Privacy Policy
Last updated: 9 November 2026
1. Introduction
This privacy policy explains how Seyfi Can Zeyrek (trading as Morrowline Apps) handles personal data in Whose Receipt?, a daily deduction game for iPhone, iPad and Android. It covers what we collect, why, who receives it, how long we keep it and how you can delete it. It takes effect on the date above.
The terms of use apply alongside this policy. If you are in Türkiye, a separate KVKK information notice also applies.
In short:
- The app creates an anonymous account identifier when you first open it; it is not tied to your name unless you add one.
- Some data leaves your device: your account identifier, alias, game results and wallet are processed by Google (Firebase) to run the game, and in the Android app RevenueCat processes your account identifier and purchase records for us.
- Other players cannot see your alias or your results: the board compares you with simulated rivals generated on your device.
- The app contains no advertising, attribution or analytics SDK.
- You can delete your data at any time in Settings > Delete my data. Section 12 explains what deletion removes and what the stores keep.
2. Who we are
The controller responsible for your personal data is Seyfi Can Zeyrek (trading as Morrowline Apps), an individual developer based in the Republic of Türkiye, at Esenyali Mahallesi 52/75 Sk. Izmir/Türkiye. Morrowline Apps is a brand name, not a registered company. You can reach us about privacy at zeyrekseyfican@gmail.com. We have not appointed a data protection officer; send every privacy request to that address.
We are established in Türkiye, outside the EEA and the UK. We have not appointed a representative in the EU or the UK; you can contact us directly at zeyrekseyfican@gmail.com.
3. Scope
This policy applies to the Whose Receipt? app on iOS and Android, its home-screen widget, its reminders and the web pages at whosereceipt.morrowline.app that host our legal texts. It covers the game's daily cases, Case Files, campaigns, season, board, shop and wallet.
It does not cover services run by others, such as the App Store, Google Play or your operating system. Screens in the app may give you extra information at the moment we collect something.
4. Data we collect
You give us
| Data | What it includes | Why we use it | Who receives it |
|---|---|---|---|
| Name or nickname (optional) | Your detective alias. We generate one for you if you do not choose one or our word filter refuses the one you chose, and it need not be your real name. Only you see it. If you are offline when you choose it, it waits on your device until our server can check it | To address you in the game, and to check it with the word filter | Google (Firebase) |
| Game content you create | Cases played, accusations, motive answers, grades, tip-offs used on a case, time taken, XP, streak, Alibis, rank, stats and achievements | To provide the game and keep your progress | Google (Firebase) |
We collect automatically
| Data | What it includes | Why we use it | Who receives it |
|---|---|---|---|
| Account identifier (user ID) | The anonymous identifier created at first launch. In the Android app it is also the customer identifier at RevenueCat | To create, secure and manage your account, and to link purchases to it | Google (Firebase); RevenueCat (Android) |
| Game content: wallet and ledger | Your tip-off balance, Merit per season, and a record of each wallet operation (type, source, amounts and key), including the tip-off a Decode uses and tip-offs you buy | To provide tip-offs and Merit, and to stop an operation being applied twice | Google (Firebase) |
| Other usage data | Your app language | To provide the app in your language | Google (Firebase) |
| Device identifiers | App attestation data from App Check, using Apple App Attest or DeviceCheck, or Google Play Integrity. On Android, an installation identifier or token that Google's Firebase libraries can create for the app and send with requests to our servers | To keep the service secure, prevent abuse and connect the app to our servers | Google (Firebase); Apple; Google Play |
| Other diagnostics | Rate-limit counters linked to your identifier, and server logs that our hosting provider creates, which can include technical request data such as an IP address, your account identifier and, for purchases, the product | To keep the service secure, prevent abuse and resolve errors | Google (Firebase) |
| Technical data for the store (Android) | IP address, device model, operating system and app version, and store country, sent by RevenueCat's software when the app starts and when it loads plans, buys or restores | To show store prices, process purchases and keep your purchase status current | RevenueCat |
Purchases
In-app purchases are currently available only in the Android app, through Google Play. Buying is optional.
