Privacy Policy

Merge 23: Ball Merge Puzzle

Türkçe

Effective 8 September 2026 · last updated 18 October 2026 (refunds, full-screen ads between games, more usage statistics, settings that follow your account; 17 October: crash reports and usage statistics, Sparks on our server, reporting and blocking, purchases, messages, notifications)

Who is responsible

Merge 23 is made and published by Merve Uluser, an independent developer based in Türkiye, acting as the data controller for the processing described below.

Privacy questions and requests: privacy@merge23.com.

What stays on your phone

Merge 23 keeps these in your phone's ordinary app storage, and sends none of them anywhere unless a section below says so:

• your best score and one row per finished run — final score, largest ball, when it ended, how many power-ups you used and what they cost;
• lifetime totals (runs, merges, wins, power-ups, largest ball);
• your nickname, which background you chose, and which tutorial cards you have seen;
• a copy of your Sparks balance (the game's currency) and the day you last got the daily gift — the balance itself is kept on our server (see "Sparks");
• a background photo or profile picture you choose. These are picked with the system photo picker, stored in the game's own folder, and never uploaded.

These may be included in a device backup that you control (iCloud or Google backup). Deleting the app removes them.

The global leaderboard

To take part in the global leaderboard, every install signs in to Google Firebase anonymously. That creates a random user ID that is not linked to your name, email or phone number. You don't need to sign in to be on the board: as a guest too, your best score is sent as soon as the game connects, and again each time a run beats it. The game stores this with that ID, and it is shown publicly on the leaderboard:

• your nickname (a generated one until you pick your own or sign in with Apple or Google) and a four-digit tag;
• your best score, the largest ball in that run, when it ended, whether it used a power-up, and whether it reached 23,552;
• whether you play on iOS or Android.

Before a best score goes on the board, our server (Google Cloud Functions, Europe) checks that it is possible: with the score, the game sends how many balls you dropped and how long you played, which are used only for that check and kept in the server's log for 30 days. The server also counts how many scores it accepted from you in the last hour; that count is deleted after two hours.

If you type a nickname yourself, please don't use anything that identifies you. If you sign in with Apple or Google while your nickname is still a generated one, the name they share becomes your nickname and is shown on the leaderboard (see below) — you can change it on your profile at any time.

Profile → Show me on the global board removes your entry from the leaderboard and stops sending scores until you turn it back on. It works for guests and signed-in players alike; for a signed-in player the setting is stored with the account and applies on every phone.

To stop anything but the real game writing to the leaderboard, the app uses Firebase App Check, which asks Apple (App Attest, or DeviceCheck on older devices) or Google (Play Integrity) to confirm that the request comes from a genuine copy of the app on a genuine device. This does not identify you.

Signing in (optional)

You can sign in with Apple or Google from the Profile screen. The game never sees your password. When you do:

• Firebase Authentication stores the email address (with Apple's "Hide My Email", a private relay address) and the name the provider shares, and, for Google, a link to your profile picture. The game downloads that picture to your phone to use as your avatar; it is not uploaded anywhere. Your email and picture never appear on the leaderboard; your email is shown only to you, on your profile. The name does, if you haven't picked a nickname of your own: it becomes your nickname, public on the leaderboard as "Name #tag", until you change it.
• You can connect both Apple and Google to one account, and sign in with either.
• Your run history syncs: each finished run (the same details as on your phone) and your lifetime totals are stored under your account, so they follow you to another phone. Only you can read them. Guests' runs are never synced.
• Your Sparks follow you too: your balance is kept on our server under your player ID (see "Sparks"), so it is the same on every phone you sign in on.
• The nickname you choose and your Show me on the global board setting are stored with your account too (Firebase, Europe), so they follow you to every phone.
• Your game settings follow you as well: sound and vibration, the built-in background you chose and which kinds of notification you have switched on are stored with your account, so they are the same on all your phones. A background photo you choose is never uploaded: it stays on your phone, and only the name of a built-in background is kept with your account.

When an account already has a player

• If the Apple ID or Google account you sign in with already has a Merge 23 player, signing in on this phone makes you that player and adds the runs and Sparks from this phone to it (earned Sparks up to 155, once a day; bought Sparks in full). The higher best score is kept; the account's nickname and tag stay. Your friends and friend requests move to the account, and your friends then see the account's name. The guest you were on this phone is deleted.
• Adding a second sign-in (Apple or Google) that is already another Merge 23 player merges that player into yours: its runs, Sparks, friends, friend requests and friend code are added to your account, and that player and its leaderboard entry are deleted. A small note — the two player IDs and which sign-ins the old player had, nothing else — is kept so that your other phones can ask you to sign in again; it is deleted with your account.
• This can't be undone, but nothing is lost: it is only combined.

