PEKO

Politique de confidentialité

Version: 13 octobre 2026

1. At a glance

PEKO is free. There are no PEKO ads, in-app purchases or subscriptions. A separately connected AI 3D provider can charge the parent under its own plan.
PEKO is designed for children. For privacy purposes, we treat every user as a child.
Drawings, worlds, stories, voice recordings and photos are stored on your device. Sharing, OS backups and optional parent-connected AI 3D generation can send selected copies outside it; section 7.6 explains the AI exception. PEKO does not receive your creations on its servers.
This version has no accounts, no sign-in, no cloud sync, no community and no AI world creation.
Apart from parent-directed sharing, backups and optional AI 3D requests, data sent by the app consists of crash reports, performance summaries and, if a parent turns them on, usage statistics. These contain no name, email address, drawing, voice, photo or advertising ID.
We do not use location, contacts, advertising IDs or tracking across apps. We do not sell data or share it for advertising.
A parent can turn reports and statistics off at any time in Parent area → Info → Reports and usage data.

2. Who we are

PEKO is developed and provided by Sercan Göger, an individual (“Developer”, “we” or “us”). Sercan Göger uses Corylustech as a trade name and brand. “PEKO” and “Peko Games” are brand names. Corylustech is not a separate legal entity.

Sercan Göger is the data controller under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the EU General Data Protection Regulation (“GDPR”), and the operator under the US Children’s Online Privacy Protection Act (“COPPA”).

Name: Sercan Göger (Corylustech)
Address: Turgut Reis Mahallesi, Karaosmanoğlu Caddesi, Esenler / İstanbul
Email: privacy@pekogames.com (privacy, KVKK applications, deletion requests and support)
Website: pekogames.com

EU and UK representative information has not yet been published for this pre-release version; contact us for jurisdiction-specific enquiries.

No data protection officer has been appointed. You can use the email address above for every question.

3. Scope of this policy

This policy covers offline functions and, where present, optional parent-connected AI 3D services in this version of the PEKO app for iOS and Android (“PEKO” or the “app”) and the server the app connects to.

The pekogames.com website has its own privacy policy and cookie policy.
Apple App Store and Google Play process data under their own privacy policies when you download the app.
Read this policy together with the Terms of Use and Children and Families.

4. PEKO is designed for children

PEKO is designed primarily for ages 6–12. Store age ratings describe content suitability and may differ by store or territory; they do not verify the user’s age.
We apply the same child-protective data settings to every user. Choosing an older age group does not enable advertising, account creation or additional data collection.
Grown-up setup first asks who will use PEKO. For children under 13, and when age is skipped, an adult check and a parent PIN are required. For ages 13–17, a parent PIN is offered but can be skipped. Adults aged 18 or over are not required to create one. Existing parent PINs remain in place.
The documents are available to read in the app and acceptance is recorded with one confirmation button. For minors, a parent or guardian should handle acceptance. Optional usage statistics remain a separate choice; accepting the documents does not switch them on.
The age group, accepted document version, acceptance time and local acceptance flags stay on the device. The age group is used for the local setup and experience and is not sent to our telemetry service or Sentry.
A maths question or PIN is a local access control, not identity verification or legally verifiable parental consent. Any processing requiring such consent must have an appropriate mechanism before it is enabled.

5. Data that stays on the device

The following data is stored in PEKO’s app storage. We do not receive it on our servers. Parent-directed exports, OS backups and the optional selected-drawing transfer in section 7.6 are separate from ordinary local storage. Uninstalling the app deletes it from the device.

