What the game keeps,
and what it never asks for.

1. Who we are

Turbo Striker 60 is developed and published by VectorLabs Studio, based in Istanbul, Türkiye. For anything on this page — a question, a correction, or a request to see or delete your data — write to vectorlabs.studio.apps@gmail.com. We are the data controller for the information described here.

2. What stays on your phone

Most of the game is local. Your settings — sound, haptics, reduced motion, and whether you share ghost replays — never leave the device. Neither does the marker the game writes when a match starts, which is only there so an interrupted match can be resolved when you come back.

When cloud saving is on, a copy of your saved documents is also cached on the device by the database library, so the game keeps working while you are offline and syncs when you are back. Deleting the app removes that copy along with everything else local.

3. What needs a connection, and what does not

Three of the four modes — Quick Match (Training Camp lives underneath it), Route Match and Career — run entirely on your device. The rival is code, not a person, and nothing has to leave the phone for you to play. With the network off you keep your progress, your career and your training; the game simply saves locally until it can sync.

Ranked is the exception, for an obvious reason: it needs an opponent and a result nobody can fake. Ranked play requires an account and a connection, and both are described in full below.

4. The account you did not have to create

When the app first reaches the network it creates an anonymous account with Firebase Authentication. That account is a random identifier — a uid. It is not your email, your phone number, or your name, and we cannot work backwards from it to you. It exists so your progress belongs to something when it is saved.

You may later link a Google account (both platforms) or Sign in with Apple (iOS) so your save survives a new phone. Linking upgrades the same account in place — the uid does not change and nothing is migrated. When you link, the sign-in provider gives Firebase the email address and display name attached to that account, and Firebase keeps them on the account record. With Sign in with Apple you may choose Apple's private relay address, and then that is all we ever see.

The app never draws a password field. Credentials are only ever typed into the operating system's own sign-in interface — Android's Credential Manager, Apple's Authentication Services — which hands us a token and never the password.

5. What gets saved to the cloud

With cloud saving on, these documents are stored under your account id in Google Cloud Firestore:

Your striker

The name you typed, the character and difficulty you picked, and your lifetime wins, losses and goals.

Progress

Level, XP, coins, and which characters and looks you have unlocked.

Match history

Your last 50 matches: the score, the mode, how long it ran, and how it ended.

Career

Where you are in the campaign — division, rivals faced, story position.

Training and Academy

Drill results and the levels you have spent training points on.

Ranked

Your rating and rank. Written only by our server, never by the app.

It is all game state. There is no address book, no location, no photos, no microphone, and no file access — the Android app requests exactly one permission, VIBRATE, and the iOS app requests none.

The security rules on our database are written so that a signed-in player can read and write only their own documents. Your rating is a deliberate exception in the other direction: the app is not permitted to write it at all, only our server is.

6. What other players can see

Two parts of the game are, by design, visible to other players. They are worth knowing about before you use them.

Ghost replays — off unless you turn them on

A ghost is a recording of the decisions you made in a match, so someone else can play against how you played. Sharing them is off by default. If you switch it on in Settings, a published recording carries your striker name, your level, the character you used, the score, and the decisions themselves — and any signed-in player may be matched against it. Switching sharing back off stops new recordings from being published.

Leaderboards

Playing Ranked puts your striker name, your rating and your rank on the season leaderboard, which any signed-in player can read. If you would rather not appear, do not play Ranked.

6b. When you report or block someone

Every place another player's name appears — the leaderboard, a ghost you were matched against — you can report the name or block the player. Reporting sends us a small record: who reported, who was reported, where it was seen, and when. Nobody but us can read those records, and we keep them only as long as it takes to deal with them.

Blocking is yours alone: it is a list of accounts stored with your save, so it survives a new phone, and it works immediately — their recordings stop reaching you and their leaderboard row disappears. It is deleted with your account, like everything else you own.

7. Analytics and crash reports

We use Google Analytics for Firebase to understand which parts of the game people actually play, and Firebase Crashlytics to find out when it breaks. The events the game sends are these, and nothing else:

• screen_view — which screen was opened
• match_completed — mode, difficulty, score, rounds, win or loss
• reward_granted and level_up — XP, coins, new level
• store_purchase and character_unlocked — which character, and the in-game coin cost

When a remote experiment is running, every event also carries which experiment and which variant you are in. Which variant that is comes from a hash of your account id computed on the device — there is no profile behind it and nothing is sent to decide it.

None of these carry your name, your email, or anything you typed. Both services also collect their own technical information on top of what we send: device model, operating system version, language, an approximate country derived from the network address, an app instance identifier. They do not collect an advertising identifier: the ad-id-capable parts of the analytics library are deliberately not built into either app, and the Android package requests no advertising permission at all — both checkable from the outside. On iOS the ad SDK does link Apple's advertising framework, because it is not offered without it; but the app never asks for tracking permission, so the identifier that framework would hand back is all zeros. Nothing reads it, and nothing is built from it. Crash reports include the state of the app at the moment it failed, and are tagged with your account id so that a single player's repeated crash can be recognised as one problem.

We do not use any of this for advertising and it is never combined with data from other apps. The iOS app does not request tracking permission, because it does not track: its privacy manifest declares no tracking domains.

Settings → Share Analytics & Crash Reports turns both of these off, on your device, at any time — no email required. It ships on by default so we can find and fix what breaks, but the switch is real: turning it off stops collection immediately and clears your account id from future crash reports.

7b. Ads, and the ones we refuse to show

There is one kind of ad in this game: a rewarded one, offered on the result screen after a match, which doubles the coins you just earned. You choose to watch it. Nothing is taken away if you do not, and the game never asks twice for the same match.