Signing out

Your account and everything in it — your leaderboard entry included — stay on our servers, unchanged, and come back when you sign in again, on any phone. Runs not yet saved to the account are uploaded first. The account's runs, stats, Sparks, nickname and profile picture are then removed from the phone, which starts over as a new guest with a new random nickname. Your phone keeps its sound, vibration, background and notification settings as they are.

Friends

Every player, guests too, gets a friend code. Typing someone's code sends them a friend request, which they accept or decline. We store your friend code, the friend requests you send and receive (your nickname and tag, and the code used) and your friend list, on Google Firebase (Europe), under your player ID — not linked to your identity for guests, linked to your account when you are signed in.

• Your friend list is visible only to you. Your friends see your nickname, tag and best score, which are already public on the leaderboard.
• Invites go out through your phone's share sheet, to the app you choose. The game never reads your contacts.
• You can remove a friend or get a new code at any time; a new code stops the old one working and removes the requests still waiting. Deleting your account removes all of it, for you and on your friends' side.

Multiplayer and ghosts

In Multiplayer you play someone else at the same time. While a match lasts, your nickname and tag and your well — where your balls are, your score and your largest ball — are sent to the other player about once a second, through Google Firebase (Europe). A friend's invite goes to that friend only; looking for a random opponent puts your nickname and tag on a short waiting list that other players looking for a match can see, for as long as you look.

• A finished Timed game (or match) of at least half a minute may be kept as a ghost: your nickname, tag and the game second by second (the balls, the score). When nobody is online, another player can race it, and sees that much — never anything else about you. Nothing is kept while Show me on the global board is off.
• Matches are stored under random IDs with the two player IDs; they are not used for advertising or tracking.
• So that a friend isn't invited while you're busy, the game keeps whether you're playing, in a match, on the menu or not in the app, with the time it last said so. Only your friends can see it, and only that — never what you play or your score.
• Deleting your account deletes your ghosts, your place on the waiting list and that status.

Reporting and blocking

You can report another player's name or score and block a player. A report stores your player ID, theirs, the reason you picked and the name, tag and score shown; it is read only by the developer to moderate names and scores and deleted after 90 days (three reports of a name replace it with a generated one). Your block list is private to you and deleted with your account. Reports you made stay until they expire.

Messages

Players can send each other messages in Merge 23. Everyone, including guests, can send quick messages — a fixed set of short phrases and emoji such as "Good game!" — to a friend and to the other player in a Multiplayer match. Friends who are both signed in with Apple or Google can also write to each other in their own words, up to 200 characters. Messages between friends are stored on Firebase servers in Europe, linked to the two friends' player IDs, and kept until they are deleted: Delete chat removes a conversation from your side only (your friend keeps their copy), and deleting your account deletes every message you sent, from every conversation, on both sides. If you stop being friends, no new messages can be sent. Quick messages in a Multiplayer match are stored with the match and deleted automatically with it within a couple of days. Before a written message is delivered, our server checks it automatically: it refuses links, phone numbers and offensive words, and limits how many messages can be sent. We look at a message only when it is reported to us, or when the law requires it: a report contains the reported message, who sent it and who reported it, and is kept for 90 days so we can review it and act on it. You can block a player at any time; blocking stops messages in both directions. Messages are used only to deliver them in the game — never for advertising, analytics or tracking — and are not shared with anyone else. If you allow notifications, a new message is shown on your friend's phone as a notification (see Notifications).

Sparks

Every player's Sparks balance, guests too, is kept on our server (Google Firebase, Europe) under your player ID, so that a modified app can't change it. Only you can read it, and only our server writes it. It holds your balance, how many Sparks you earned today and on which day, when you last got the daily gift and watched a video for Sparks, which ball sizes of each recent run have already paid (kept for three days), your recent spends (kept for three days) and how many Sparks you bought. When a guest signs in to an existing account, its Sparks are set aside for a short time so the account can take them in once.

When you watch the video for Sparks, the app first gets a one-time code from our server and passes it, with your player ID, to Google AdMob. When the video has finished, AdMob sends our server a confirmation signed by Google, and only then are the Sparks added. The code is deleted after two days.

When you last played

For every player, guests too, we keep two timestamps under your player ID on Google Firebase (Europe): when you last opened the game and when you last played it. They are private — not on the leaderboard, not shown to other players — and are used only to see whether players are active, to run and improve the game; never for advertising or tracking. They are not linked to your identity for guests, and linked to your account when you are signed in. They are deleted with your account, and for a guest on request, like the rest of a guest's data.