Drawings, worlds and stories: drawings, pages, worlds, objects, world and object names, story texts and thumbnails.
Voice recordings: The microphone is off by default. A parent can turn it on in Parent area → Preferences → Microphone; the device also asks for permission. A recording lasts at most 10 seconds.
Photo to drawing: A photo taken with the camera or chosen from the gallery is turned into lines on the device. The temporary photo file is deleted after the import; only the lines remain.
Photo world backgrounds: A resized copy of the chosen photo is stored inside that world.
AR photos: The last 12 photos taken in augmented reality are kept on the device. When a new one is taken, the oldest is deleted. A parent can share them with the device’s share menu.
Discovery camera: Camera images are processed only in the device’s memory and are never saved. The discovery album keeps only the type of object found, how many times and when.
Progress and rewards: Drawing School progress, guide steps, stickers, course records and similar items.
Device profile name: A nickname picked at random from a list of names on first launch. It is not a real name and is never sent.
Parent settings: a salted hash of the parent code (not the code itself), language and sound preferences, microphone and backup settings, the acceptance record and the child’s age group.
Screen time: daily minutes of use, the daily time limit, the break reminder and a summary of the last 7 days. These are shown only in the parent area.
Local diagnostic files: the on-device crash journal, drawing recognition feedback and local performance measurements a parent starts. These are not backed up and are not sent automatically.
Trash: Removed worlds are kept for 30 days so they can be restored, then removed during the next app cleanup.
Pending report queue: technical events and (if turned on) usage statistics waiting to be sent. See section 7.

Drawing recognition and the discovery camera run on the device’s own processor; no drawing or image is sent to us for them. Read-aloud uses the device’s own speech engine (section 7.5).

Because this data is on your device, you control it. The ways to delete it are described on the Account and Data Deletion page.

iCloud and Android backups: If your device’s backup feature is on, only PEKO’s main database (peko.db) is included. This database holds drawings, worlds, stories and photo backgrounds placed in worlds. Voice recordings, AR photos, exports, the trash, settings and diagnostic files are not included.
The backup is stored in your Apple or Google account under those companies’ terms. We cannot access backups. You can turn backups off or delete them in your device settings.
Exports: A parent can create a .peko.zip backup of a world in Parent area → Worlds and backups. This file also contains that world’s voice recordings and photo backgrounds. The file leaves the device only if the parent shares it or saves it somewhere else. Exports can be turned off in Parent area → Preferences → Local backup export.
Sharing: AR photos, world pictures and backups can be shared with the device’s share menu after the parent code. A shared file goes to the app or person you choose; we do not receive it. Before sharing, check whether the file shows the child’s face, name, home or other people.

7. Data that leaves the device

7.1 Crash reports (Sentry)

When: Only after the Grown-up setup is complete, and only when the app crashes or an error occurs.
Contents: error type, technical stack trace, app version, device model and operating system version.
Not included: name, user ID, account, email address, drawings, voice, photos, screenshots, typed text, logs, session tracking and location. The app removes the IP field and identifying user fields from managed error events; network connection metadata is still processed by the receiving infrastructure. Server-side scrubbing and retention must also be configured before release.
Recipient: Functional Software, Inc. (“Sentry”), US region. Sentry processes this data on our behalf as a service provider.
Why: To find and fix crashes and errors, and to keep the app working and safe.
Default: On, because it is necessary to operate and maintain the app. A parent can turn it off in Parent area → Info → Reports and usage data → Error and performance reports.
Retention: The release retention policy is up to 90 days at Sentry; the project setting must be verified before release.

7.2 Performance diagnostics

When: After the Grown-up setup is complete.
Contents: a frame-rate summary (fps_summary) and a low-memory warning (low_memory); a random session number created anew at each launch; app version; platform; device model family (for example “iPhone14”); memory range; major operating system version.
Not included: any persistent ID, name, account, drawing, voice, photo or free text.
Recipient: our own server, running on Cloudflare’s infrastructure.
Why: To measure and improve how smoothly the app runs on different devices.
Default: On. It is turned off with the same switch as crash reports (Error and performance reports). Turning it off also deletes events waiting on the device.
Retention: A 90-day retention window from server receipt, followed by scheduled cleanup.

