Idol Manager · Privacy

Privacy Policy

Version: 2026-10-06 · Effective: 6 October 2026

This policy explains how your personal data is processed when you use the Idol Manager World mobile app (including the Solo and Online modes, the "App"). It is our notice under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the EU General Data Protection Regulation ("GDPR").

1. Data controller

Terepop Games ("we")
Address: Yeni Mah. Atatürk Cad. Seçkin Sok.
Email: contact@terepop.com
Web: terepop.com

2. Summary

  • You can play Solo without an account. Solo saves stay on your device.
  • The leaderboard, purchase verification and the Online mode need an account (email, Google or Apple).
  • Product analytics (Firebase Analytics) is only switched on if you allow it. You can change this at any time in Settings.
  • Personalised ads are only shown if you allow tracking on iOS and give ad consent in the EU/UK.
  • We never see your payment details. Apple and Google process payments.
  • You can permanently delete your account in the App (Settings > Delete account).

3. What we process, why, and on what legal basis

3.1 Account data

  • Data: Email address, display name, sign-in method (email, Google, Apple), Firebase user ID, the version and date of the Terms of Use you accepted. In Solo, an anonymous device-specific game ID may be created even if you do not sign in.
  • Purpose: Creating your account and signing in, the leaderboard, linking purchases to your account, Online play.
  • Legal basis: Entering into and performing our contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).

3.2 Game data

  • Solo: Your career saves are stored on your device. If you join the leaderboard, your label name and fan and stream scores are sent to our servers and shown to other players.
  • Online: Your label (company), manager, group and song names; your idol roster; in-game economy, league, season, concert, transfer and transaction records; quests and daily rewards; cosmetic choices. Your label, group and song names and league results are visible to players in the same league.
  • Purpose: Providing the game, saving your progress, fair competition and cheat prevention.
  • Legal basis: Performance of the contract; our legitimate interest in preventing cheating and abuse (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).

3.3 User content and moderation

  • Data: Posts and comments you write in the Online social feed, mentions, likes; reports you send and their explanation; players you block; feedback messages.
  • Purpose: Providing social features, reviewing and removing content that breaks the rules, restricting abusive players, answering support requests.
  • Legal basis: Performance of the contract; legitimate interest in community safety.
  • Your posts and comments are visible to players in your league. Please do not share personal information (real name, phone number, address and so on).

3.4 Purchases

  • Data: Product, price, currency, transaction ID, the store-signed purchase proof (stored encrypted), delivery and refund status.
  • Purpose: Verifying and delivering purchases, handling refunds and abuse, accounting and tax obligations.
  • Legal basis: Performance of the contract; legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)); legitimate interest.
  • We never see card or payment details; the App Store or Google Play processes the payment.

3.5 Advertising (Google AdMob)

  • Data: Advertising ID (IDFA/GAID, only when permitted), IP address, device and app information, ad interactions. For rewarded ads, your player ID and the reward are passed through Google to our server to verify the reward.
  • Purpose: Showing ads, verifying rewarded ad rewards, preventing ad fraud.
  • Legal basis: Consent for personalised ads and device access (App Tracking Transparency on iOS, the Google consent message in the EU/UK); legitimate interest for non-personalised ads and fraud prevention.
  • You can change ad choices in the privacy options in Settings and in iOS Settings > Privacy > Tracking.

3.6 Product analytics (Firebase Analytics)

  • Data: In-game events (for example, your first release or opening the store), screen views, app version, device type, an anonymous app instance ID; in Online, a random player ID.
  • Purpose: Improving the game, finding bugs and balance problems.
  • Legal basis: Consent. Analytics only runs if you allow it and is never used for ad personalisation. You can withdraw consent in Settings.

3.7 Technical operation and security

  • Data: Crash reports (Firebase Crashlytics: device model, operating system, error log), device integrity checks (Firebase App Check), server logs and IP address, error tracking (Sentry: the error message and a random player ID; no email, password or session token), remote configuration and in-app announcements (Firebase Remote Config and In-App Messaging).
  • Purpose: Keeping the App working and secure, preventing attacks and abuse, fixing errors.
  • Legal basis: Legitimate interest; information security obligations.

3.8 Notifications

  • Data: Push notification token (Firebase Cloud Messaging), your notification preferences.
  • Purpose: Telling you about in-game events.
  • Legal basis: Your consent through the operating system's notification permission. You can switch notifications off in Settings and in your device settings.

3.9 Invite rewards

  • Data: Your invite code, invite relationships and a one-way hash of the device ID. The raw device ID never leaves your device.
  • Purpose: Preventing invite rewards from being claimed repeatedly with the same device.
  • Legal basis: Legitimate interest (abuse prevention).