Notifications

If you allow notifications, the app gives us your phone's notification token from Firebase Cloud Messaging (Google), together with the app's language, your phone's time zone and which kinds of notification you have switched on, stored with your player ID. We use them only to send you the notifications you chose: a friend's message (with the friend's name and the message, or the quick message), a friend request or an accepted one, and a friend's match invite — delivered through Google's Firebase Cloud Messaging and Apple's Push Notification service — and, sometimes, news about the game. Reminders such as the daily gift are scheduled on your phone and send nothing to us. Your time zone is used to keep quiet hours (by default 22:00–09:00). You can switch each kind off in Profile → Notifications, or all of them in your phone's Settings. The token is deleted when you sign out, when you delete your account, when you turn notifications off, when the app is uninstalled (the next time we try to reach it), and in any case 60 days after you last opened the app.

Game settings

Some of the game's settings can change without an app update — which ad units it loads, and which test phones get Google's test ads and a debug log. The game fetches them from Firebase Remote Config (Google). To deliver the right settings, Firebase receives the phone's country and language codes, time zone and operating-system version, the app's identifiers, the version of Firebase's software, and a random Firebase installation ID. These are used only to deliver the settings — never for advertising or tracking — and are not linked to your player ID, your account or your leaderboard entry. Whether your phone is a test phone is checked on the phone itself; nothing about that is sent.

Crash reports and usage statistics

To find and fix problems, the app sends a crash report to Google's Firebase Crashlytics when it crashes or hits an error: what went wrong in the code, the app version, the phone's model and system version, the game mode being played, and a short form of your anonymous player id (its first six characters), so a crash can be matched with a problem you report. It never includes your name, email or nickname. Crash reports are kept for 90 days.

With your consent — in the EEA, the UK and Switzerland, through the "Ad privacy" choices in the app (Profile → Ad privacy), where you can withdraw it at any time — the app also uses Google Analytics for Firebase to count how the game is played: games started and finished, how far they got (score in ranges, largest ball), power-ups used, whether reward videos and full-screen ads played, which screens are opened, sign-ins and sign-outs; whether the Store was opened and how a purchase ended; Sparks earned and spent (by where they came from and what they bought — never your balance); whether notifications are allowed and which kinds are opened or switched off; how often friends, invites, messages, reports and blocks are used — never what was written, nor who with; settings changed (sound, vibration, language, background, the leaderboard switch); and short error codes when something fails. It is tied to a random app-instance id, not to your name, email, nickname or account, and never to your advertising id; Google signals and ad personalisation are off for it. Detailed event data is kept for 14 months.

Google processes both for us (Google Ireland Limited / Google LLC), under Google's data processing terms.

Advertising

The game shows ads from Google AdMob: a banner below the play area, and optional rewarded videos: four power-ups — "Pop", which removes one ball you choose, "Clear the top three", which rescues a run that has overflowed, "No gravity" and "Cosmic Order" — and a video for Sparks on the game-over screen. A rewarded video never plays until you press its button, and you are told what it costs first.

Between games — when you leave the game-over screen — the game may also show a full-screen ad now and then: never while you play, not in your first few games, and only a few times a day. It uses the same data and follows the same choices (Ad privacy, Apple's tracking prompt) as the banner.

To serve those ads, Google may process:

Merge 23 does not ask for location permission, so no GPS or precise location is available to the game or to its ads. How Google handles the data above is described in the Google Privacy Policy and in how Google uses information from apps that use its services.

Your choices about ads

If you are in the European Economic Area, the United Kingdom or Switzerland, the game asks on first launch whether Google may use your data for personalised ads. You can say no and keep playing — you will see non-personalised ads instead. You can change that answer at any time: open your Profile in the game and tap Ad privacy.

On iOS you will also see Apple's tracking prompt. Declining it means the game never receives your IDFA, and ads become non-personalised. The two prompts are independent, and declining either has no effect on the game itself.

Remove ads (an in-app purchase) switches off the banner and the full-screen ads between games. The rewarded videos stay, because they only play when you choose one, so the ad SDK still starts and the consent choices above still apply.

Purchases

If you buy Remove ads or a Sparks pack, you pay Apple (or Google on Android); the store takes the payment, and we never see your card, bank or billing details. Apple and Google handle the payment as sellers, under their own privacy policies. The app sends the store's signed record of the purchase to our server, which checks it with the store's certificates and then gives you what you bought: Sparks are added to your Sparks balance on our server, and Remove ads is kept with your player ID so it can be restored.

