About this policy
Tiki Studios ("Tiki Studios", "we", "us") is an independent mobile studio brand based in Türkiye. We make mobile apps and games, including Basso, Pipzi, PromptMaster and MaskedTalk. This Privacy Policy covers all of them, and every app or game we release in the future.
The policy has two parts. The first part, below, applies to all of our products. The second part has one section per product, describing exactly what that product collects, why, and who processes it. If a product section and the general part differ, the product section is the more specific one and applies to that product.
Some products have extra pages that stay on their own websites. For MaskedTalk these are the Child Safety Standards and Account Deletion pages on maskedtalk.live.
Who is responsible
Tiki Studios is the data controller for the personal data described in this policy. For any privacy question or request, contact us at support@tikistudios.io.
What we collect, in general
What we collect depends on the product. The product sections list the details. Across our products, the categories are:
- Data you give us, such as an email address, username, profile details, messages, photos, reviews or journal entries, in products that have accounts or community features.
- Data created on your device, such as progress, results, settings and preferences. In several products this data never leaves your device.
- Usage and diagnostic data, such as which screens you open, feature events, crash reports and performance data, linked to a random app-instance or installation identifier.
- Purchase data, such as which product you bought and your subscription status. Payments are processed by the app store. We never see your card details.
- Device and advertising identifiers, only in products that show ads, and only as described in the advertising section below.
- Support correspondence, if you email us.
We do not collect precise location in any product. We do not sell personal data.
How and why we use data
We use personal data to:
- Provide the product: run your account, sync your content, deliver messages and calls, and unlock what you paid for. The legal basis is performance of our contract with you.
- Keep products safe: verify age limits, moderate content, prevent fraud and abuse, and respond to reports. The legal bases are our legitimate interests and, where it applies, legal obligations.
- Understand and improve our products: usage analytics, crash reporting and performance monitoring. The legal basis is our legitimate interest in building reliable, useful products. Where a product lets you turn analytics off, the setting is described in its section.
- Show ads in products that contain them. The legal basis is your consent where the law requires it, otherwise our legitimate interest.
- Answer you when you contact support.
- Meet legal obligations, such as keeping purchase records or responding to lawful requests.
For users in Türkiye, these purposes and legal bases correspond to Article 5 of the Personal Data Protection Law No. 6698 (KVKK). For users in the European Economic Area, the United Kingdom and Switzerland, they correspond to Article 6 of the GDPR.
Service providers
We use service providers that process data on our behalf, under their own data-processing terms. Not every product uses every provider; each product section names the ones it uses.
- Google Firebase (Google LLC / Google Ireland Ltd): analytics, crash reporting, performance monitoring, remote configuration, push notifications and, in some products, authentication.
- Google AdMob (Google): advertising, in products that show ads.
- RevenueCat, Inc.: subscription and purchase management.
- Apple, Google Play, Huawei AppGallery and Samsung Galaxy Store: app distribution and payment processing, under their own privacy policies.
- Hetzner Online GmbH: server hosting for products that have a backend. Our servers are in the European Union (Finland).
- Slack Technologies: the internal tool our moderation team uses to review safety reports, where a product section says so.
Advertising and tracking
Only products whose section says so show ads. In those products:
- If you are in the EEA, the UK or Switzerland, or another region where consent is required, Google's consent form asks for your choices before any ad is requested. You can change your choices later in the app's settings.
- On iOS, we ask for permission through App Tracking Transparency before using your device's advertising identifier. If you decline, ads are not personalized.
- On Android, you can reset or delete your advertising ID, or opt out of personalized ads, in your device settings.
Paid plans that remove ads do not request ads.
International transfers
Some of our service providers, including Google and RevenueCat, process data in the United States and other countries. Where data leaves the EEA, the UK, Switzerland or Türkiye, the transfer relies on the safeguards the law provides, such as the European Commission's Standard Contractual Clauses and the providers' data-processing terms.
How long we keep data
- On-device data stays on your device until you delete it in the app or delete the app. Your phone's own backups (iCloud or Google backup) may keep a copy under your control.
- Account data is kept while your account exists and is deleted after you delete your account, as described in the product section.
- Analytics data is kept for up to 14 months. Crash reports are kept for up to 90 days.
- Purchase records are kept as long as needed to restore your purchases and to meet tax and accounting rules.
- Support emails are kept only as long as needed to handle your request.
Product sections give specific retention periods where they differ.
Your rights
Depending on where you live, you can ask us to:
- tell you whether we process your data and give you a copy;
- correct inaccurate data;
- delete your data;
- restrict or object to certain processing, including processing based on legitimate interests;
- give you your data in a portable format;
- withdraw consent at any time, without affecting processing that already happened.
To use these rights, email support@tikistudios.io. For products without accounts, we can only identify data linked to a random app identifier, so deleting the app or its data is often the most complete option. We may need to verify your request before acting on it. We respond within 30 days, or sooner where the law requires.
