Hauling Empire — Privacy Policy
Effective date: October 9, 2026
Who we are: Hauling Empire is developed and operated by Hazım Okutan, an individual developer based in New Jersey, USA ("we", "us"). We decide how your personal data is used (we are the "controller" under the GDPR and the "veri sorumlusu" under Türkiye's KVKK).
Contact: hazimokutan@hotmail.com
This policy explains what data the Hauling Empire app for iPhone, iPad and Android collects, why, how long we keep it, and what choices and rights you have. A Turkish version is also available.
1. Summary
- You can start playing without signing up. The game creates an anonymous account (a random ID) to back up your progress.
- You can protect that account with Sign in with Apple or Sign in with Google, and on iPhone and iPad link Game Center, so you can restore it on a new device.
- Solo mode is single-player. Online mode is one shared world with other players: your username, company name, colour, emblem and bio, your trucks on the map, leaderboard scores, guild activity and the messages you send are visible to other players (see §3).
- We collect gameplay analytics and crash reports to fix bugs and balance the game. You can turn analytics off (see §8).
- In Solo mode, the game offers optional rewarded video ads from Unity LevelPlay on iPhone, iPad and Android: an ad plays only when you tap a "Watch an ad" button, in return for a small in-game reward. There are no banners and no ads that interrupt play. Online mode has no ads. See §5.
- Our ad partner Unity uses device data, and the advertising ID where you allow it, to deliver ads. Before any ad is loaded, the game asks you once whether ads may be personalized; if you say no, Unity shows non-personalized ads. On iPhone and iPad, Unity gets the advertising identifier (IDFA) only if you choose personalized ads and then allow tracking in the iOS prompt. The reward is the same either way, and you can change your choice any time in Settings. We do not sell your personal data for money, and we do not use your account or game data for advertising.
- You can delete your account inside the game at any time.
2. Data we collect and why
| Data | When | Purpose | Legal basis (GDPR / KVKK) |
|---|---|---|---|
| Account ID (random identifier) and sign-in session | When the game first connects to our servers | Run your account, cloud save and online features | Contract |
| Sign in with Apple: Apple's user identifier and the email Apple shares with us (your address or a private "Hide My Email" relay address) | Only if you choose Sign in with Apple | Protect your account and let you restore it | Contract |
| Sign in with Google: your Google account identifier and email address, plus the name and profile-picture link Google puts in the sign-in token (kept by our sign-in provider; the game does not show them) | Only if you choose Sign in with Google | Protect your account and let you restore it | Contract |
| Game Center: your Game Center player ID (team player ID) and a signature from Apple proving it is yours; leaderboard scores and achievements | Only if you use Game Center | Restore your account on a new device; show Game Center leaderboards and achievements | Contract |
| Cloud save: your game progress, company name, map region, a random device ID created by the app (not the IDFA or IDFV) and a device label such as "iPhone" | While you play with an internet connection | Back up and restore your progress | Contract |
| Online profile: @username, company name, colour, emblem, short bio, online status and last-seen time | When you use Online mode | Run the shared world and social features | Contract |
| Shared-world gameplay: your company's game state, your trucks' positions on the in-game map, loads you post or take, plots, contracts with other players, weekly and solo leaderboard scores | When you use Online mode | Run the shared world and leaderboards; detect cheating | Contract; legitimate interest (fair play) |
| Social: friend requests and friendships, blocks, direct messages and guild chat (up to 500 characters each), guild membership | When you use these features | Provide the features you use | Contract |
| Moderation: reports you make or receive (including a copy of the reported text), mutes and bans, your acceptance of the community rules | When a report is made or you accept the rules | Keep the community safe | Legitimate interest |
| Purchases: on iPhone and iPad, Apple transaction IDs, product, purchase / renewal / refund status, price and store country as reported by Apple; on Android, the Google Play purchase token (sent to our server, which checks it with Google; we store only a one-way hash of it), the Google Play order ID, product, purchase / renewal / refund status and store country as reported by Google; and the items you own | When you buy something | Check each purchase with Apple's or Google's servers and deliver it; accounting | Contract; legal obligation (tax, accounting) |