7.3 Usage statistics (optional)

Default: Off. Collected only if a parent turns it on in Parent area → Info → Reports and usage data → Usage statistics. While it is off, no event is recorded.
Contents: a random install ID created on the device, a session number created anew at each launch, the events below and the device class information in section 7.2. Event properties are only numbers, yes/no values or short fixed words; for example drawing duration, number of strokes or the general class of a recognised drawing such as “animal”.
Events: app opened (app_open); first-use and guide steps (onboarding_started, onboarding_completed and events starting with first_run_); first drawing and completed drawing (first_drawing_started, drawing_completed); drawing recognition result, general class only (ai_recognition_result); game started (first_game_started, game_started); augmented reality steps and counts (events starting with ar_ and ar_intro_: opening, device support, surface found, placement, play, photo and discovery counts; no image, location or object name); course introduction steps (events starting with course_intro_).
Not included: name, account, advertising ID, device serial number, drawings, voice, photos, typed text and location.
Recipient: our own server, running on Cloudflare’s infrastructure.
Why: To see, in aggregate, which features are used and where children get stuck, and to improve the app. It is not used to build profiles or to show personalised content or ads.
Turning it off: A parent can turn it off at any time. Turning it off deletes events waiting on the device and the install ID. If it is turned on again, a new ID with no link to the old one is created.
Retention: A 90-day retention window from server receipt, followed by scheduled cleanup.

7.4 Fetching app settings and connection data

When the device is online, PEKO fetches current app settings from our server at each launch (for example, which technical events the server accepts). No drawing, name, age group or account data is included in this request; ordinary network metadata such as the IP address is still processed.
As with any internet connection, Cloudflare and Sentry see the device’s IP address during the connection. Our telemetry database does not store raw IP addresses; infrastructure providers process connection metadata for delivery and security.
To prevent abuse, our server uses a short-lived hash of the IP address for rate limiting. Expired rate-limit records are removed by scheduled server maintenance, normally within one day.
Cloudflare may keep short-lived technical logs to operate the server. These logs do not contain request contents.

7.5 Services of the device and platforms

Read-aloud: PEKO reads text aloud with the device’s own speech engine. This engine is provided by Apple, Google or the device maker and is subject to their terms.
AR on Android: On Android, augmented reality runs with Google Play Services for AR. This service is subject to Google’s terms and privacy policy. PEKO does not send camera images.
App stores: Apple and Google may give us aggregate statistics such as download counts, and crash reports only from users who chose in their device settings to share them with developers, under their own policies.

7.6 Optional third-party AI 3D services

Availability. Some builds offer Parent area → AI 3D services. Other builds omit it. This is separate from on-device drawing recognition and from PEKO accounts, cloud saving or AI world creation, which remain unavailable. Nothing is sent to an AI 3D provider just because a child draws. If your build has no AI services option, the following provider transfers do not take place through that feature.

Parent setup. A parent must unlock this area with a PIN (creating one if necessary), connect their own provider account using an API key, review the provider information and make four separate choices covering drawing transfer, possible credits/charges, third-party processing, and reading the provider policies. The service must be enabled before a generation request can run. This local record is not, by itself, legally verifiable parental consent. Provider age restrictions and applicable child-data rules still apply; a parent’s checkbox does not override them.

What is sent and to whom. The selected drawing is rendered as an image and sent directly from the device to the chosen provider, together with generation options, the API credential needed to authenticate the parent’s account, and ordinary network data including the IP address. PEKO’s servers are not a proxy for these requests. Connection tests and balance checks also contact that provider. Task identifiers and status requests are used to retrieve the result. A drawing can itself contain personal information, such as a handwritten name or a recognisable person; do not send such content or sensitive information. The feature is not designed to upload the entire world, voice recordings, AR photos or the child’s age group. Where a build offers realistic pictures and short films (the Pictures and Videos page), each selected drawing is sent the same way as a JPEG image together with one fixed instruction chosen from PEKO’s list; drawings made from a photo cannot be selected, and the provider’s safety checker is never switched off.

The current integration catalogue has connection paths for Meshy AI, Tripo AI, Hyper3D Rodin and Replicate (3D models, and also realistic pictures and short films). Availability is not a statement that a provider approves child use. Higgsfield is not connectable in this version; Peko Local AI is planned, not an on-device 3D generator.

Provider	Privacy information	Terms
Meshy AI	Privacy	Terms
Tripo AI	Privacy	Terms
Hyper3D Rodin	Privacy	Terms
Replicate	Privacy	Terms

Provider use, retention and countries. A provider can associate requests with the parent’s account and process content in other countries. Its terms govern its own handling of inputs, outputs, logs and billing information. Do not assume zero retention, no training, or that a downloadable file’s expiry deletes every provider record. Replicate states that the inputs, outputs and logs of predictions created through its API are removed after one hour by default. In particular, Meshy’s terms allow certain uses of non-Enterprise inputs and outputs for model training; consult the applicable plan and current terms before any upload. PEKO does not grant those providers permission to use content beyond the applicable arrangement, and remains responsible for its own processing and integration obligations. Eligibility, lawful bases, transfers and required parental-consent mechanisms must be resolved before child use is enabled in a release.

