Tiny Turns — Privacy Policy

Your races stay yours. Here is what the app sends.

Tiny Turns is a racing game with local career progress and a developer opponent. It has no advertising or online multiplayer. Its Global Records feature uses a Unity Gaming Services account linked to Game Center on iPhone or Google Play Games on Android. The game also sends product-usage information to TelemetryDeck and technical diagnostics to Sentry, lets you voluntarily send written feedback through Sentry, uses Apple or Google Play together with RevenueCat for its optional one-time in-app purchase, and can check Apple for an app update on iPhone. This policy explains those activities without treating “offline” as a promise that nothing leaves your phone.

Last revised: 26 September 2026 · Mobile release

The essentials

• Your career save and game settings live on your phone. Tiny Turns does not currently sync them to another device.
• Global Records uses Unity Authentication, Cloud Code, Cloud Save and Leaderboards. It creates a Unity player ID, links it to Game Center or Google Play Games, generates a public racer tag, and submits eligible race evidence and verified times.
• TelemetryDeck receives pseudonymous usage events, including race performance and device information.
• Sentry receives error, crash, hang, session, and sampled performance information. If you choose Send Feedback, it also receives the message you entered and limited game context.
• Apple or Google Play processes the optional store purchase on that platform. RevenueCat receives an anonymous app-user identifier and purchase/entitlement information so the game can verify and restore it.
• Apple receives requests for the public store listing when the app checks for updates.
• We do not use advertising identifiers, cross-app advertising tracking, session replay, or advertising networks.
• There is no email/password login, recurring subscription, chat, or user-written public profile. The optional Unlock All Tracks product is a one-time purchase.
• You can contact us about your personal data at tinyturns@visoolabs.com.

1. Who is responsible

The operator and data controller is Visoo Labs, Tina Panzalović s.p., Breznica 12, 4274 Žirovnica, Slovenia. “We” and “us” refer to that operator. Tiny Turns uses the bundle identifier com.visoolabs.tinyturns.

We determine the purposes of the app’s analytics and diagnostic processing. Providers may act as processors on our behalf and, for their own security, legal, or service-administration purposes, as independent controllers. Apple also processes information under its own policies when you use the App Store or Apple device services.

Privacy and support contact: tinyturns@visoolabs.com.

2. Information stored on your phone

Tiny Turns stores settings such as sound, vibration, driving hand, and introduction progress. Its career save contains a locally generated profile ID, race-attempt IDs and dates, selected cars and tracks, lap and heat times, results, crashes, stars, unlocked content, achievements, and the rule and handling versions relevant to those results.

The app keeps a local backup to help recover from some damaged-save situations. It also stores the time of its last update check and reminder, and the version for which a reminder was shown. Global Records stores a bounded queue of eligible runs awaiting verification, a Unity Authentication session token, and cached leaderboard pages so previously viewed results can remain available offline. These values avoid losing an eligible result, repeated sign-in, or repeated update prompts.

The optional personal ghost uses a locally saved visual trace of your fastest complete compatible heat, separately for each heat position, track and car. A trace contains timing, distance along the lane, and visual derail/recovery offsets, together with track, handling and rules compatibility information. Ghost traces and their backup files remain on your device; the game does not upload them as analytics or share them with other players. Ghost and CPU visibility preferences are stored locally. The ghost is available without a purchase and starts enabled on a new installation; you can switch it off in Settings. A matching saved heat is needed before playback appears. Completed heats can still improve your local ghost for later use.

There is no Tiny Turns email/password account or iCloud/CloudKit career synchronization in this release. The Unity Gaming Services account used for Global Records does not sync your career save. We do not upload the complete career-save file to a game server. Some information about your races is nevertheless sent for leaderboards and analytics, as described next. Your operating system may back up app data under your device and store-account settings; that backup service is separate from a Tiny Turns sync feature.

3. Product analytics through TelemetryDeck

We use TelemetryDeck to understand how people use the game and where its controls, progression, or rival balance need work. The app generates a random installation identifier, combines it with the app identifier, and hashes the result before sending it as an app-scoped identifier. Each app session also has a generated session ID. These are not your name or Apple account ID, but they can distinguish activity from an installation and should be treated as pseudonymous information, not as guaranteed anonymous data.