| Usage data (analytics): gameplay events such as app opened, session start / end and length, tutorial steps, jobs, trucks, drivers and buildings, tier reached, daily rewards, online actions, feedback sent — with app version, platform, map region and language. Events never contain your messages, feedback text or email address. | While you play, unless you turn analytics off | Understand how the game is played and improve it | Legitimate interest (you can object — §8) |
| Crash reports: error message and stack trace, error type, app version, platform, OS version, device model, game mode and tier, current screen. Email addresses, IDs, tokens, IP addresses and long numbers are removed on your device before sending. In short, a crash report includes your device model, OS version, app version and the last screen you were on — no personal content (no messages, feedback text or contact details) | When the app crashes or hits an unexpected error | Find and fix bugs | Legitimate interest |
| Feedback you send: category, your text, an optional picture you add yourself, either picked from your photo library or taken with the camera at that moment (the camera opens only if you choose "Take Photo" in the picker; the photo is used only as this feedback picture), your @username, and automatic diagnostics (app version, device model, OS version, screen size, language, time zone and local time, game mode / region / tier / fleet size, current screen, graphics settings, frame rate, recent errors) | Only when you submit feedback | Answer and fix what you report | Legitimate interest; consent for the optional picture |
| Daily reward: your device time zone (for example "Europe/Istanbul") | When you claim a daily reward online | Decide when your day starts; prevent abuse | Contract |
| Install source: where the app was installed from, saved once with your account. iPhone / iPad: Apple's ad attribution token (Apple AdServices; it tells us whether the install came from an Apple Search Ads campaign and which one; no tracking permission and no advertising identifier are used). Android: the Google Play install referrer (the campaign tags of the Play link you opened, for example an invite link with the invite code, and when it was clicked and installed) | Once, after the app is first opened and signed in | Measure which channels bring players; fill in the invite code for you | Legitimate interest (you can object — §8) |
| Ad revenue per player: for each rewarded ad you choose to watch, the estimated revenue the ad network reports (in US dollars), the ad network name, ad format, country and an ad auction ID | When a rewarded ad is shown (Solo mode) | Measure what the free game earns per player so we can keep it free and fair | Legitimate interest |
| Technical data: IP address and request logs, processed by our hosting provider | Whenever the app talks to our servers | Deliver the service; security and abuse prevention | Legitimate interest |
We do not collect: your real-world location (truck positions are positions in the game world), contacts, microphone recordings, camera images (other than a feedback picture you choose to take and send yourself), health data, payment card details (Apple or Google handles payments), or advertising identifiers (where you allow it, the ad partner collects the advertising ID directly from your device, see §5).
Email sign-in exists in the app but is currently switched off. If we switch it on, your email address will be used only to send sign-in codes, and we will update this policy first.
Notifications: the game can show local notifications scheduled on your device (for example, when a delivery finishes). They are created on your device, not sent from our servers. You can turn them off in iOS or Android Settings.
3. What other players can see (Online mode)
Your @username, company name, colour, emblem and bio; your trucks moving on the shared in-game map; your leaderboard ranks and scores; your guild membership; whether you are online (you can turn this off); a small PRO mark next to your company, shown only if you have Hauling Pro and turn "Show Pro badge on my company" on (off by default); loads you post or take on the shared board; your guild chat messages (visible to guild members) and your direct messages (visible to the recipient).
Do not put personal information (real name, phone number, address, social media accounts) in your username, company name, bio or messages. Offensive words are filtered automatically, and you can block or report any player.
If you use Game Center, Apple shows your Game Center name, scores and achievements to other Game Center players according to your Game Center settings. Apple's privacy policy applies to that.
4. How we use data
Only to: provide the game and its online features; back up and restore your progress; verify purchases; moderate the community and act on reports; detect cheating and abuse; fix crashes and bugs; and understand, in aggregate, how the game is played so we can improve it.
We do not use your account or game data for advertising (the ad partner's own collection is described in §5), we do not sell it, and we do not make automated decisions with legal or similarly significant effects on you. Automatic anti-cheat and rate-limit checks may temporarily limit some in-game actions; you can ask us for a human review of any action taken on your account.