You can also complain to a data-protection authority. In Türkiye this is the Personal Data Protection Authority (KVKK Kurumu). In the EEA, it is the authority in the country where you live or work.
California and other US states. We do not sell or share personal information for cross-context behavioral advertising, except through the ads in products that show ads, which you can control as described above. We do not use sensitive personal information to infer characteristics about you. You will not be treated differently for exercising your rights.
Children
Our products are not directed to children under 13. Some products have higher minimum ages: MaskedTalk is for adults 18 and over. Product sections state the minimum age and how it is checked.
If you are a parent or guardian and believe a child has given us personal data, contact support@tikistudios.io and we will delete it.
Security
We protect data with encryption in transit (HTTPS/TLS), access controls on our servers, and the app sandboxing and storage encryption of your phone's operating system. Data kept only on your device is protected by your device lock. No system is perfectly secure, so we also try to collect as little as we can.
Our website
tikistudios.io does not use cookies, analytics or advertising. It loads fonts from Google Fonts, which receives your IP address to deliver them. Links to app stores and other websites are governed by those sites' own policies.
Changes to this policy
When we change this policy, we post the new version here and update the date at the top. If a change is significant, we tell you in the affected product or on this page before it takes effect.
Contact
Tiki Studios, Türkiye · Email: support@tikistudios.io
MaskedTalk
MaskedTalk is an anonymous chat app for adults aged 18 and over. Its Child Safety Standards and Account Deletion pages are at https://maskedtalk.live/child-safety and https://maskedtalk.live/delete-account.
Data you give us
- Account: email address and password. Email addresses are not verified by email, and we do not send marketing email.
- Profile: username, date of birth, gender, bio, country and city (chosen from a list), interests and an optional profile photo. Other users see your username, profile photo, bio, interests and the age shown on your profile. Your email address is never shown to other users.
- Content: messages, photos, videos and voice notes you send, stories you post, games you play in chat, and reports and blocks you make.
- Calls: voice and video calls are one-to-one and are not recorded. We keep call metadata: who called whom, when and for how long.
- Optional Spotify connection: if you connect Spotify, we receive the access needed to show the music you choose to share.
Data collected automatically
- Safety and anti-abuse data: IP address, user agent, device model, OS version, a device fingerprint and a hash of your email address. We use these to enforce bans, stop fake and duplicate accounts and investigate abuse.
- Usage data: in-app events, recorded in our own database and in Firebase Analytics, linked to your user ID, country and plan.
- Crash and performance data through Firebase Crashlytics and Performance Monitoring, linked to your user ID.
- Push-notification token through Firebase Cloud Messaging, to deliver message and call notifications.
MaskedTalk does not collect GPS location and does not use advertising identifiers or show ads.
Where data is processed
- Our servers: MaskedTalk's database, file storage and real-time services, and its voice and video call server, run on infrastructure we operate on Hetzner in Helsinki, Finland. To connect calls, your device contacts Google's public STUN servers, which see your IP address.
- Google Firebase: analytics, crash reporting, performance monitoring and push notifications.
- RevenueCat: subscription and purchase management, linked to your MaskedTalk user ID. Apple and Google receipts are also checked by our server.
- Moderation tools: when content is reported or our systems flag an account, our moderation team reviews it in a private Slack workspace (Slack Technologies). Review cards include the usernames and IDs involved, the report reason and description, and the reported conversation. When investigating a report, moderators can look up account details, including email, date of birth, gender, location, bio, message content and attachments, session IP addresses, user agents and device fingerprints.
Safety and moderation
- You must be 18 or older. Sign-up checks your date of birth and our database rejects accounts under 18.
- Profile photos and stories are checked automatically by an image-moderation model running on our own servers. Bios and story text are filtered for abuse, spam and shared contact details.
- Private chats are not automatically scanned. Messages and media sent in private chat are reviewed by our moderation team only when they are reported or an account is under investigation.
- We have zero tolerance for child sexual abuse material and exploitation. We remove it, ban the account and report it to the authorities, as described on our Child Safety Standards page.
- We aim to review reports within 24 hours.
How long we keep data
- Stories: removed one hour after they expire.
- Messages and media, call records: deleted after 30 days.
- In-chat games: deleted after 24 hours.
- Push tokens: deleted after 90 days without use.
- Reports and moderation records: kept as long as needed to keep the platform safe. If you delete your account, reports you made or received are kept without your account attached.
- Banned accounts: when a banned account is deleted, we keep the email address in anonymized form to stop the same person from returning.
Deleting your account
Go to Settings → Account → Delete account and confirm with your password. Your account enters a 30-day grace period, during which you can sign in to restore it. After 30 days, your account and the content linked to it are permanently deleted. Details are on https://maskedtalk.live/delete-account.
To get a copy of your data, email support@tikistudios.io from the address on your account.