Device storage and control. The app stores service settings, local consent records, generation history, task metadata and downloaded models on the device. API keys use iOS Keychain or Android Keystore-backed storage in mobile builds; they are not sent to PEKO’s backend or intentionally included in logs, exports, cloud sync or OS backups. AI settings, jobs, downloaded models and the pictures and films made from drawings are excluded from the app’s OS-backup allowance. Device security is still important; no storage mechanism guarantees absolute safety.

Stopping and deletion. In the parent’s service page, revoking permission or removing the connection deletes the local credential and prevents new submissions. Disabling technical reports does not disable a separately connected AI service. Removing the connection does not delete already-downloaded models, the external provider account or content already submitted. A request already accepted by the provider may continue and may be charged even if the app stops waiting. Revoke the key in the provider account if needed, and use that provider’s privacy contact to request deletion of its copies. See Data deletion.

8. Persistent identifiers and internal operations

The random install ID used while usage statistics are on, and the IP address seen during a connection, count as “persistent identifiers” under some laws (for example COPPA).
We use these identifiers only to support the internal operations of the app: to make network connections, to maintain and analyse how the app works, to keep it secure and to prevent abuse.
We do not use them, and do not let anyone use them, to contact a specific person, to build a profile of a person, for behavioural advertising or for any other purpose.
Our safeguards: The install ID is random and is not linked to an account, a name or a device identifier. Raw IP addresses are not stored in our telemetry event table. A hash is pseudonymous, not a guarantee of anonymity. Service providers process data only on our behalf.

9. What we do not do

We do not show ads. We do not use ad networks, advertising IDs (IDFA, AAID) or advertising software.
There are no in-app purchases or subscriptions.
We do not track users across apps or websites.
The app does not request location, contacts, phone numbers or email addresses. If you contact support, we receive the contact information and message you choose to send.
We do not sell or rent personal data or share it for advertising. We do not work with data brokers.
We do not build profiles. We make no decisions based solely on automated processing that have legal or similarly significant effects on you.
There is no chat, messaging, commenting, friend list or other social feature.

10. Features not available in this version

This version does not include the following. They may appear in the app as “coming soon”:

creating an account and signing in;
cloud saving and syncing between devices;
sharing worlds in a community and browsing community worlds;
AI world creation through PEKO accounts. The separate parent-connected AI 3D feature is described in section 7.6.

If any of these is introduced, we will first update these documents and notify parents in the app. Before the feature can be used, we will ask for verifiable parental consent as the law requires and, where needed, explicit consent.

11. Recipients and service providers

Parent-connected AI 3D providers receive selected drawings and account credentials directly as described in section 7.6. They are not simply another crash-reporting recipient; their own content, account and billing processing also applies.

Recipient	Role	Data	Location
Functional Software, Inc. (Sentry)	Crash reporting; processes on our behalf	Crash reports (section 7.1)	US
Cloudflare, Inc.	Hosting of our server; processes on our behalf	Performance diagnostics, usage statistics, connection data	Global network, including the US
Apple and Google	App store and operating system; under their own policies	Download information, backups in your own account, device services	Under their own policies
Competent public authorities and courts	Only where the law requires it	Data requested and held by us	Relevant country

There are no advertising networks or data brokers among our recipients. Infrastructure, platform and support providers have the roles described here and in the website privacy policy.
If the Developer transfers PEKO to a company he sets up in the future or to another successor, data may be transferred together with the protections in this policy. We will tell you in the app beforehand.

12. International transfers

Optional AI 3D transfers also require the separate provider-specific assessment in section 7.6; the following describes technical reporting.

Sentry processes crash information in its US region; Cloudflare uses an international network. Technical data can therefore be processed outside Türkiye, the EEA or your country.