5. Who we share data with
We do not sell or rent personal data. We use these service providers, who process data on our behalf:
- Supabase, Inc. — database, sign-in, file storage and server functions. Servers in the United States (AWS us-east-1, Virginia).
- Apple Inc. — Sign in with Apple, Game Center, App Store payments and purchase verification (App Store Server API and App Store Server Notifications). Apple also processes this data under its own privacy policy.
- Google LLC — Google Sign-In (your Google account identifier and email address, see §2), Google Play Billing on Android (payments, and purchase verification through the Google Play Developer API using the purchase token; refund and renewal notices from Google Play) and the Google Play install referrer (§2, Install source). Google also processes this data under its own privacy policy: https://policies.google.com/privacy.
- Unity Technologies (Unity LevelPlay and Unity Ads; Solo mode on iPhone, iPad and Android): optional rewarded video ads. Before any ad is loaded, the app asks you once, on an in-game card, whether ads may be personalized; nothing is sent to Unity before you answer. After that, the Unity software in the app contacts Unity's ad servers when it starts and when an ad is loaded or shown. According to Unity's disclosures it collects, directly from your device, your IP address (from which an approximate location can be inferred), device and operating-system details (model, version, language, screen), app information, device identifiers (the Android advertising ID and app-set ID; on iPhone and iPad the IDFV and, only with your tracking permission, the IDFA), and how you interact with ads (shown, watched to the end, tapped), to deliver and measure ads, limit how often you see them and prevent fraud. If you choose Personalized ads, we tell Unity that you consent to personalized advertising (GDPR) and that you do not opt out of the sale or sharing of personal information (US state laws), and Unity may use this data to show ads based on your interests. If you choose General ads only, we tell Unity that you do not consent and that you opt out of sale and sharing, and Unity shows non-personalized ads (it still uses the data above to deliver and measure ads and to prevent fraud). In both cases we tell Unity that the app is not directed to children. The reward is the same either way, and you can change your choice at any time in the game under Settings or Legal. We send Unity no account, profile or game data; the game itself decides the reward. Unity processes this data under its own privacy policy: https://unity.com/legal/game-player-and-app-user-privacy-policy. On Android you can reset or delete your advertising ID in Android Settings (Privacy > Ads). On iPhone and iPad, the advertising identifier (IDFA) is shared with Unity only if you choose Personalized ads and then tap "Allow" in the iOS tracking prompt that appears right after; without that permission Unity gets no IDFA and shows non-personalized ads. You can change the permission any time in iOS Settings > Privacy & Security > Tracking.
Content delivery services the app contacts directly. To draw the map, your device downloads map tiles from OpenFreeMap (tiles.openfreemap.org, map data © OpenStreetMap contributors). The app's fonts are bundled inside the app, so no font service is contacted. Like any website, this service receives your device's IP address and standard request information (and which map area is being shown). We send it no account or game data. Its own privacy policy applies.
Other players see the information described in §3. We may disclose information when the law requires it, to answer valid legal requests, or to protect the safety of players or the service.
6. International transfers
We and our servers are in the United States. If you play from the EU / EEA, the UK or Türkiye, your data is transferred to the US. For EU / UK data we rely on the safeguards our providers offer (such as the EU Standard Contractual Clauses). For Türkiye, transfers abroad are made under Article 9 of the KVKK (Law No. 6698), using the safeguards available under that article (such as standard contracts) or, where the law requires it, your explicit consent.
7. How long we keep data
| Data | How long |
|---|---|
| Account, cloud save, online profile, company, friends, blocks, direct messages and guild messages | Until you delete your account (the messages you sent are deleted with it) |
| Raw gameplay analytics events | 90 days; then summarised per day (for example "played on this day, N events"). Summaries are kept until you delete your account |
| Your trucks' live positions in the shared world | Overwritten as you play; stale positions are deleted after 90 days |
| Crash reports | 90 days |
| Feedback (text, diagnostics, picture) | 24 months, or until you delete your account, whichever comes first |
| Moderation reports (including the copy of the reported text) | Up to 24 months after the report is resolved. A report stays if the reporter deletes their account, but the reporter's identity is removed |
| Leaderboard history (past weekly and solo results) | Kept after account deletion so past rankings stay intact, shown as "Deleted player" with no link to you |
| Purchase records received from Apple | As long as tax and accounting law requires (up to 7 years); after you delete your account they are kept without your player ID |
| Free-trial claim | Kept after account deletion only as a one-way hash (a scrambled code that cannot be turned back into your Apple ID or email), only to prevent the same Apple ID or email from getting the free trial twice |
| Username of a guest account that was never protected and is inactive for 30+ days | The username is released so others can use it; a record of the release is kept |
| Server backups and hosting logs | Removed on our provider's schedule (typically within 7–30 days) |
When you delete your account, your leaderboard history is kept as "Deleted player", purchase records are kept without your player ID, and the free-trial claim is kept only as a one-way hash to prevent trial abuse. Apart from that we keep only an anonymous counter (date, whether it was a guest account, how many events were deleted) with no identifier.
