Privacy Policy
Idol Band Manager · Last updated: 15 September 2026The game does not ask you for an email address, phone number, name or social media account. Your account is tied to a random identifier the app generates on your device.
It is, however, an online game: your group's name, line‑up and progress live on our server. They have to — the leaderboard is made of real players, and the only way to keep cheating out is for the server to hold the truth.
There is no analytics software, no crash reporting service and no social media SDK in the game. The single third party is Google AdMob, which serves the rewarded ads — section 6 covers it.
1. Who we are
Idol Band Manager ("the game", "the app") is developed and published by muzo.dev (Muzaffer Uyar & Hicret Uyar). We are the data controller. For anything about this policy: contact@muzo.dev.
This policy covers Idol Band Manager only. Other apps under the muzo.dev name have their own policies.
2. How your account is created
The first time you open the app it generates a random identifier on your device — a string made of a timestamp and random characters. It is kept in the device's secure storage (the iOS Keychain) and your account is tied to it.
That identifier tells us nothing about who you are. It is not Apple's device identifier, not your advertising identifier, not your phone number; it is a number generated for this game alone, and it is never matched against your advertising identifier.
Deleting the game removes the identifier from your device. If you reinstall on the same device a new one is generated, and you cannot get back to your old account.
3. What we keep on the server
Game progress is kept on our server at bandapi.muzo.dev.
The connection is HTTPS only. These are the records we store:
| Record | Contents | Why |
|---|---|---|
| Player | Device identifier, group name, in‑game money, leaderboard scores, sign‑up and last‑seen times | To recognise the account and build the leaderboard |
| Save | Game state: week, season, quests, wardrobe, investments, event history | So you can pick up where you left off |
| Artists | Group members' names, ages, skill values, appearance and clothing | To run the line‑up and the transfer market |
| Market listings | The artist listed, the price, the state of the listing | To run transfers between players |
| Money ledger | In‑game money movements | Anti‑cheat — balances must match movements |
| Profile views | Which account opened which profile | The profile view counter and the achievements tied to it |
| Error log | Error message, shortened stack trace, the screen it happened on, app version, platform | To see what broke in the game and fix it |
None of these records contain a name, email address, phone number, location, address book, photo or payment detail. Your IP address is not stored permanently; server logs keep it briefly for operational reasons and then drop it.
4. What stays on your device
These never leave your phone:
- The device identifier and session key — in secure storage
- Sound and music volume, scene quality level, haptics preference
- Accessibility preferences: reduced motion, high contrast
- A queue of requests that could not be sent (when the connection drops)
- One tutorial flag
5. What is public
Because the game has a multiplayer side, the following is visible to other players:
- Your group's name, genre and position on the leaderboard
- Your monthly listeners, reputation and hype
- Your members' names, roles and the outfits you chose for them
- Your achievements and awards, and the date the group was founded
- How many different players have opened your profile
You write the group and member names yourself. If you put your own name, email address or any other personal detail there, it becomes public. Don't.
Your money, quests, mail, inventory and the details of your save are not public; the profile other players see carries only the fields listed above.
6. Advertising
The game shows rewarded ads through Google AdMob. A rewarded ad only appears when you ask for one — to refill energy, open a crate or speed up a running job. No part of the game is locked behind an ad, and there are no other ad formats (no interstitials, no banners).
To serve the ad, Google processes its own data: the advertising identifier, approximate location (from the IP address), device data and ad interaction data. That data does not reach us and we cannot see it. The details are in Google's advertising policy.
Whether an ad was genuinely watched is reported to our server by Google in a signed callback; the reward is only granted if that signature verifies. That callback does not carry your advertising identifier, only your in‑game account number.
App Tracking Transparency
On iOS, the first time the ad system runs you will see Apple's tracking permission prompt. If you allow it, ads are personalised; if you decline, rewarded ads still work and only the personalisation stops. You can change your mind at any time in iOS Settings → Privacy & Security → Tracking.
7. Notifications
The game reminds you when your energy is full, your crate is ready, the job you started has finished and the daily reward window is open. All of these are scheduled on your device — their timing is known in advance, so we do not need to send push messages from the server. If you decline notification permission, the game works exactly the same.
8. Permissions we ask for
| Permission | What for |
|---|---|
| Notifications | The local reminders above. Optional |
| Tracking (ATT) | Ad personalisation. Can be declined |
| Face ID / Touch ID | To keep the session key in the device's secure storage — when the system requires it |
| Microphone | A category declared by the audio library. The game never opens the microphone and never records |
9. What we do not collect
- Name, surname, email address, phone number, date of birth
- Location data
- Address book, photos, files, calendar
- Health data, payment details
- Analytics: behaviour tracking, session recording, heatmaps — none of it
- Third‑party crash reporting — none; error records go straight to our own server
We do not sell your data, we do not share it with anyone outside the ad network, and we build no profile of you for ad targeting on our side.
10. Where data is processed
The game server runs on a machine operated for muzo.dev, located in Germany — a member of the European Union and the European Economic Area.
If you are in the EEA: your game data stays inside the area. The GDPR applies directly, and there is no transfer of the game's own data to a third country.
If you are in Turkey: your data is transferred abroad for the purposes of the KVKK (Turkey's Personal Data Protection Law No. 6698). The legal basis for that transfer is your explicit consent — by installing and playing the game you consent to it. If you do not wish to consent, you should not use the game, since it does not work without the server. Consent can be withdrawn at any time; withdrawing it means deleting your account (Your data & deletion).
If you are elsewhere: your data is processed in Germany and is likewise covered by the GDPR.
Google AdMob is separate from this: it is a global service and processes ad data on its own infrastructure, in locations it determines. The terms of that transfer are set out in Google's own policy and it does not pass through our server.
11. How long we keep it
Records tied to your account are kept until the account is deleted. Resetting your career deletes your save and line‑up immediately. To have the account itself removed, see section 13.
Error records become useless once the cause is understood and fixed, and are cleared regularly. Market and money records are kept for as long as the account lives, so the economy can be audited for consistency.
12. Security
All traffic between the app and the server is HTTPS. The session key is kept in the device's secure storage and verified by signature on the server. All game progress is calculated on the server; the client cannot write its own score, money or leaderboard position.
No system is perfect. If you find a security flaw, write to contact@muzo.dev. Giving us a reasonable window to fix it before publishing means a great deal to us.
13. Exercising your rights
Under the GDPR and Turkey's KVKK you have the right to access your data and to have it corrected, deleted or its processing restricted. In this game most of that can be done from inside the app:
- See it: nearly all of the data about you is already on the game's screens
- Delete it: Settings → Reset career
- Delete it entirely, request a copy, object: contact@muzo.dev
The details are on the Your data & deletion page. Because the account is anonymous, you need to include your in‑game group name so we can act on the request — there is no other way for us to find the account.
14. Children
The game is not aimed at young children, though its content is suitable for all ages. We do not knowingly collect data from children under 13. The details are on the Children's Privacy page.
15. Changes
This policy is updated as the game changes. The "Last updated" date at the top always shows the version in force. If a change widens the data we collect, we will also announce it inside the game.
16. Contact
muzo.dev — Muzaffer Uyar & Hicret Uyar
contact@muzo.dev