Where the applicable law requires a transfer mechanism, that mechanism must be established before the relevant processing starts. For Türkiye this requires assessment under KVKK Article 9; for the EEA and UK it requires the applicable adequacy decision or other valid safeguards, where available and relevant to the recipient and transfer. A provider’s general policy alone does not establish our compliance.

This pre-release document does not assert that a Turkish standard contract has already been executed or notified, or that a particular provider certification covers every transfer. Ask privacy@pekogames.com for the transfer safeguards and recipient details applicable to your request. Required provider agreements, regional settings and transfer arrangements must be verified before release.

13. Retention policy

For optional AI 3D, local keys remain until removed/revoked, while local settings, job history and models remain until deleted from the app’s storage. Remote provider retention is separate; deleting local data does not delete provider records. Their input/output, account, billing and security records may have different periods (section 7.6).

We keep personal data only as long as needed for its purpose and never indefinitely. The table below summarises our written retention policy.

Data	Where	How long	How it is deleted
Drawings, worlds, stories, voice recordings, progress, settings, acceptance record, age group	Device	Until you delete them or uninstall the app	In the app or by uninstalling
Worlds in the trash	Device	30 days	Next app cleanup after expiry
AR photos	Device	The last 12 photos	Oldest when a new one is taken; all on uninstall
Temporary photo in photo to drawing	Device	Until the import ends	Automatically
Discovery camera images	Device memory	Never saved	Not saved
Events waiting to be sent	Device	Until sent, at most 90 days	When sent, when the switch is turned off, or after the 90-day retention window
Crash reports	Sentry (US)	Up to 90 days under the release policy	Provider retention setting, verified before release
Performance diagnostics	Our server (Cloudflare)	90 days from receipt	Scheduled cleanup after expiry
Usage statistics	Our server (Cloudflare)	90 days from receipt	Scheduled cleanup after expiry
Connection metadata and IP hash	Infrastructure / rate limiter	No raw IP in telemetry records; expired hashes normally removed within one day	Scheduled maintenance; infrastructure policies also apply
Server technical logs	Cloudflare	A few days, at most 7 days	Automatically
Requests and correspondence by email	Our email account	At most 2 years after the request is closed	Deleted at the end of the period

We keep correspondence for this period so we can show that we answered your request and met our legal obligations.

14. Security

Connections between the device and our server and Sentry are encrypted (HTTPS/TLS).
Technical reporting is minimised to avoid names and contact details. A selected image sent to an optional AI 3D provider may itself contain personal information; review it before sending (section 7.6).
The parent code is stored on the device only as a salted, strongly hashed value.
Access to the server and Sentry accounts is limited to the Developer.
Service providers must be covered by appropriate contractual safeguards before release; configuration and contracts are part of the release verification.
Files on the device are protected by your device’s own protections. The parent code does not encrypt these files. We recommend using a screen lock on your device.

Data breach: If a data breach occurs, we take the necessary measures immediately. Under KVKK, we notify the Turkish Personal Data Protection Board within 72 hours of becoming aware of it and notify the people affected as soon as reasonably possible. Under the GDPR, we notify the competent supervisory authority within 72 hours and, where the risk is high, the people affected. Because we hold no contact details for you, we publish the notice in the app and on pekogames.com.

15. Your rights and how to use them

A parent or guardian exercises the rights on behalf of a child. Users aged 18 or over exercise their own rights.

Data on the device: It is directly under your control. You can view it, delete it, or delete all of it by uninstalling the app.
Stopping collection: Turn off the two switches in Parent area → Info → Reports and usage data. No network data is sent while the device is offline. To stop a connected AI 3D service, use its separate parent controls in section 7.6.
Withdrawing consent: Turning off usage statistics withdraws your consent. Withdrawal does not affect the lawfulness of earlier processing.
Viewing or deleting server data: Write to privacy@pekogames.com. Because server data is not linked to a name, account or contact details, we often cannot tell which records belong to your child. We will explain what we hold and delete everything we can match with the information you give us. Other records are deleted automatically at the end of the periods in section 13.
Response time: Within 30 days for KVKK requests, normally within one month for GDPR requests, subject to lawful extensions communicated in time. Requests are normally free, subject only to lawful exceptions. We ask only for the minimum information needed to confirm that the requester is the parent or guardian.
Complaints: You can complain to the Turkish Personal Data Protection Board in Türkiye (section 16.7), to the data protection authority of your country in the EEA, or to the Information Commissioner’s Office (ICO) in the UK.