Events can include:

• App version, build, current screen, session timing, background/foreground changes, language, and low-memory events.
• Device model, operating system, memory and graphics information, processor count, and screen resolution.
• Menu navigation, track selection, tutorial activity, settings changes, and race starts, retries, pauses, or exits.
• Custom-paywall views and duration, entry screen/track/cup, and whether purchase or restore was started, completed, cancelled, unavailable, or failed. Completion includes product ID, store currency, numerical price and sandbox status, but not card details or an Apple Account email.
• Track and car IDs, race format, lap/heat/match times, finishes and DNFs, stars earned, crash counts, throttle use, and input-press counts.
• Corner-warning and derailment speeds, recovery duration, and a coarse section of the track where an event occurred.
• Player-versus-CPU time differences, waiting time, rival tuning, and an experience category derived from prior play, to evaluate game balance.
• A categorical report that saving failed. The analytics event does not include the complete save file or free-form error text.

This is event-based reporting, not a recording of every frame or every movement. The track section is a position in the fictional circuit, not your physical location. We do not send names, email addresses, contact lists, advertising IDs, or user-entered text in these product events.

Events can wait in a bounded local queue while the phone is offline and be transmitted later. The current queue holds up to 256 events; older events are dropped when it fills. Transmission uses HTTPS. Successful delivery removes the sent items from the local queue; some unrecoverable request errors also cause items to be discarded.

As with other internet services, the receiving provider and its delivery infrastructure can see connection metadata, including your IP address and ordinary HTTP request information. The app does not add a physical-location field to these events. Provider-side processing of connection information must also be covered by the confirmed provider arrangements below.

TelemetryDeck GmbH, Augsburg, Germany, processes these events. TelemetryDeck says its analytics infrastructure is in the EU and that it does not store the IP address used to deliver an event. Its privacy FAQ also says cold-storage events have no guaranteed deletion schedule. Our custom event fields are described here because choosing a privacy-focused provider does not, by itself, make every event anonymous. See also TelemetryDeck’s privacy information.

4. Crash and performance information through Sentry

Sentry, operated by Functional Software, Inc., helps us investigate failures and slow operations. The configured Unity SDK captures managed exceptions, error logs, native iOS crashes, app hangs, and session information. Startup and scene-loading performance traces are sampled at 10%.

Reports can contain stack traces, error messages, recent diagnostic breadcrumbs, app/build information, device and operating-system details, session or diagnostic identifiers, and performance measurements. Diagnostic messages may include technical file paths or other context necessary to investigate a fault. We do not attach your full career save or intentionally add personal contact details to these reports.

Sentry and its delivery infrastructure also receive the network metadata needed to accept a report. Where a network failure is captured by an SDK integration, diagnostics can contain request-related technical context such as a service URL or response status; that is different from granting access to your browsing history.

Screenshots, view-hierarchy capture, structured logging, game metrics, and the SDK’s default-PII option are disabled in our current configuration. Turning off default PII does not mean that error messages or all diagnostic fields can never contain personal data. We review what the app adds to reports and should not receive sensitive information through normal gameplay.

After you newly complete a fourth different career track, the game can show a one-time feedback form over the result screen. Repeated tracks, incomplete matches and DNFs do not count toward that milestone. The form sends only when you tap Send Feedback; closing it or tapping No Thanks does not send its text. A submission contains the text you chose to enter, current fictional track ID, distinct-track completion count, app version and build identity, together with Sentry's normal app, device and network context. The form does not request or send your name or email address and explicitly attaches no screenshot. Please do not include personal or sensitive information in the message. Because connection and device context can still be processed, we do not claim the submission is technically anonymous.

The SDK may cache up to 30 events on the device for later delivery. For its handling of diagnostics and related technical information, see Sentry’s privacy policy.

5. Global Records, platform identity and race verification

Global Records uses Unity Gaming Services (UGS), including Authentication, Cloud Code, Cloud Save and Leaderboards. The game first creates or restores a Unity player identity. To publish scores, that identity must be linked to Game Center on iPhone or Google Play Games on Android. Apple or Google authenticates you and provides short-lived verification material to Unity; Tiny Turns does not receive your platform password. Unity stores the resulting player ID and linked platform identifier. If a platform identity is already linked to a different Unity player, the game reports a conflict and does not silently merge the accounts.

After linking, Unity generates a racer tag for the leaderboard. The tag, verified full-event time, rank and track category are visible to other players on a shared Event board for that track, regardless of which car they used. Best Lap remains a personal local record and is not published to a public Lap board. The game does not publish your Game Center nickname, Google Play Games name, email address, or a user-written profile. Other players can nevertheless associate a racer tag and event history with the same leaderboard identity.