If Apple refunds a purchase, we take back what it gave you (the pack's Sparks, never taking your balance below zero, or Remove ads) and mark the purchase record as refunded.

For each purchase we keep the product, the store's transaction ids, the purchase date and whether it was a real or a test (sandbox) purchase, with your player ID — to give you your purchase on another phone or after a reinstall, and to never give a pack twice. When you delete your account, your player ID is removed from these records and your Remove ads and Sparks are deleted; the records themselves, without your player ID, are kept for our accounts.

What Merge 23 does not do

• No performance monitoring, and no notifications unless you allow them.
• No card, bank or billing details — Apple or Google take the payment.
• No access to your contacts — invites go through the share sheet.
• No passwords — sign-in is handled entirely by Apple or Google.
• No uploading of your photos.
• No selling or sharing of personal information for money, and no building of advertising profiles by us. We receive only anonymous, aggregate earnings reports from Google; we never see who saw an ad.

Keeping and deleting your data

• Signed in: open Profile → Delete account. This permanently deletes your account and everything in it: your leaderboard entry, your synced runs and totals, your Sparks (bought ones too), Remove ads, your ghosts, your settings (nickname, board setting, sound and vibration, background, notification choices), your friends (on both sides) and friend codes, your block list, the messages you sent (on both sides), your last-opened and last-played times, and your sign-in for Merge 23 (for Apple, the game also revokes its access to your Apple ID). The copy on this phone goes too: the phone starts over as a new guest.
• Playing as a guest: Show me on the global board on your profile removes your leaderboard entry at any time. Your entry and other data otherwise stay after you delete the app. Write to privacy@merge23.com with your nickname and tag (shown on your profile) and everything will be removed — leaderboard entry, Sparks, friends (on both sides), ghosts, block list and the last-opened and last-played times.
• Some things are kept for a set time whatever you do: reports (90 days), crash reports (90 days), usage statistics (14 months, and only with your consent where it is needed) and purchase records, without your player ID once your account is deleted (see "Purchases").
• Otherwise, data in Firebase is kept for as long as the game runs, so your best score and your history are there when you come back.

Legal bases

Under the GDPR and comparable laws: the leaderboard, sign-in, sync, friends, Multiplayer, messages, Sparks and purchases are provided because you use them (performance of a contract — the game you chose to play); notifications are sent only with your permission, which you can withdraw at any time in your phone's Settings; App Check and the server's score checks protect the leaderboard from abuse, reports and blocks keep names, scores and matches fair, crash reports keep the game working, Remote Config delivers the game's settings, and the last-opened and last-played times help us run and improve the game (legitimate interest); usage statistics (where the law requires it) and personalised advertising rely on your consent, which you can withdraw in Ad privacy; non-personalised advertising funds the free game (legitimate interest).

Who processes data for us

• Google — Firebase Authentication, Cloud Firestore and Cloud Functions (in Europe), App Check, Remote Config, Firebase Crashlytics, Google Analytics for Firebase and Firebase Cloud Messaging; AdMob advertising.
• Apple — Sign in with Apple, App Attest, DeviceCheck and the Apple Push Notification service.

Apple and Google also sell Remove ads and Sparks packs as sellers in their own right, not on our behalf.

Some of this processing, notably Firebase Authentication, Remote Config, Crashlytics, Analytics and AdMob, may take place on servers outside your country, including in the United States, under the safeguards in Google's and Apple's own terms.

Children

Merge 23 is a general-audience game and is not directed to children under 13. It does not knowingly collect personal information from children. If you believe a child has provided personal information through the game, write to privacy@merge23.com and it will be removed.

Your rights

Under the GDPR, the UK GDPR, Türkiye's KVKK and comparable laws you have rights of access, correction, erasure, restriction, objection and portability over your personal data. Most of them you can use yourself: rename yourself on the profile, leave the leaderboard with Show me on the global board, delete your account in the game, or delete the app. For anything else, write to privacy@merge23.com. Requests about advertising data, which Google holds rather than us, should go to Google through the links above. You may also complain to your local data-protection authority — the Kişisel Verileri Koruma Kurumu (KVKK) in Türkiye, or your national authority in the EEA or UK.

This website

merge23.com is a static site. It sets no cookies, runs no scripts and loads nothing from other hosts. The hosting provider (GitHub Pages) keeps ordinary server logs.

Changes to this policy

If the game's data handling changes, this page is updated before that version ships, and the date at the top changes with it.