Effective date: 9 November 2026
Beach Simulator is made and published by sormatch ("we"). This policy explains what the game and this website collect, why, where it's kept and what your rights are. In short: we take only what we need, we don't sell it and we don't use it for advertising.
The short version
- Solo play needs no account, and the game sends us no personal data.
- No analytics, advertising or tracking SDKs. We don't track you across apps or websites.
- Voice chat is relayed live and never recorded.
- Apple or Google take the payment; your card details never reach us.
- You can delete your account at any time, in the game or on the web.
1. What we collect
| Data | When | Why | How long |
|---|---|---|---|
| Username and display name | When you create an account | To identify you and let friends find you | Until you delete your account |
| Email address | When you create an account | Password reset codes, account recovery and support. We don't send marketing email. | Until you delete your account |
| Password hash | When you create an account | To check your sign-in. We store a salted one-way hash (PBKDF2), never the password itself. | Until you delete your account |
| Apple ID identifier | If you use Sign in with Apple | The app-specific user ID Apple gives us and, if you choose to share it, your email (it may be an Apple “Hide My Email” address). | Until you delete your account |
| Session tokens | When you sign in | To keep you signed in. Only a hash is stored, up to 10 devices. | 180 days if unused |
| Game account data | As you play | Pearl balance, owned items, Beach Club expiry, friend code, language | Until you delete your account |
| Friends list | If you add friends | To show who's online and invite them | Until you remove them or delete your account |
| Shared bar saves | If you run a bar with friends | The bar's name, members and game state, so everyone can pick up where they left off | Until the bar or account is deleted |
| Cloud backup | Only if you choose to back up | To move your save to another device (max 512 KB) | Until you delete your account |
| Purchase receipts | If you buy something | To verify the signed Apple/Google transaction, deliver the item and stop the same receipt being used twice | The transaction ID is kept, detached from you, after deletion (see below) |
| IP address | When you connect | Rate limiting against brute force and spam; security | Briefly in memory; a few days in server logs |
2. Voice chat
Voice chat only runs if you turn it on, and that's when we ask for the microphone. Your voice is relayed live through our server only to players in the same room. It is never recorded, stored or listened to, and never sent to any AI or speech recognition service.
3. What stays on your device
Your solo save, settings (sound, language, graphics) and session token are stored only on your phone. Deleting the app deletes them.
4. What we don't do
- We don't show ads or read your advertising ID (IDFA/AAID).
- We don't use analytics or crash-reporting SDKs (Firebase, Facebook, etc.).
- We don't ask for location, contacts, photos or the camera.
- We don't sell or rent your data or share it with data brokers.
5. Who it's shared with
- Cloudflare, Inc. — our game server, database, email sending (password reset codes) and this website run on Cloudflare. Data may be processed in Cloudflare data centres around the world.
- Apple and Google — take payments, give us signed receipts to verify, and provide Sign in with Apple. Their own privacy policies apply.
- Players on your friends list and in your room see your username, display name and online status.
- Authorities, only when the law requires it and only as much as required.
6. Deletion and retention
When you delete your account, your username, email, password hash, sessions, friends list, shared bar memberships, cloud backup, balance and items are deleted immediately. Only purchase transaction IDs are kept, with the link to you removed, to stop receipts being reused and for tax/accounting duties. Server logs expire on their own within a few days.
7. Security
All connections are encrypted with HTTPS/WSS. Passwords are stored as salted PBKDF2 hashes, sign-in attempts are rate limited, and changing your password signs out other sessions. No system is perfect; if a breach happens we'll tell you as the law requires.
8. Children
Beach Simulator is designed for adults (18+) and is not directed at children under 13. We don't knowingly collect personal data from children under 13. If you think a child has made an account, write to us and we'll delete it. See also Child Safety Standards.
9. Your rights (GDPR and KVKK)
Under the EU General Data Protection Regulation (GDPR) and Turkey's KVKK (Law No. 6698), you have the right to access, copy, correct and delete your data, to object to or restrict processing, and to data portability. We process your data to perform our contract with you (providing the game and your account) and for legitimate interests (security and fraud prevention). Send requests to destek@hatdustu.app; we answer within 30 days. You can also complain to your local data protection authority.
California residents (CCPA/CPRA): we do not sell or share your personal information.
10. This website
This site uses no cookies and doesn't track visitors. Fonts are loaded from Google Fonts, which means your browser shares your IP address with Google. Cloudflare keeps short-lived access logs for security while serving the site.
11. Changes
If we update this policy we'll change the date above and announce important changes in the game.
12. Contact
sormatch · destek@hatdustu.app