-player mute / volume in voice chat.
App Tracking Transparency (iOS): Decline the prompt, or change your answer any time in Settings → Privacy & Security → Tracking. Declining stops IDFA-based attribution; campaign measurement then relies on Apple's aggregated SKAdNetwork only.
Advertising ID (Android): Reset or delete it in Settings → Google → Ads. Deleting it stops GAID-based attribution.
Advertising measurement opt-out: The in-game "Share gameplay data" toggle (Settings → Share gameplay data) turns off the Meta and TikTok SDKs together with analytics. On iOS this takes effect immediately. On Android, some automatic session events may continue until the app is next restarted, after which the SDKs are not initialised at all.

13. Tracking Technologies

We use limited tracking technologies in our mobile app:

SDKs for first-party analytics and crash reporting (gated on your consent)
Third-party measurement SDKs from Meta and TikTok, used only for advertising attribution and campaign measurement (gated on the same consent, and on your ATT choice on iOS)
Local storage (Unity PlayerPrefs and Addressables cache) on your device for settings, downloaded assets, and progress
Push notification token issued by Firebase Cloud Messaging (only if you accept the notification permission)

We do not use traditional web cookies in the mobile app itself, and we do not show third-party advertisements inside the game. We do use advertising identifiers (IDFA on iOS, subject to your ATT choice; GAID on Android) and the Meta and TikTok measurement SDKs, strictly to measure the performance of our own advertising campaigns — never to display ads to you inside Zooyale and never to build advertising profiles for other companies' products. Both SDKs are covered by the same in-game consent toggle described in Section 3.4, and each can be disabled remotely by us without an app update.

13.1. Cookies on this website

This website uses Google Analytics 4 to measure general visitor activity — such as pages viewed, approximate region, device and browser type, and basic on-page interactions — so we can understand traffic and improve the site. We use this for website analytics only: we do not run advertising, ad personalization, or cross-site profiling, and analytics data is not used to identify you personally.

Analytics cookies (such as _ga and _ga_*) are set only after you accept via the consent banner shown on your first visit. We operate Google Consent Mode, so analytics storage is denied by default and no analytics cookies are written until you opt in. You can change or withdraw your choice at any time through the "Cookie Preferences" link in the site footer. Google Analytics data is processed by Google LLC; for details see Google's Privacy Policy and how Google uses cookies.

13.2. YouTube trailer on this website

The Zooyale trailer on our home page is hosted on YouTube (Google LLC / Google Ireland Limited) and is embedded in click-to-play form. Until you press the play button, the page shows only a still image served from our own server, and no request of any kind is made to YouTube or Google — no cookies, no browser storage, and your IP address is not disclosed to them.

If you press play, the player is loaded from youtube-nocookie.com, Google's privacy-enhanced embed domain. From that point Google receives your IP address, the address of the page you played the video from, and basic device and browser information, and may write entries in your browser's storage that are needed to play the video and count the view. Google acts as an independent controller for that processing and we cannot delete those records on your behalf — such requests must go to Google directly. YouTube sends us no personal data in return: if you have accepted analytics, our own Google Analytics property records only an anonymous "trailer played" event.

Whether to load the player is entirely your decision, and that click is the legal basis (consent) for the processing described above. If you would rather not contact Google at all, simply do not press play — the rest of the page works normally. For details on Google's processing see Google's Privacy Policy.

14. Regional Privacy Rights

14.1. European Economic Area (EEA), United Kingdom & Switzerland — GDPR / UK GDPR

You have the following rights:

Right to access (Art. 15) — request a copy of your data
Right to rectification (Art. 16) — correct inaccurate data
Right to erasure / "right to be forgotten" (Art. 17)
Right to restriction of processing (Art. 18)
Right to data portability (Art. 20)
Right to object (Art. 21) — including objection to direct marketing
Right to withdraw consent at any time
Right to lodge a complaint with your national data protection authority

To exercise these rights, contact info@pfgames.io. We will respond within one month.

14.2. California, USA — CCPA / CPRA

California residents have the right to:

Know what personal information is collected, used, shared, or sold
Delete personal information
Correct inaccurate personal information
Opt out of the "sale" or "sharing" of personal information. We do not sell personal information for money. However, sharing advertising identifiers and app-event data with Meta and TikTok for advertising measurement is treated as "sharing" for cross-context behavioral advertising under the CPRA. You can opt out at any time by turning off "Share gameplay data" in the in-game Settings, and on iOS by declining or later revoking the App Tracking Transparency permission in your device settings.
Limit use of sensitive personal information
Non-discrimination for exercising rights

To exercise these rights, submit the Privacy Requests form or email info@pfgames.io.

We do not sell your personal information for monetary consideration. We do not have actual knowledge of selling or sharing the personal information of minors under 16.

14.3. Türkiye — KVKK (Law No. 6698)

For users in Türkiye, please refer to our separate KVKK Aydınlatma Metni (KVKK Information Notice). It contains specific information about your rights under KVKK Article 11, our application process, and the Turkish Data Protection Authority contact details.

14.4. Brazil — LGPD (Law No. 13.709/2018)

Brazilian users have rights similar to GDPR including access, correction, deletion, portability, and information about data sharing. Contact info@pfgames.io to exercise these rights. The data controller for purposes of LGPD is PF Games. Our Data Protection Officer (DPO) can be contacted at info@pfgames.io.

14.5. Other Jurisdictions

If you reside in a jurisdiction with applicable privacy laws (e.g., PIPEDA in Canada, PIPL in China, PIPA in South Korea, APPI in Japan, POPIA in South Africa, Australian Privacy Act, India DPDP Act), please contact us to exercise your rights under local law.

15. Third-Party Services

Our Service integrates with the following third-party services, each governed by its own privacy policy:

Apple: apple.com/legal/privacy — App Store, Apple Game Center (linking optional)
Google: policies.google.com/privacy — Google Play, Google Play Games (linking optional), Firebase Cloud Messaging, Google Analytics (this website, consent-gated), YouTube (trailer embed on this website, loaded only when you press play — see Section 13.2)
Unity Technologies (Unity Gaming Services & Vivox): unity.com/legal/game-player-and-app-user-privacy-policy — Authentication, Cloud Save, Economy, Friends, Multiplayer, Leaderboards, voice chat
Meta Platforms: facebook.com/privacy/policy — advertising attribution and campaign measurement (Meta SDK)
TikTok (ByteDance): ads.tiktok.com/i18n/official/policy/business-products — advertising attribution and campaign measurement (TikTok Business SDK)

We are not responsible for the privacy practices of these third parties.

16. Changes to This Privacy Policy

We may update this Privacy Policy. Material changes will be communicated through:

In-game notification
Email to your registered address (if available)
Notice on our website
Updating the "Last Updated" date at the top

For material changes affecting how we process your data, we will provide at least 15 days' advance notice. Continued use of the Service after the effective date constitutes acceptance.

17. Contact Us

General Privacy Inquiries:
Email: info@pfgames.io
Website: https://pfgames.io
Postal: PF Games Yazılım Teknolojileri A.Ş., İvedikosb Mah. 2224 Cad. No: 1 İç Kapı No: 116, Yenimahalle / Ankara, Türkiye

Data Protection Officer (if appointed): info@pfgames.io

KVKK-specific requests (Türkiye): See KVKK Aydınlatma Metni.

This Privacy Policy is published in English as the master version. Translations into other languages are provided for convenience. In case of inconsistency, the English version prevails, except where local law requires otherwise (e.g., KVKK matters governed by the Turkish-language document).