Privacy Policy
Derbi: Roll-a-Ball Horse Racing · Effective date: October 7, 2026 · Last updated: October 7, 2026
1. Data controller
For the purposes of Turkey's Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR), the data controller is Emir KIZILIRMAK (md9.net). Contact: destek@md9.net
2. What we don't collect
- Your name, email address or phone number
- Location (GPS), contacts, photos, camera or microphone
- Card, bank or any other payment details (there are no purchases in the app)
The app asks for only two permissions: notifications, for room invites, friend notices and a daily reminder; and, on iOS, App Tracking Transparency, for personalized ads. Both are optional; the game works the same if you decline.
3. Stored only on your device
- Progress: level, XP and ticket balance
- The horses and balls you have unlocked
- Daily tasks, daily streak, badges and the dates you earned them
- Local stats: races, wins, accuracy and best times
- Settings: music, sound effects, vibration, notifications, language, Reduce Motion, throw guide, throw sensitivity and your usage statistics choice
Your ticket balance, unlocked horses and balls, badges, tasks and settings are not sent to our servers. If you have an online account, your race results and the stats calculated from them, your chosen horse and your language are also sent to the server, as described in section 4. If device backup is on, this data may be included in the operating system's own backup (iCloud). Deleting the app removes it from the device.
4. Online account (Derbi API)
Online features run on our own server, the Derbi API, at derbi-api.md9.net. It runs on Cloudflare infrastructure (Workers, the D1
database and Durable Objects).
How the account is created
When your device is online, the app creates a player account automatically. The account needs no email or password; it is identified by a randomly generated secret token. The token is stored on your device in the iOS Keychain, and the server keeps only an irreversible hash of it (SHA-256). If you haven't picked a nickname, you get a guest name such as Guest1234 (Misafir1234 in the Turkish interface). We recommend not using your real name or anything that identifies you as a nickname.
What the account holds
| Data | Why | Who can see it |
|---|---|---|
| Nickname | Profile, rooms, leaderboards and finding friends by nickname | Other players |
| Avatar number and chosen horse | How you appear in your profile, in rooms and in races | Other players |
| Language and platform (iOS or Android) | Sending notifications in the right language, compatibility | Only us |
| Push notification token (only if you allow notifications) | Delivering room invites and friend notices through Firebase Cloud Messaging | Only us |
| Race results: mode, course, place, number of players, time and race points | Leaderboards, stats and checking that results are valid | Points and times that make the leaderboards are visible to other players |
| Stats: races, wins, best time, weekly points and your best daily time in the Daily Race | Profile and leaderboards | Other players |
| Friends list | Friends leaderboard, invites and online status | The player you add gets a notice that you added them |
| Room invites and friend-add notices | The in-app notification inbox | The recipient |
| Last-seen time | Showing "online" status | Players who added you as a friend can see whether you are online |
Adding a friend is one-directional: you can add a player by nickname without their approval, and they add you separately if they want to. You can remove friends from your list at any time.
Rooms and races
The players in a room, their ready status, the throws during a race and emoji reactions are kept on the server to run the race and are deleted when the room closes. Everyone in a room sees the other players' nicknames, avatars and horses. To keep play fair, the server may reject results that look impossible (for example, physically impossible times); this check relies only on race data and builds no profile of you.
IP address
With every request to the server, your IP address is processed by Cloudflare to deliver the content and keep the service secure. To limit abuse (for example, many accounts being created from the same address in a short time), your IP address is kept in a short-lived counter; these counters are removed by an automatic daily cleanup within 2 days at most. We do not store your IP address with your player account.
5. Deleting your account and data
- Settings › Delete online account: your player account and all of its server data (nickname, avatar, chosen horse, push token, race results, stats, weekly points, daily times, your friends list, your entry in other players' lists, and invites you sent or received) are deleted immediately and permanently. Your progress on the device stays.
- Data on the device: deleting the app removes your progress, tickets and settings from the device. Deleting the app does not delete the server account. iOS may keep the account token in the Keychain after the app is deleted; in that case, reinstalling the app continues with the same online account. If you want the server account deleted, use Delete online account first.
- By email: if you can't access the app, write to destek@md9.net and include your nickname.
6. Google Firebase
| Service | Data processed | Purpose | Retention | Can you turn it off? |
|---|---|---|---|---|
| Firebase Analytics | In-game usage events (screens opened, modes played, settings changed and similar), app instance ID, general properties such as language, level and chosen horse, device model and OS version, approximate location derived from the IP address (country/city). Your nickname and account ID are not sent. | Understanding how the game is played and improving it | 14 months | Yes: Settings › Usage statistics (on by default) |
| Firebase Crashlytics | Crash diagnostics (stack trace, device model, OS and app version) | Finding and fixing bugs | 90 days | Yes: same switch |
| Firebase Performance Monitoring | Technical performance measurements (e.g. launch time, network request duration), device model and OS version | Monitoring how fast the game runs | Google's standard retention | Yes: same switch |
| Firebase Remote Config | Firebase installation ID | Changing game settings (e.g. ad frequency) without an app update | Google's standard retention | No; required for the game to work |
| Firebase Cloud Messaging | Push notification token | Delivering room invites and friend notices | Google's standard retention | Yes: notification permission |
When you turn off Settings › Usage statistics, Firebase Analytics, Crashlytics and Performance Monitoring stop collecting data.