Additional rights by country are described in sections 16, 17 and 18.

16. KVKK Information Notice (Türkiye)

This section is prepared to inform data subjects under KVKK Art. 10 and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It is not an explicit consent text.

16.1 Data controller

The data controller is Sercan Göger (Corylustech). Address: Turgut Reis Mahallesi, Karaosmanoğlu Caddesi, Esenler / İstanbul. Email: privacy@pekogames.com.

16.2 Data processed, purposes and legal grounds

Processing	Data	Purpose	Legal ground
Crash reports	Error type, stack trace, app version, device model, OS version (transaction security)	To detect and fix errors and keep the app secure and available	KVKK Art. 5(2)(f): legitimate interest
Performance diagnostics	Frame-rate summary, low-memory warning, random session number, device class (transaction security)	To measure and improve performance	KVKK Art. 5(2)(f): legitimate interest
Usage statistics	Random install ID, usage events, device class	To analyse feature use in aggregate and improve the app	KVKK Art. 5(1): explicit consent of the parent or guardian
Connection and security	IP address (not stored in the telemetry event table), short-lived IP hash, technical logs (transaction security)	To make the connection, prevent abuse and keep information secure	KVKK Art. 5(2)(f): legitimate interest
Applications and contact	Name, email address, request contents, where needed information showing you are the parent or guardian (identity, contact)	To answer the application, meet legal obligations and protect rights	KVKK Art. 5(2)(ç): legal obligation; Art. 5(2)(e): establishing, exercising or protecting a right

The local data in section 5 is not transferred to PEKO servers; optional AI 3D transfers are described separately in section 7.6.

For processing based on legitimate interest, we protect children’s fundamental rights and freedoms by minimising data, designing it to carry no identity and letting the parent turn it off.

16.3 Method of collection

Crash reports, performance diagnostics, usage statistics and connection data: through the app, electronically, by automated means.
Applications: when you send them by email or in writing.

16.4 Transfers

Abroad: Sentry for crash reporting and Cloudflare for hosting, as described in section 12. The necessary transfer mechanism must be established under KVKK Article 9; this text is not proof of an executed or notified contract.
In Türkiye: to competent public authorities and courts, only on request and within a legal obligation.
We do not sell data. Support correspondence is also handled by the email provider described in the website privacy policy.

16.5 Children’s data

Persons under 18 are minors. A parent with parental authority or a guardian acts on the minor’s behalf.
Only the parent or guardian gives explicit consent for usage statistics. Giving explicit consent is not a condition for using PEKO, and it can be withdrawn at any time with the same switch.

16.6 Your rights (KVKK Art. 11)

Everyone has the right, by applying to the data controller, to:

learn whether their personal data is processed,
request information about it if it has been processed,
learn the purpose of processing and whether the data is used for that purpose,
know the third parties in Türkiye or abroad to whom the data is transferred,
request correction if the data is incomplete or inaccurate,
request deletion or destruction under the conditions in KVKK Art. 7,
request that correction, deletion and destruction be notified to the third parties to whom the data was transferred,
object to a result against them arising from analysis exclusively by automated systems,
claim compensation for damage caused by unlawful processing.

16.7 Applications and complaints

How to apply: Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your application in writing to Turgut Reis Mahallesi, Karaosmanoğlu Caddesi, Esenler / İstanbul, or by email to privacy@pekogames.com signed with a secure electronic signature or mobile signature. For your convenience, we also answer unsigned email applications; in that case we may ask for additional information to verify your identity.
What to include: name, surname and, for written applications, signature; Turkish ID number for Turkish citizens, or nationality and passport or ID number for foreign nationals; residential or business address for notifications; email address and phone number, if any; the subject of the request. If you apply on behalf of a child, state that you are the parent or guardian.
Response: We answer KVKK requests within 30 days. Requests are normally free; a fee is charged only where the law expressly permits it.
Complaint to the Board: If your application is rejected, you find the answer insufficient, or it is not answered in time, you can complain to the Turkish Personal Data Protection Board within 30 days of learning of the answer and in any case within 60 days of the application date (KVKK Art. 14). You must apply to the data controller before complaining to the Board.