| Data | What it includes | Why we use it | Who receives it |
|---|---|---|---|
| Purchase and subscription status (optional) | What you hold: Pro, Case File packs, campaigns, the Season Pass and tip-offs, and whether a subscription is active or will renew | To unlock what you bought and credit tip-offs | Google Play, as the store that sold it; RevenueCat; Google (Firebase) |
| Purchase records and events (optional) | RevenueCat's record of your purchases under your account identifier, and the purchase events it sends to our server: event type, product, store environment and time | To deliver each purchase once, keep Pro status current and resolve billing questions | RevenueCat; Google (Firebase) |
Our servers keep the status of your Pro plan (product, expiry, renewal and store) and, for tip-offs you buy, the store's transaction ID; we never receive your card details. Google Play handles payment under its own terms.
Records of purchase events, which include your account identifier, are deleted when you use Delete my data; otherwise they are deleted automatically 180 days after the event.
Stays on your device
- Settings, your reminder hour, the offline copy of your game and the cosmetics you hold.
- The board: the simulated rivals and their scores are generated on your device and compared with your own results there.
- The date and version of the terms you accepted when you continued past the first screen.
- The values for the home-screen widget. Home-screen widgets can show your streak and whether today's case is closed to anyone who can see your screen.
- Your time zone, which is read to schedule reminders and is not sent to us.
What we do not collect
The app does not request your contacts, location, camera, photos or microphone. It does not read an advertising identifier. The app contains no advertising, attribution or analytics SDK. It has no chat, friends list or public profile. Reminders are scheduled on your device, and we do not send push messages.
Your account identifier, game content and security data are required to run the game. An alias of your own, reminders, the widget and purchases are optional. If you do not use them, the rest of the game keeps working.
5. How we collect data
- Directly from you: when you play a case, use a Decode, choose an alias, choose a reminder hour or buy something.
- Automatically: from your device and the app as you use them, including through the Firebase SDKs and, on Android, RevenueCat's SDK. Permissions you grant are covered in section 8.
- From others: Google Play, through RevenueCat, tells the app and our server what your store account has bought and whether a subscription is active.
6. How we use data
We use data to:
- provide the game and keep your progress across sessions;
- create and secure your anonymous account;
- check aliases with a word filter;
- keep your tip-off balance and Merit correct, unlock what you bought, credit tip-offs you buy and keep Pro status current;
- schedule the reminders you asked for, on your device;
- keep the service secure, stop abuse, avoid crediting a purchase twice and limit excessive requests;
- answer billing and support questions;
- comply with the law and defend legal claims.
We do not sell your personal information and we do not share it for cross-context behavioural advertising. We do not show ads. We do not use your data for profiling beyond what this policy describes.
7. Legal bases
| Purpose | Data | Legal basis (GDPR and UK GDPR) | KVKK art. 5 |
|---|---|---|---|
| Provide the game, wallet and purchases | Account identifier, alias, game content, wallet and ledger, purchase status, RevenueCat's purchase record and technical store data, language | Contract, art. 6(1)(b): we need this to provide the service you asked for | 5/2-c: necessary for the performance of a contract |
| Keep the service secure, prevent abuse and double crediting, including the alias word filter | Device identifiers and attestation data, rate-limit counters, server logs, wallet ledger, purchase event records, alias | Legitimate interests, art. 6(1)(f), in security, abuse prevention and correct billing; you can object | 5/2-f: legitimate interest of the controller |
| Meet legal duties | Records the law requires | Legal obligation, art. 6(1)(c) | 5/2-ç: controller's legal obligation |
We do not rely on consent for any of this processing. The system prompt for notifications is a device permission, and you can change it at any time.
8. Device permissions
We ask only for the notification permission below. The other entries are permissions that Android grants at installation without a prompt; we list them so you know why they are there.
Notifications (iOS and Android)
- Why we ask: to send a daily reminder at the hour you pick. There is no reward for allowing them.
- What we do not do with it: advertising, sales messages or tracking.
- Stored or sent: the reminder is scheduled on your device and nothing about it is sent to us.