There are no banners and no ads between matches. That is a design decision as much as a privacy one: a match lasts sixty seconds, so an ad every few matches would land in front of you every few minutes, and the whole point of the game is that a full match fits in a gap in your day.

The ads are not personalised. They are requested with personalisation switched off, which means no advertising identifier is read, nothing about you is sent to choose which ad you see, and no profile is built from what you watch. This is why the iOS app never shows the "allow tracking" prompt — there is nothing to allow — and why the Android app requests no advertising permission. An ad network still sees the ordinary technical details of a device requesting an ad: approximate country, device type, and operating system version.

Where the law requires a consent choice before ads are requested, you will be asked before the first one — through Google's consent form, and before any ad is loaded. If you decline, or if the question cannot be answered for any reason, no ad is requested at all.

8. Two quieter things the app talks to

Remote Config lets us adjust game balance without shipping an update. The app asks Google's servers for the current values; the request carries the usual technical details of an app making a network call and nothing about you. If the fetch fails, the values bundled in the app are used, which is why balance changes never break offline play.

App Check asks the platform — Play Integrity on Android, App Attest on iOS — to vouch that the request is coming from a genuine, unmodified copy of the app. What travels is a token from Google or Apple about the app and the device, not about you. It is what keeps someone from pointing a script at the ladder. A device that cannot produce a token still plays: the game is offline-first, and failing to attest is never fatal.

9. Ranked results are checked on our server

To keep the ladder honest, the app never submits a score. It submits the random seed and the buttons that were pressed, and our Cloud Function replays the match to see whether the claimed result actually happens. A submission that does not reproduce is rejected. What the server keeps from that is your rating, your rank, and the leaderboard entry.

10. Who else touches this data

We do not sell your data, and we do not share it with advertisers or data brokers. It is handled by two kinds of third party:

• Google — Firebase Authentication, Cloud Firestore, Cloud Functions, Remote Config, App Check, Analytics and Crashlytics run the account, the save, and the reporting described above. Google processes this data on our behalf under its own Firebase privacy terms.
• Apple and Google sign-in — only if you choose to link an account, and only to prove that the account is yours.

The app store you installed from — Google Play or the App Store — also receives information about the download and any purchase under its own policy. We do not receive your payment details from either; the game currently sells nothing for real money at all.

Our database and functions run in Google's United States multi-region. If you are in Türkiye or the European Economic Area, your data is transferred there and is covered by the standard contractual clauses in Google's terms.

11. How long we keep it, and how to delete it

Cloud saves are kept for as long as the account exists, because that is the point of them. Analytics events and crash reports expire on Firebase's own schedule — Analytics event data after 14 months, crash reports after 90 days.

There is one save we do not keep indefinitely. A guest account — one you never linked — is deleted automatically, along with everything it owns, after 30 days without playing. A guest account carries no email address, so nobody could ever ask us to delete it by name; expiry is the only way that save is ever reachable. Linking is what stops the clock: a linked account is never expired, however long you leave it.

You can also have part of it deleted without giving up the account — published ghost recordings, your leaderboard entry and rating, your match history, or your crash reports. Ask by email and say which; the account keeps working.

There is a page that covers this on its own, written so it can be followed after the app is already uninstalled: how to delete your account and data. For anything else, there is a support page. The short version:

In the app: Settings → Account → Delete account. That erases your striker, progress, match history, training, Academy and career, along with every ghost recording you made — including the ones you published to the shared pool, so no other player can be matched against your name after you leave. Then it deletes the account itself. You are returned to a fresh anonymous identity and can keep playing.

Two things outlive the account: your rating and any leaderboard rows, which the app is not permitted to write and therefore cannot delete — they are historical results, held under the old random id, and we remove them on request — and analytics events, which were never tied to your identity and expire on their own schedule.

By email: write to vectorlabs.studio.apps@gmail.com from the address linked to your account, or quote the account id the game shows under Settings → Account, and we will delete everything we hold within 30 days.

12. Children

Turbo Striker 60 is not directed at children under 13 (or the equivalent age where you live), and we do not knowingly collect data from them. There is nothing in the game that asks a player who they are. If you believe a child has created an account, write to us and we will remove it.

13. Your rights

Under Türkiye's KVKK, the GDPR, and comparable laws elsewhere, you can ask us what we hold about you, ask for a copy, ask us to correct it, and ask us to delete it. You can also object to our using it and complain to your local data protection authority. Use the email above; we do not charge for any of this.

Where a legal basis is required: we process game state to provide the game you asked for (performance of a contract), and analytics and crash reporting to keep it working and worth playing (legitimate interests). Ghost sharing is consent — a switch you turn on. For analytics and crash reporting specifically, you do not have to wait on an email to object: Settings → Share Analytics & Crash Reports, in the app, is that objection — instant, and it needs no explanation.

14. Security

Everything travels over encrypted connections. Per-account isolation is enforced by server-side rules rather than by the app being polite, the ladder is server-authoritative so a tampered client cannot write its own rating, and Firebase App Check is installed so requests can be checked as coming from a genuine build of the app. No system is perfect, and we will not pretend otherwise — but nothing here is guarded only by client code.

15. This website

turbostriker60.app is a static site. It sets no cookies, runs no analytics, and loads nothing from anyone else's server — everything you see, including the fonts, is served from this domain. Our host keeps ordinary server logs.

16. Changes

If what the game collects changes, this page changes with it and the date at the top moves. A change that materially affects you will be announced in the app before it takes effect.