17. United States: COPPA notice

Operator: Sercan Göger (Corylustech), Turgut Reis Mahallesi, Karaosmanoğlu Caddesi, Esenler / İstanbul, phone: not yet published, email: privacy@pekogames.com.
Child-directed service: PEKO is primarily directed to children. We therefore treat every user as a child under 13; the age group question does not change this.
What we collect online: the technical data in sections 7.1–7.5; optional AI 3D transfers are separately explained in section 7.6 and are not covered by an internal-operations-only assumption. Technical records may qualify as personal information, including persistent identifiers such as the random install ID while usage statistics are on, and the IP address during a connection. We use them only for internal operations (section 8). Optional AI 3D may involve content and provider account data, so it requires a separate eligibility, consent and transfer assessment before child use.
Audio and photo files: Recordings and photos that may contain a child’s voice or image stay on the device and are not sent to us.
Making information public: PEKO has no public community in this version. External sharing and any provider publication rights must be assessed separately before a parent sends content.
Disclosure: Sentry and Cloudflare receive technical reporting data. Optional parent-connected AI providers receive the selected inputs and account connection described in section 7.6; they have separate terms and processing purposes. Such content transfers cannot be treated as merely internal technical reporting.
Retention: the written retention policy in section 13.
Parents’ rights: To review the information we have collected about your child or to have it deleted, write to privacy@pekogames.com. To refuse further collection, turn off the switches in section 15.
The technical-reporting design is intended to limit identifier use to support for internal operations. Whether the COPPA exception applies depends on the actual data use, service-provider restrictions and release settings; a parent PIN or optional-statistics switch is not itself legally verifiable parental consent. If such a feature is added, we will ask for consent first. We do not make a child’s participation in an activity conditional on giving more information than is reasonably necessary.

Optional AI 3D involves a separate user-requested transfer. An appropriate legal basis, any required parental consent and international-transfer safeguards must be established before enabling child use; the technical-reporting grounds below do not automatically authorise that content transfer.

Controller and representative: section 2.
Legal basis (crash reports, performance diagnostics, connection and security): GDPR Art. 6(1)(f), legitimate interests. Our interest is keeping the app stable and safe for children. We minimise data, use no identity and let the parent turn it off.
Legal basis (usage statistics): consent of the holder of parental responsibility under GDPR Art. 6(1)(a) and Art. 8.
Legal basis (applications and contact): GDPR Art. 6(1)(c), legal obligation, and Art. 6(1)(f), legitimate interests.
Requirement: Providing the data is not a legal or contractual requirement. PEKO works without it.
Your rights: access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent. The easiest way to object to processing based on legitimate interests is to turn off the relevant switch. Where we cannot identify you, we may be unable to act on some requests unless you give additional information (GDPR Art. 11).
Transfers: section 12.
Automated decision-making: None.
Complaints: You can complain to the data protection authority of the EEA country where you live, work or where the infringement took place, or to the ICO in the UK.
UK Children’s Code: We use high-privacy defaults. There is no profiling and no location. We do not nudge parents or children towards less privacy; turning a setting off is as easy as turning it on.

19. Other countries

If the law where you live gives you more rights than this policy, we respect those rights. Write to privacy@pekogames.com to use them.

20. Changes

The version of this policy is shown at the end of the document.
We announce changes in the app and publish them on pekogames.com.
For material changes, for example a new type of data, a new recipient, a new purpose or a new online feature, we ask the parent to read and accept the documents again at the next launch. Where needed, we obtain explicit consent or verifiable parental consent beforehand.
We send a copy of earlier versions on request.

21. Contact

Email: privacy@pekogames.com
Post: Sercan Göger (Corylustech), Turgut Reis Mahallesi, Karaosmanoğlu Caddesi, Esenler / İstanbul
Other contact routes and imprint: Support and Contact

For website data and email enquiries, see the website privacy policy.

Last updated: 13 October 2026 · Version 2026-10-13