Magic Staff — Privacy Policy
Diese Seite gibt es noch nicht in Ihrer Sprache. Sie sehen die englische Version.
Last updated: 2026-10-07
This policy explains how the mobile game Magic Staff (Android and iOS) handles personal data. It adds game-specific details to the general Privacy Policy of Qundir. If the two differ, this page wins for the game.
Who is responsible
Lokman Uçar, Türkiye ("I", "me"). Contact: contact@qundir.com. In the game: Profile → Settings → Legal & Support → Contact Support. More details: Business details.
Short version
- You can play as a guest. You never have to give your name, e-mail or phone number.
- I only use data that is needed to run the game, keep it fair and safe, show ads and process purchases.
- I do not sell your data and I do not use it for profiling outside the game.
- You can delete your account inside the game at any time (Profile → Settings → Account → Delete Account). It is deleted immediately.
- The game is for players aged 13 and over.
What data the game uses and why
| Data | Why | Legal basis (GDPR / KVKK) |
|---|---|---|
| Player ID (random account number), a random device ID created by the game, login tokens | Create and keep your account, sign you in, sync your progress | Performance of the contract (Terms of Service) |
| Google or Apple sign-in ID (only if you link your account) | Recover your progress on a new phone. I receive only a technical account ID from Google / Apple, not your e-mail or name | Contract |
| Game data: username you choose, profile picture and gender you pick from preset options, progress, items, currencies, clan, League and ranking entries, server you play on | Run the game, show leaderboards and other players' profiles | Contract |
| Chat messages you send in server or clan chat | Let players talk to each other. Messages pass through an automatic bad-word filter; only the latest messages per channel are kept | Contract; legitimate interest (safety) |
| Reports you send about other players, and reports about you, incl. the reported chat message | Moderation, keeping the community safe | Legitimate interest; legal obligation |
| Block list (players you blocked) | Hide messages from blocked players | Contract |
| Purchase data: product, store transaction ID and receipt from Google Play / App Store | Deliver what you bought, prevent fraud and double use of receipts, tax records | Contract; legal obligation |
| Ad data: advertising ID (GAID/IDFA, only with your consent where required), IP address, device and app information, ad interactions | Show rewarded ads (only when you choose to watch one), confirm that the ad was watched so you get the reward, measure and limit ads | Your consent (EEA/UK/Switzerland, iOS tracking); otherwise legitimate interest |
| Age group (under 13 / 13-15 / 16+) and the date you accepted the terms — stored only on your device. Your year of birth is not stored | Age gate, child-safe ads for 13-15 year olds | Legal obligation |
| Technical data: IP address, device model, operating system, app version, error logs | Connect to the game server, security, fixing bugs | Legitimate interest |
| Support e-mails you send me | Answer you | Your request |
The game does not access your contacts, photos, camera, microphone or precise location.
Who receives data (processors and partners)
- Game server hosting: Hostinger International Ltd. (VPS, data centre in Frankfurt, Germany). Your game account and game data are stored here.
- Google Play (Google Ireland Ltd.) and Apple App Store (Apple Distribution International Ltd.): app distribution, payments, sign-in. I never see your card details.
- Google AdMob and Google User Messaging Platform (Google Ireland Ltd. / Google LLC): rewarded ads and the consent form. Google may use data according to its own policies: How Google uses data from partner apps. Ad partners selected by Google may also receive data when ads are personalised; you can see and change this in the consent form.
- Unity Technologies (game engine): may collect basic technical and crash data about the engine (device model, OS, performance). See Unity Privacy Policy.
- E-mail provider for support e-mails.
- Authorities, only if the law requires it.
Advertising choices
- In the EEA, the UK and Switzerland the game shows Google's consent form before ads. You can change your choice any time in Settings → Privacy → Options.
- On iOS, the game asks for permission to track (App Tracking Transparency). If you say no, ads are not personalised.
- Players aged 13-15 only get non-personalised ads, and all ads are limited to content suitable for teens.
- You can also reset or delete your advertising ID in your phone settings.
- If you buy Remove Ads, no ads are shown.
International transfers
Google, Apple and Unity may process data in countries outside your own (for example the USA). They use EU Standard Contractual Clauses or other legal safeguards. Players in Türkiye: data transfers abroad are made under KVKK Article 9.
How long data is kept
- Account and game data: as long as your account exists. You can delete it any time.
- Chat messages: only the latest messages per channel are kept; older ones are deleted automatically. All your messages are deleted when you delete your account.
- Reports: reviewed and kept up to 12 months for safety, unless needed longer for a legal claim. Reports you filed are deleted with your account.
- Purchase receipts: a minimal record (hashed transaction ID, product, account ID) is kept as long as tax and anti-fraud rules require (up to 10 years).
- Server logs: rotated automatically by size and kept only for a short time (normally days, at most a few weeks).
- Inactive guest accounts: may be deleted after 24 months without any login.
Deleting your data
- In the game: Profile → Settings → Account → Delete Account. Everything is deleted immediately: all characters on all servers, progress, items, currencies, clan membership, League and ranking entries, chat messages and your username. If you signed in with Apple, the Apple sign-in link is revoked too.
- Without the game (for example if you uninstalled it): use the Delete my data page. I delete the account within 30 days.
- Purchases cannot be moved to a new account after deletion.
Your rights
You can ask to access, correct, export or delete your data, object to processing, restrict it, and withdraw consent at any time (it does not affect what happened before). Players in Türkiye have the rights in KVKK Article 11; players in California have the rights under the CCPA/CPRA (I do not sell or share personal data for cross-context behavioural advertising outside the consent you give in the ad form). Write to contact@qundir.com. You can also complain to your data protection authority (in Türkiye: KVKK Kurumu; in the EU: your local authority).
Children
Magic Staff is not made for children under 13. A neutral age screen at the first start blocks players under 13, and I do not knowingly collect their data. If you believe a child under 13 is playing, write to me and I will delete the account.
Security
Connections to the game server are encrypted (HTTPS/TLS). The server decides all game results, accounts are protected by tokens, and only the data needed is stored.
Changes
If this policy changes, I update the date at the top. If the change is important, the game will ask you to read and accept it again.