8. Your choices
- Turn off analytics: Me › Settings › Account & cloud save → turn off "Usage data (analytics)". Events not yet sent are deleted from your device. Crash reports are still sent so we can keep the game stable; they contain no contact details.
- Hide your online status in your online profile.
- Block or report any player from their profile or from a message.
- Delete your account: Me › Settings › Account & cloud save › Delete account. Your account and the data linked to it are deleted from our database straight away (§7 lists the few exceptions). Data stored on your device is not touched; start a new game to reset it. Deleting the app does not delete your account. Subscriptions are billed by Apple or Google — cancel them in iOS Settings → your name → Subscriptions, or in the Google Play Store app → Payments & subscriptions → Subscriptions.
- Permissions (notifications, photos, camera) can be changed in iOS or Android Settings at any time. The photo picker gives us only the picture you choose, and the camera is used only when you take a feedback picture yourself.
9. Your rights
Write to hazimokutan@hotmail.com and include your player ID (shown in Settings) so we can find your data. We may ask you to confirm the account is yours. We reply within the time the law sets (GDPR: one month; KVKK: 30 days; CCPA: 45 days). Using your rights is free.
EU / EEA and UK (GDPR / UK GDPR): access, correction, erasure, restriction, data portability, objection to processing based on legitimate interest (including analytics), and withdrawal of consent at any time. You can complain to your local data protection authority.
Türkiye (KVKK, Article 11): to learn whether your data is processed and to request information about it; to learn the purpose of processing and whether it is used for that purpose; to know the third parties in Türkiye or abroad it is transferred to; to ask for incomplete or incorrect data to be corrected, and for data to be deleted or destroyed, and for these actions to be notified to those third parties; to object to a result against you that arises only from automated analysis; and to claim compensation for damage caused by unlawful processing. You can also complain to the Personal Data Protection Authority (KVKK).
California (CCPA / CPRA) and other US states: the right to know and access, delete and correct your personal information, and not to be discriminated against for using these rights. In the last 12 months we collected the categories in §2 (identifiers, commercial information (purchases), internet or electronic activity (gameplay and diagnostics) and user content) for the purposes in §4, and disclosed them only to the service providers in §5 (in Solo mode, the ad network collects the device information described in §5 when ads are used). We do not sell personal information for money. If you choose "Personalized ads", letting Unity use your device data for interest-based ads may count as "sharing" (cross-context behavioural advertising) under California law; choosing "General ads only" (on the first card or any time in Settings) is your opt-out of sale and sharing, and the ad network is then told so and do not use sensitive personal information in a way that requires a right to limit. An authorised agent can make a request for you with your written permission.
10. Children
Hauling Empire is rated 13+ and is not directed to children under 13 (or under the minimum age for digital consent in your country, which is up to 16 in some EU countries). We do not knowingly collect personal data from children under 13. If you believe a child under 13 has used the game online or given us data, contact us and we will delete the account.
11. Security
Data is encrypted in transit (HTTPS / TLS) and stored with our provider, which encrypts data at rest. Database access rules let each player read and change only their own private data; feedback pictures are stored in a private bucket that only the developer's admin account can read; server keys are never included in the app. No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires.
12. Changes
We will update this policy when the game or our practices change and update the effective date above. If a change is significant, we will tell you in the game before it takes effect.
13. Contact
Hazım Okutan — New Jersey, USA — hazimokutan@hotmail.com