For an eligible completed event, the app can send an authenticated verification envelope containing a random run ID, creation time, track and car IDs, compatibility versions, race format and seed, claimed summary values, and a bounded fixed-tick record of accelerate/release changes and interruptions. Cloud Code replays that evidence against approved game data and publishes only server-verified times. The evidence describes controls within the fictional race; it is not a recording of your screen, physical movements, or location. Unfinished, tutorial, unsupported, or otherwise ineligible races are not published. A pending envelope can remain in a local outbox and retry after connectivity returns.

Leaderboard reads return Unity player IDs, generated racer tags, times and ranks. Recently viewed pages are cached on the device. The service also necessarily processes authentication/session tokens, request metadata and IP address. Game Center and Google Play Games separately process platform-account and authentication information under their own policies. See Unity's Game Player and App User Privacy Policy, Apple Games & Privacy, and Google's explanation of Play Games data.

Cloud Save holds a private per-player operations record: recent submission timestamps, the account-initialization time, deletion status and, where necessary, a restriction flag and moderation case reference. Only the server can access that record. It supports rate limits, safe deletion and abuse prevention; it does not store the race-input trace. Raw race evidence is processed to verify a result and is not deliberately retained by our module or included in application logs. Unity's Cloud Code Logging documentation states that logs available in its dashboard are retained for seven days; other Unity operational or security records may follow different periods.

We check service availability while online. During maintenance or an outage, Global Records can pause while local races and purchases continue. Queued evidence is separated by service environment and player identity; it is not transferred to another account. Cached public rows expire on access after 24 hours. Pending and rejected evidence is bounded to 32 records / 8 MiB and discarded on the next queue check after seven days; automatic attempts stop after 20 failures. Device clock changes may affect local expiry, but never determine an accepted race time.

Settings → Account & privacy → Notices displays service account notifications, including notices returned when sign-in is restricted. Notices may contain a case reference, affected player and project identifiers, an explanation and an appeal link. Read receipts are stored on the device for the affected account. Generated racer tags are not custom public profiles; contact support if a generated tag is inappropriate.

6. App Store update checks

Eligible App Store builds may check Apple’s public app listing while you are in the menu, normally at most once per 24 hours. The request identifies the app and a country code based on the device’s region setting, or the configured store-region override. That region is not GPS location and may differ from your Apple account’s storefront.

The app compares the store version and minimum supported iOS version locally. It does not send your career save, race results, installation analytics ID, or installed app version as update-query parameters. Like other HTTPS requests, the connection exposes network information such as an IP address and ordinary request metadata to Apple and its delivery infrastructure.

If an update is available, an optional alert offers Update or Later. Update opens an Apple App Store link; it does not install anything itself. The game normally waits seven days before reminding you about the same version. Offline play remains available if checking fails.

This feature uses no push-notification token and asks for no notification permission. Development builds, local installs without a store receipt, and TestFlight builds are excluded from automatic checks. Apple’s processing is explained in Apple’s privacy policy.

7. Optional purchase through Apple, Google Play and RevenueCat

Tiny Turns offers Unlock All Tracks, a one-time non-consumable / one-time Play product. It is not a subscription. On iPhone, Apple presents checkout and processes payment under your Apple Account. On Android, Google Play presents checkout and processes payment under your Google account. The game and studio do not receive your card number or store account password. Buying on one store does not unlock the other.

RevenueCat supplies the purchase SDK and backend used to load the store product and localized price, complete checkout through the platform store, validate purchase status, apply the all_offline_content entitlement, restore the purchase after reinstall or on another eligible device for that store, and learn about refunds or revocations. Tiny Turns does not create a player account or send RevenueCat a name or email address. When no App User ID is supplied, RevenueCat creates and caches a random anonymous App User ID. Deleting/reinstalling can create a new anonymous ID; user-initiated Restore Purchase reconciles the current store account with it.

Information processed for this function can include the anonymous RevenueCat identifier, app/bundle and SDK information, product and offering identifiers, store receipt/transaction and entitlement status, purchase dates, price/currency, storefront/sandbox or license-test status, and ordinary device/network connection information needed to provide and secure the service. SDK diagnostics and automatic attribution-device-identifier collection are disabled in the current configuration. No advertising SDK or cross-app tracking is enabled.