- How to turn it off: in Settings in the app, or in the Notifications section of your device settings.
Reminders after a restart (Android: boot completed, wake lock)
- Why we ask: to keep the reminder scheduled after a restart and deliver it on time.
- What we do not do with it: run in the background for any other purpose.
- Stored or sent: nothing is sent.
- How to turn it off: turn off the reminder in the app.
Background work (Android: foreground service)
- Why it is there: Android's background-work library, which updates the home-screen widget and reminders, declares it.
- What we do not do with it: run any other background activity.
- Stored or sent: nothing is sent.
- How to turn it off: remove the widget or turn off the reminder.
Vibration (Android)
- Why we ask: for touch feedback.
- What we do not do with it: anything else.
- Stored or sent: nothing.
- How to turn it off: in Settings in the app.
Network access (Android: internet, network state)
- Why we ask: to reach our servers and tell whether you are online.
- What we do not do with it: determine your location or track you.
- Stored or sent: the data in section 4.
- How to turn it off: these are not user-revocable settings. You can play the cases you have offline.
Google Play billing (Android)
- Why it is there: to let you buy Pro, Case File packs, campaigns, the Season Pass and tip-offs through Google Play.
- What we do not do with it: take any payment outside Google Play. Nothing is charged until you confirm a purchase in Google Play.
- Stored or sent: the purchase data in section 4.
- How to turn it off: this is not a user-revocable setting; you can turn on purchase authentication in Google Play.
Google service permissions (Android: cloud messaging receive, Google services read)
- Why they are there: Google libraries that ship with Firebase sign-in and the Firebase connection declare them.
- What we do not do with them: send push messages, advertise or track you.
- Stored or sent: only the device identifiers described in section 4.
- How to turn them off: these are not user-revocable settings.
9. Who receives data
Service providers
| Recipient | What it does for us | Data |
|---|---|---|
| Google (Firebase) | Sign-in, database, server functions and app attestation | Account identifier, alias, game content, wallet and ledger, purchase status and purchase event records, language, device identifiers and attestation data, rate-limit counters, server logs |
| RevenueCat | In the Android app: manages purchases and subscriptions, checks them with Google Play and tells our server about them; deletes your customer record when you delete your data | Account identifier, purchase status and purchase records, technical store data |
Independent services you choose
| Recipient | What it does | Data |
|---|---|---|
| Apple | App Store distribution, App Attest and DeviceCheck | Attestation data, under Apple's own privacy policy |
| Google Play | Google Play distribution and billing, Play Integrity | Purchase status and attestation data, under Google's own privacy policy |
Sharing you start
If you tap Share result, your device's share sheet opens with a short text and, where available, an image card of your result: the case number or name, your grade, your accusation trail, your streak and your specialty if you picked one, never the answer. It goes only to the app and the people you pick, and we do not receive a copy.
Legal and corporate
We may disclose data to authorities when the law requires it, or to protect rights and safety. If our business is merged or sold, this policy continues to apply to your data.
We do not sell your personal information and we do not share it for cross-context behavioural advertising. We have no actual knowledge of selling or sharing the personal information of anyone under 16.
10. International transfers
Our servers are in the United States. Google Cloud, through Firebase, hosts them for us as our processor: our database (Cloud Firestore) is stored in Google's US multi-region (nam5) and our server functions (Cloud Functions) run in Google's us-central1 region in the United States. Your account identifier, alias, game content, wallet and ledger, purchase status, purchase event records, language and rate-limit counters are therefore stored and processed in the United States, wherever you play from. Sign-in, app attestation and Google's server logs may also be processed in the United States and in other countries where Google or its sub-processors operate. RevenueCat processes purchase data for us in the United States. Apple and Google Play may also process data outside your country, under their own terms.
If you are in the EEA or the UK, this means your data is transferred to the United States. We rely on an adequacy decision where one covers the recipient, such as the EU-US Data Privacy Framework and its UK extension, and otherwise on the standard contractual clauses approved by the European Commission, with the UK addendum for UK data, as included in the data processing terms of Google and RevenueCat. If you are in Türkiye, your data is transferred abroad under article 9 of Law no. 6698, on one of the conditions it sets: an adequacy decision of the Personal Data Protection Board, appropriate safeguards such as a standard contract notified to the Personal Data Protection Authority, or the exceptions listed in the law. You can ask for a copy of the relevant safeguards at zeyrekseyfican@gmail.com.