3.10 Install and ad measurement (Adjust), when used

  • Data: Which ad or campaign led to the install, advertising ID (only when permitted), device information, certain game milestones (for example, your first release), purchase and ad revenue.
  • Purpose: Measuring the effectiveness of ad campaigns.
  • Legal basis: Consent (it does not run in the EU/UK without consent; on iOS the advertising ID is not used without permission). Switching product analytics off in Settings also stops this measurement. If you delete your account, Adjust is asked to forget your device.

3.11 AI-generated virtual accounts

Some influencer and critic accounts in the Online social feed are fictional. Their posts are written from templates or, when enabled, by an AI service (OpenAI). For this, only the label name and verified game event details (for example, a song title and its release result) are sent. Your own posts, your email address and your other personal data are not sent. Legal basis: legitimate interest in providing the game experience.

3.12 Character images

Some idol images are downloaded from DiceBear (api.dicebear.com). This request sends your IP address and a random key belonging to the game character to DiceBear; no account information is sent.

4. Who receives your data

We do not sell your data. We share it only for the purposes above and only as much as needed with:

  • Our service providers (processors): Google (Firebase Authentication, Analytics, Crashlytics, Cloud Firestore, Cloud Functions, Remote Config, In-App Messaging, Cloud Messaging, App Check, AdMob, Google Sign-In), Apple (Sign in with Apple, App Store), server hosting and network services (DigitalOcean, Cloudflare), Sentry (error tracking), Adjust (when used), OpenAI (when used), DiceBear.
  • App stores: Apple and Google, for purchase verification and refunds.
  • Other players: Your leaderboard details; in Online, your label, group and song names, league results, posts and comments.
  • Authorities: Where required by law.

International transfers: Some of our providers process data outside Türkiye (including the EU and the US). These transfers rely on the standard contracts published by the Turkish Personal Data Protection Board or other safeguards under KVKK Art. 9, and, for transfers from the EU, on the European Commission's Standard Contractual Clauses or equivalent safeguards under the GDPR. Our Online game servers are located in: Germany (Frankfurt).

5. How long we keep data

  • Account and game data: While your account exists.
  • When you delete your account: Your email address, display name, sign-in ID and push tokens are deleted immediately. Your label, group, song and private league names are replaced with neutral names. Your posts are hidden and their text deleted. Your comments, feedback and command records are deleted.
  • Kept without your identity: Purchase and financial records are kept for the period required by law (up to 10 years under the Turkish Tax Procedure Law and Commercial Code). In-game economy ledgers and league history that other players are part of (charts and match results) stay linked only to a random player ID. Security and moderation records are kept as long as needed. The record of which version of the Terms of Use you accepted and when is kept for the general limitation period (10 years) as evidence in case of a dispute.
  • Backups: Server backups are deleted on a rolling basis within 30 days.
  • Analytics, crash and error records: For the retention period set in the respective service.
  • Data on your device: Until you uninstall the App or clear it in Settings.

6. Your rights

Under KVKK Art. 11 and the GDPR you have the right to:

  • Know whether your data is processed and request information about it,
  • Know the purpose of processing and whether it is used accordingly,
  • Know the recipients of your data,
  • Have incomplete or inaccurate data corrected,
  • Have your data deleted or destroyed,
  • Have corrections and deletions notified to recipients,
  • Object to a result against you arising from analysis by automated systems,
  • Claim compensation for damage caused by unlawful processing,
  • Under the GDPR, also: restrict processing, data portability and object to processing based on legitimate interest.

How to use them:

  • Delete your account: Settings > Delete account in the App.
  • Withdraw consent: Product analytics and ad privacy options in Settings; notifications in Settings and your device settings; iOS tracking permission in iOS Settings.
  • Other requests: Write to contact@terepop.com. We answer free of charge within 30 days.

If you do not get an answer or find it unsatisfactory, you can complain to the Turkish Personal Data Protection Board, or, if you live in the EU, to the data protection authority of your country.

7. Children

The App is not designed for children under 13, and we do not knowingly collect personal data from them. If you are under 18, get your parent's or guardian's permission before creating an account or making purchases. If we learn that we collected data from a child under 13, we delete it.

8. Security

We protect your data with technical and organisational measures such as encrypted connections (HTTPS), encrypted storage of purchase proofs, access restrictions and authorisation, audit logs and regular backups. No system is risk-free; if a data breach occurs, we notify the authority and you as required by law.

9. Changes

We may update this policy. The current version is always available in the App (Settings) and on our website. For significant changes we notify you in the App and ask for your acceptance again where required.

10. Contact

Questions and requests: contact@terepop.com