The game checks cached and refreshed entitlement information when it starts. Restore Purchase is only initiated when you tap it because the store may show an account prompt. RevenueCat remains the transaction/entitlement record; TelemetryDeck receives only the limited paywall funnel described in section 3. Refund requests are made through Apple or Google Play for the store that sold the product. See RevenueCat's privacy policy, Apple's privacy policy, and Google's privacy policy.

8. Feedback, support messages and development diagnostics

If you use the in-game feedback form, we receive the message and context described in section 4. It has no reply address, so we cannot answer you directly. If you email the studio, we receive your email address, message, attachments, and any information you choose to include. We use those details to answer your request and investigate the issue. Please avoid sending passwords, full payment details, or sensitive information. Settings → Account & privacy provides a support-email link and lets you copy your Unity player ID. Opening the email link does not send a message automatically.

Development builds can also write local performance files containing frame timing, memory, thermal state, scene, build identity, and diagnostic markers. These files are not automatically uploaded by that recorder. If you choose to share one for troubleshooting, we process it as support material. That recorder is not enabled in a normal release build. TestFlight and Apple’s own diagnostic or distribution services may separately process information under Apple’s terms.

9. Information the game does not request

This release does not request access to your camera, microphone, photos, contacts, calendar, health data, or GPS location. It does not read Apple’s advertising identifier or implement cross-app advertising tracking. There are no ads, player messages, friend lists, user-written public profiles, or multiplayer races. Global Records is an online leaderboard service, not live multiplayer.

The game has no recurring subscriptions. Its one optional non-consumable / one-time purchase is handled by Apple or Google Play and verified through RevenueCat as described above. The game does not receive your card number or store account password.

We do not sell personal information or share it for cross-context behavioural advertising. We do not use game data to make decisions with legal or similarly significant effects. The experience categories used for rival-balance analysis are about gameplay, not assessments of your identity or private life.

10. Why we process information

We process information to save your progress, authenticate a leaderboard identity, verify and display competitive records, prevent leaderboard abuse, operate the game, provide and restore purchased access, find bugs, improve performance and controls, evaluate rival balance, review feedback you choose to send, check for app updates, answer support requests, and comply with legal obligations.

For the EEA and other places where a legal basis is required, our processing purposes and bases are:

• Performance of our agreement with you: operating the offline game, providing Global Records when you choose to use them, verifying a purchase and restoring purchased access, and answering a support or account request you make.
• Our legitimate interests: protecting the service from fraud and abuse, diagnosing faults, maintaining security and reliability, and understanding whether game features work as intended, subject to your rights and any consent required by law.
• Legal obligations: records or responses that applicable law requires us to keep or provide.
• Consent where required: any processing that needs your prior consent under the law that applies to you, including rules about accessing information on your device. A privacy policy alone is not consent.

Analytics and diagnostic collection currently start automatically in the configured app. There is no in-game analytics or diagnostics switch. Sound and vibration controls do not disable them. Offline events may be queued for transmission when connectivity returns. If applicable law requires a prior choice for any of these activities, that choice must be implemented before offering the affected version in that market; this policy is not that choice.

11. Who receives information

The providers relevant to this release are:

• Unity: Authentication, Cloud Code, Cloud Save and Leaderboards.
• Apple and Google: Game Center or Play Games identity, their respective app stores, and checkout; Apple also handles iPhone update-listing requests.
• TelemetryDeck GmbH, Germany: product-usage events.
• Functional Software, Inc. (Sentry), United States: diagnostics and any written feedback you choose to send.
• RevenueCat, Inc., United States: purchase and entitlement records.

We limit access within the studio to people who need it for these purposes. Provider privacy notices explain their independent processing; our use of providers is also subject to the arrangements applicable to our accounts.

We may disclose information when lawfully required, to establish or defend legal claims, or to protect rights and security. If the game or studio changes ownership, relevant information may transfer with it subject to applicable safeguards and notice. We do not supply these datasets to advertising networks.

12. Where information is processed

Our support mailbox is hosted on a private Hetzner VPS in the EU. TelemetryDeck describes its analytics infrastructure as EU-hosted. The configured Sentry ingest endpoint is in Germany, but this does not mean all Sentry support access or subprocessors remain in the EU. RevenueCat says its customer data is stored in United States AWS data centers. Unity, Apple and Google use infrastructure and subprocessors that may process data in more than one country. These locations and provider arrangements can change; the linked provider notices describe their current practices.

Where personal data is transferred outside the EEA or another protected jurisdiction, applicable provider agreements and transfer safeguards, such as adequacy decisions or standard contractual clauses, may apply. These must be checked against the studio's actual provider accounts and contracts before release. You can ask tinyturns@visoolabs.com for information about the safeguards relevant to your data.