11. Retention
| Data | How long | What triggers deletion |
|---|---|---|
| Account identifier, alias, game content, language | Until you delete your account | Settings > Delete my data |
| Wallet and ledger, including tip-off purchase entries | Until you delete your account. Ledger entries have no earlier expiry | Settings > Delete my data |
| Pro status on our servers | Until you delete your account | Settings > Delete my data |
| Purchase event records | Until you delete your data, and at most 180 days from the event | Settings > Delete my data, or automatic expiry |
| RevenueCat's purchase record and technical store data | Until you delete your data. RevenueCat's own logs follow its schedule | Settings > Delete my data deletes the customer record at RevenueCat |
| Store purchase records | Kept by Google Play under its own rules | Google Play |
| Rate-limit counters | Each record expires one hour after your last request and is then deleted automatically, normally within a day | Automatic expiry, or at once with Settings > Delete my data |
| Device identifiers, attestation data and server logs | For the period Google (Firebase) sets in its own retention settings; we have not shortened it | The provider's schedule |
| Settings, terms acceptance and offline copy on your device | Until you reset it in Settings > Delete my data, or remove the app | You |
| Widget values | Stored only on your device until you remove the app | You |
We do not delete accounts automatically when they are inactive. If you stop playing or remove the app without deleting your data, your account identifier, alias, game content, wallet and ledger stay on our servers until you delete them in the app or ask us to, as section 12 explains.
Deleted data can remain in encrypted backups and logs for a limited time until they are overwritten. Legal records are kept as the law requires.
12. Account and data deletion
To delete in the app, go to Settings > Delete my data and confirm with Delete everything. You need a connection, and the deletion runs when you confirm. If the deletion cannot finish, nothing is removed and you can try again later.
Deleting your data removes your wallet and its ledger from our servers, including any tip-offs and Merit you hold. Tip-offs and Merit have no cash value and cannot be sold, transferred or exchanged for money. Deletion also removes:
- your alias;
- your game results, streak, XP and stats;
- the Pro status we keep for your account;
- the records of purchase events that name your account identifier;
- your rate-limit record and your anonymous sign-in account;
- the data on your device.
Records of purchase events, which include your account identifier, are deleted when you use Delete my data; otherwise they are deleted automatically 180 days after the event.
Delete my data also deletes your customer record at RevenueCat, including its purchase history. It does not cancel a subscription: cancel it in your App Store or Google Play account settings.
What stays:
- Google Play keeps its own purchase records, and your subscription with the store continues until you cancel it there.
- Aggregate daily statistics that identify nobody, and provider logs at Google (Firebase) and RevenueCat until they age out on the provider's schedule.
The app then starts a new anonymous account. Pro, Case File packs, campaigns, Season Passes and cosmetics can be restored from your store account. Tip-offs cannot. When you restore purchases on another account of yours, they move to that account, and the account they came from no longer has them.
Uninstalling the app does not delete data on our servers.
You can also ask for deletion without the app by writing to zeyrekseyfican@gmail.com. Because the account is anonymous and the app does not show its identifier, we can find it only from details you give us, such as your alias, when you last played or a Google Play order number. If we cannot match the request to an account with reasonable certainty, we tell you and point you to the in-app route.
13. Your rights and choices
Depending on where you live, you can ask to know what we hold, get a copy, correct it, delete it, restrict or object to processing, and withdraw consent where we rely on it. You can complain to us or to an authority.
Ask at zeyrekseyfican@gmail.com, or use the controls in the app. Because accounts are anonymous, we may ask for details such as your alias or a Google Play order number to confirm the request is yours. We answer within one month, within 45 days for US state laws and within 30 days for Türkiye. We do not treat you differently for using your rights. If we refuse a request you can appeal by replying to our message; we answer within the period the law sets. An authorised agent may act for you where the law allows it.