7. Ads (Google AdMob)
Derbi is free; Google AdMob serves banner, interstitial, app-open and rewarded ads. Interstitials appear only between races, and app-open ads when you launch the game or come back to it; no ads are shown during a race. Rewarded ads are optional: watching one doubles the tickets you just won or gives you free tickets. Ad content is limited to Google's "PG" (parental guidance) rating. To show and measure ads and prevent fraud, Google processes:
- The advertising identifier: on iOS the IDFA, only if you allow it in Apple's App Tracking Transparency prompt; in the Android version, the Android advertising ID
- IP address and the approximate location derived from it
- Device information (model, OS version, language and similar)
- Ad interactions (impressions, clicks, rewarded ads watched)
Personalized ads are shown only with your permission: in the European Economic Area, the UK and Switzerland, Google's consent form (User Messaging Platform) is shown, and on iOS Apple's tracking permission is also required. If you decline, the game works fully and shows non-personalized ads, which are chosen from general signals such as context and approximate location rather than your interests.
Where the consent form is required, you can change your choice in Settings › Ad privacy options. On iOS you can withdraw tracking permission in Settings › Privacy & Security › Tracking. How Google uses this data is explained at the links below.
8. Notifications
If you allow notifications:
- When a friend invites you to a room or adds you as a friend, you get a notification through Firebase Cloud Messaging; for this, your push token is stored with your online account.
- A "Daily Race" reminder is scheduled locally on your device for 7 p.m. each day. It is not sent from our server.
Turn notifications off in Derbi under Settings › Notifications, or on iOS under Settings › Notifications › Derbi.
9. Legal bases
| Processing | KVKK art. 5 | GDPR art. 6 |
|---|---|---|
| Online account, multiplayer races and rooms, friends list, leaderboards, invite and friend notifications | Establishment or performance of a contract (art. 5/2-c) | Performance of a contract (art. 6/1-b) |
| Security and abuse prevention (IP-based rate limiting, result validation), crash reports, app settings (Remote Config) and non-personalized ads | Legitimate interest (art. 5/2-f) | Legitimate interest (art. 6/1-f) |
| Usage statistics and performance measurement (Firebase Analytics, Performance Monitoring) | Legitimate interest (art. 5/2-f); explicit consent (art. 5/1) where the law requires consent | Legitimate interest (art. 6/1-f); consent (art. 6/1-a) where required |
| Personalized ads (Google consent form in the EEA, UK and Switzerland; Apple App Tracking Transparency on iOS) | Explicit consent (art. 5/1) | Consent (art. 6/1-a) |
Our legitimate interests are understanding how the game is played, fixing bugs, protecting the service and leaderboards from cheating, and keeping the game free through ads. No direct identifiers such as your name or email are used for this processing. You can object to the processing of statistics and crash data (GDPR art. 21) simply by turning off Settings › Usage statistics. You can withdraw consent to personalized ads at any time; withdrawal does not affect the lawfulness of earlier processing.
10. International transfers
Google (Firebase and AdMob) and Cloudflare may process data on servers outside Turkey, including in the United States. These transfers are made under KVKK art. 9 and Chapter V of the GDPR; the providers use safeguards such as standard contractual clauses for international transfers.
11. Retention
| Data | Retention |
|---|---|
| Data on the device (progress, tickets, horses, badges, settings) | Until you delete the app |
| Online account (nickname, avatar, chosen horse, language, platform, push token, stats, weekly points, friends list, last-seen time) | Until you delete it with Settings › Delete online account |
| Individual race records | 90 days; the totals stay with the account |
| Daily Race best times | 90 days |
| Room invites and friend-add notices | 7 days |
| Room and matchmaking data (players in the room, throws, reactions) | Until the room closes |
| IP-based rate-limit counters | 2 days at most |
| Firebase Analytics events | 14 months |
| Crashlytics crash reports | 90 days |
| Advertising data | According to Google's retention policies |
12. Your rights
Under KVKK art. 11 you have the right to learn whether your personal data is processed; to request information about it; to learn the purpose of processing and whether data is used for that purpose; to know the third parties in Turkey or abroad to whom it is transferred; to request correction of incomplete or inaccurate data; to request erasure or destruction under KVKK art. 7 and notification of these actions to the third parties concerned; to object to a result against you arising solely from automated analysis; and to claim compensation for damage caused by unlawful processing.
If you are in the EU, EEA, UK or Switzerland, you also have the rights of access, rectification, erasure, restriction of processing, data portability, objection and not to be subject to decisions based solely on automated processing (GDPR art. 15–22), and you may lodge a complaint with your local data protection authority.
How to make a request
Write to destek@md9.net. Requests are handled free of charge within 30 days at the latest. Include your nickname so that we can find your account. You can correct your nickname yourself in Profile › Edit Profile and delete your account yourself with Settings › Delete online account. If you are not satisfied with our answer, you can complain to Turkey's Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
13. Children
Derbi is a game for a general audience. It is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe your child has given us personal data, write to destek@md9.net and we will delete the online account and its data. Parents can use Screen Time on iOS to limit app downloads and usage time. Derbi has no in-app purchases.
14. Third-party policies
- Google Firebase privacy and security
- Google AdMob: how Google uses information from sites or apps that use its services
- Google: advertising
- Google Privacy Policy
- Cloudflare
- Apple
15. Changes
When this policy changes, the date above is updated; significant changes are announced in the app.