13. How long information is kept

We retain identifiable or pseudonymous information only for the purposes described here and any applicable legal requirements. Anonymous aggregate statistics may be kept longer when they can no longer identify a person or installation.

We may retain particular records longer if legally required or needed for a documented legal claim, with restricted use during that period. Deleting the app stops future app processing but does not automatically erase events already sent to a provider.

Delete your Tiny Turns account or request data deletion

In the game: open Settings → Account & privacy → Delete online account → Confirm deletion. Connect to the internet. The service first stops new submissions, waits briefly for in-flight requests, removes the account’s public scores, then deletes its Unity Authentication account. The screen reports success only after those steps finish. If interrupted, return to the same screen and choose Finish deletion. Online sign-in stays off afterward until you explicitly enable it again.

Without the game: email tinyturns@visoolabs.com to request Tiny Turns account or data deletion. You do not need to reinstall. If available, include the player ID or racer tag and whether you used iPhone or Android; if unavailable, explain that and we will help locate the account using only necessary verification. Do not send passwords or full payment details. You can also use this route when a restriction prevents sign-in.

Online account deletion keeps local career progress and store purchases. It does not delete your Apple or Google account, independent provider records or data that cannot reasonably be linked to this account. For analytics, diagnostics, support or purchase-data requests, tell us which data you want deleted; we will explain what we can identify, remove and must retain. Necessary security, fraud-prevention or legally required records may be retained for the reviewed periods above. We normally respond to rights requests within one month, subject to lawful extensions.

14. Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction of processing, or a portable copy of your personal data. You may object to processing based on legitimate interests and withdraw consent for processing based on consent. Withdrawal does not undo processing that was lawful before withdrawal.

To make a request, email tinyturns@visoolabs.com and identify Tiny Turns and the type of request. We ordinarily respond within one month under the GDPR; if a lawful extension applies, we will explain it within the required period. We may request only the information reasonably necessary to establish identity or locate the relevant data.

Because the game has no email/password account, your contact email generally cannot by itself identify pseudonymous analytics, diagnostics, a RevenueCat customer record, or a Unity player identity. We will explain what we can locate and help identify an appropriate Unity player ID or racer tag, platform identity, diagnostic, installation, RevenueCat App User ID, or store order reference where possible. We do not ask for your platform password, card details, or unnecessary identity documents, and we do not create extra identifying records solely to identify you. Where we cannot reasonably identify the data, we will explain that limitation and the options available under law.

Deleting the app removes its local data in normal iOS use; offloading is different and retains documents. Device backups may need separate management in Apple settings. Requests concerning Apple’s independently controlled information should be directed to Apple.

You may complain to your local data-protection authority. In Slovenia this is the Informacijski pooblaščenec. You do not have to contact us before exercising that right. We will not penalize you for exercising privacy rights available under applicable law.

15. Children and families

Tiny Turns is intended for people aged 13 and older and is not intended for children under 13. If you are under the age of legal majority where you live, involve a parent or guardian before using online features or making purchases. We do not currently verify age in the app. Where local law requires parental consent for a particular data use, a 13+ audience statement does not replace that consent. Contact tinyturns@visoolabs.com if you believe a child under 13 has provided personal information so we can investigate and handle deletion.

If you are a parent or guardian who believes a child has supplied information that should not have been collected, contact tinyturns@visoolabs.com. We will investigate and take the action required by law, including deletion where appropriate. Before a child-directed release, the identity, leaderboard, analytics and diagnostics configuration, permission flows, and policy must be reviewed for that audience.

16. Security

Network requests use HTTPS, the game limits queued telemetry, and career files include a corruption check and local backup. The save checksum is not encryption or a guarantee against tampering. No device, backup, or network system is perfectly secure. We use access controls and reasonable measures appropriate to the information and its risks, and respond to incidents as required by law.

17. Policy changes

We will revise this page when the app’s processing changes and update the revision date. Where law requires notice or consent before a new use, we will provide it before that use starts. An app-version reminder is not a privacy-consent prompt.

This policy covers the mobile app described here. It does not describe analytics or cookies that might be added to a future marketing website, nor does it pre-authorize cloud saves, multiplayer, advertising, or other future processing.

18. Contact us

Visoo Labs — Tina Panzalović s.p.
Breznica 12
4274 Žirovnica, Slovenia
Privacy requests and support: tinyturns@visoolabs.com