If the data protection law where you live gives you other rights, such as access, correction, deletion or objection, we honour them. Write to us and tell us where you live; we answer within the time your law sets.
14. Additional information for the EEA and UK
Under the GDPR and the UK GDPR and Data Protection Act 2018, you have the rights in articles 15 to 22: access, rectification, erasure, restriction, portability and objection, where the law gives you each right. You can object to processing based on legitimate interests. We do not send direct marketing and we do not make decisions with legal or similarly significant effects by automated means alone. The word filter refuses some aliases automatically, and you can choose another.
You can complain to a supervisory authority where you live or work. In the UK that is the Information Commissioner's Office. If you are in the UK you can also complain to us directly: we acknowledge a complaint within 30 days and investigate without undue delay.
Providing the data marked as required in section 4 is necessary to use the game. It is not a statutory requirement. Without it we cannot provide the service.
15. Additional information for US residents
We extend these rights to all US residents, including under California law.
| Category | Examples | Source | Purpose | Disclosed to |
|---|---|---|---|---|
| Identifiers | Anonymous identifier, alias, device identifiers and attestation data, IP address | You; your device | Service, security | Service providers |
| Commercial information | Purchase status, purchase records and events, store transaction IDs for tip-offs, tip-off balance, ledger | Google Play through RevenueCat; the app | Service, security | Service providers |
| Internet or other electronic network activity | Game results, language, server logs, technical store data | The app | Service, security | Service providers |
| Inferences drawn from personal information | Rank, streak, XP | The app | Service | Service provider |
We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of and we do not process opt-out preference signals for that purpose. We have no actual knowledge of selling or sharing the personal information of anyone under 16. We do not collect sensitive personal information.
You have the right to know, delete and correct, and the right not to be discriminated against for using these rights. Send requests to zeyrekseyfican@gmail.com. We verify a request with details only the account holder is likely to know, such as your alias or a Google Play order number. An authorised agent can submit a request with your written permission. Retention periods are in section 11.
16. Additional information for Türkiye
Under Law no. 6698 on the Protection of Personal Data (KVKK), the data controller is Seyfi Can Zeyrek (trading as Morrowline Apps). We are not currently registered in the Data Controllers' Registry (VERBİS); if an obligation to register arises, we will register and update this text. No separate KVKK representative has been appointed; requests go to the e-mail address below. Our separate Turkish information notice gives the full KVKK information. You have the rights in article 11, including to learn whether your data is processed, ask for correction or deletion, and object to outcomes against you from solely automated analysis. Apply in writing to zeyrekseyfican@gmail.com; we answer within 30 days.
17. Children
Whose Receipt? is not for children under 13. We do not knowingly collect personal data from anyone under that age. If we learn that we have, we delete it. A parent or guardian who believes a child has used the app can write to zeyrekseyfican@gmail.com.
18. Security
We use encrypted connections, access rules that let each user read only their own records, server-side control of the wallet, Pro status and game results, app attestation through App Check, rate limits on requests, and a shared secret that our server checks before it accepts purchase events from RevenueCat. Our providers encrypt stored data at rest.
No system is perfectly secure. Protect your device with a lock. We will notify you and the authorities of a personal data breach as the law requires.
19. Changes to this policy
We may update this policy. For a material change, such as a new type of data, recipient or purpose, we notify you in the app and update the date at the top. If a change means we need your consent, we ask first.
20. Contact
For privacy questions, contact Seyfi Can Zeyrek (trading as Morrowline Apps), Esenyali Mahallesi 52/75 Sk. Izmir/Türkiye, email zeyrekseyfican@gmail.com, telephone +90 555 027 76 81. We aim to answer within the times in section 13. You can also go to your local data protection authority.
Trader contact for EU consumers: Seyfi Can Zeyrek (trading as Morrowline Apps), Esenyali Mahallesi 52/75 Sk. Izmir/Türkiye, zeyrekseyfican@gmail.com, +90 555 027 76 81.
In Türkiye, apply as described in section 16.
