Legal

Privacy Policy

Effective date: May 6, 2026 · Last updated: August 2, 2026

This Privacy Policy explains how BE PLUS S.R.L. ("we", "us", "our") collects, uses, and protects information when you use the BomberzBoard mobile application (the "App"). We respect your privacy and are committed to protecting it through compliance with this policy.

BomberzBoard is published by BE PLUS S.R.L. This policy covers both editions of the App:

• iOS — bundle identifier com.pydevsolutions.bomberzBoard, distributed through the Apple App Store.
• Android — application ID plus.beplus.bomberzboard, distributed through Google Play.

The two editions are the same game and share the same backend, so everything below applies to both unless a point is explicitly marked iOS only or Android only. Platform differences exist mainly where the operating system itself differs: identifiers, push delivery, payment processing, and how you are asked for advertising consent.

1. Information We Collect

We collect the following categories of information when you use the App:

1.1 Account & identity data

• User ID — a unique identifier we generate when you create an account. Used to keep your progress synchronized across sessions and devices.
• Display Name (callsign) — the name you choose for your in-game profile. It is always public to other players on the global Leaderboard, in matchmaking, and during multiplayer matches, regardless of the in-app "Activity in Intel Feed" privacy setting. Choose a callsign you are comfortable showing publicly.
• Anonymous device account — on both platforms the App creates your account automatically on first launch, with no email, name, or password. It is bound to a cryptographic key held on the device (in the iOS Keychain, in the Android Keystore), which is what proves the device is yours on later launches. Playing does not require you to identify yourself to us at all.
• Sign-in identity — you may optionally sign in to link that anonymous account to an identity, so you can recover it on another device. On iOS this is Sign in with Apple (we receive an opaque identity token — no email or real name unless you choose to share them) or Google Sign-In (we receive your email address and Google profile name). On Android this is Google Sign-In (we receive your email address and Google profile name); Android does not offer Sign in with Apple. Sign-in is optional on both platforms — without it, the app runs entirely on the anonymous device account.
• Game Center Player ID (iOS only) — when you choose to sign in to Apple Game Center (optional), we receive your Game Center player identifier (gamePlayerID). We use this only to report achievement unlocks to Apple Game Center on your behalf. We never receive your real name, Apple ID, or email through Game Center. You can use BomberzBoard without signing into Game Center; this is entirely optional. The Android app does not connect to Google Play Games Services; achievements there are tracked only by us.

1.2 Device data

• Device identifier — a random identifier the App generates on first launch and sends when registering your device. It is not a hardware serial or an operating-system identifier, it is ours alone, and it cannot be used to recognize you in any other app. On iOS it is stored in the Keychain; on Android it is stored in the app's private storage. We use it to register the device, to keep your session valid, and to prevent duplicate accounts on the same device.
• Analytics install identifier — a per-installation identifier used to measure retention (how many players come back) and to group installs by cohort. On iOS this is a random identifier held in the Keychain. On Android it is Settings.Secure.ANDROID_ID, the identifier Android scopes to our app's signing key: it is unique to this app on this device, is not shared with other developers' apps, and is reset by a factory reset. Both survive reinstalling the App, which is exactly what makes retention measurable; neither identifies you personally.
• Push notification token — so we can send you gameplay-related notifications (daily missions, tournament reminders). Issued by Apple Push Notification service (APNs) on iOS and by Firebase Cloud Messaging (FCM) on Android.
• Device model + operating system version — for example "iPhone 15 Pro, iOS 18.4" or "Pixel 7, Android 14". Included in diagnostic logs to help us reproduce and fix bugs, and recorded with analytics events.
• App version — to correlate issues with specific releases.
• Advertising identifier — used by our advertising partner (Google AdMob) to serve relevant rewarded video ads. On iOS this is the IDFA, and only if you grant tracking permission via the App Tracking Transparency prompt. On Android the equivalent is the Advertising ID (AAID). See Section 5: rewarded ads are currently served only in the iOS app, so no advertising identifier is read on Android today.

The App does not collect your contacts, photo library, microphone, calendar, health data, or files, and does not read any cross-app operating-system identifier beyond the advertising identifier described above. Camera and compass access are both optional, local to your device, and covered in Sections 1.5 and 1.6.

1.3 Gameplay & purchase data

• Game outcomes — match results (win/loss), tournament participation, daily mission progress, login streaks.
• Currency balances — fuel, medals, insignia, plane skins, and other in-game inventory.
• Friend & rival connections — the user IDs of players you've added as friends or rivals, and gifts sent or received.
• Achievement progress — counters that track your progress toward in-game achievements (e.g. number of PvP wins, login streak days, fleet variety used). On iOS, if you sign in to Apple Game Center, achievement unlocks are also reported to Apple Game Center under your Game Center Player ID so they appear in your Game Center profile. On Android, achievements are held only on our own backend.
• Purchase history — records of in-app purchases (which pack you bought, when, and whether the purchase was successful, refunded, or restored). Payment is processed by Apple on iOS and by Google Play on Android — we never see your card number, billing address, or full transaction details.
• Ad interaction events (Advertising Data) — when an advertisement is shown to you and when you complete a rewarded video ad. We log these events for reward grant verification, ad-funnel analytics, and they are correlated by our advertising partner (Google AdMob) for ad personalization when you grant tracking consent. This applies wherever ads are served; see Section 5 for which platforms that is today.
• In-app analytics events — we record first-party product-analytics events (for example: screens viewed, buttons tapped, matches started and finished, tournament participation, purchases, and ad views), linked to your User ID and to the analytics install identifier described in Section 1.2. Each event also records which platform it came from, so we can compare how the game behaves on iOS and on Android. These events are sent to our own analytics service hosted on our AWS infrastructure — not to a third-party advertising network — and are used only to understand how the game is used and to improve it.

1.4 Diagnostic data

• Crash logs — automatically generated when the App stops unexpectedly, so we can fix the issue.
• Error events — non-fatal errors logged with anonymized context (no personal identifiers other than the User ID).
• Performance metrics — aggregate timing data for slow operations.

1.5 Camera access (QR scanning)

BomberzBoard requests camera access for one optional feature: scanning a friend's QR code to join a live multiplayer match. The camera is used only to read the on-screen room code locally on your device. We do not capture, store, transmit, or otherwise collect any photo or video, and the camera is never used for any other purpose. You can decline camera access and still join a match by typing the room code manually. This works the same way on iOS and on Android.

1.6 Compass access (iOS only)

The iOS app asks for "While Using the App" location access for one cosmetic feature: the compass ring on the main menu turns to point at true north. We read the device heading only — the direction the phone is facing — and it is used to rotate a graphic on screen. Your coordinates are never requested, stored, transmitted, or logged, and nothing from this feature reaches our servers or any third party. Declining the prompt costs you nothing: the ring simply stays still and the rest of the game is unaffected. The Android app has no equivalent feature and requests no location permission at all.

2. How We Use Your Data

3. Third-Party Services

BomberzBoard integrates the following third-party services. Each operates under its own privacy policy:

• Apple Sign In (iOS only) — Apple Inc. We do not request your email or name unless you choose to provide them. Apple Privacy Policy
• Apple Game Center (iOS only) — Apple Inc. Optional service that tracks achievement unlocks under your Game Center Player ID and surfaces them in your Game Center profile. Sign-in is voluntary; declining or skipping Game Center does not affect gameplay or in-game rewards. We do not use Game Center leaderboards or multiplayer matchmaking. Apple Game Center Terms · Apple Privacy Policy
• Google Sign-In — Google LLC. Optional authentication method on both iOS and Android. We receive your Google email and profile name. Google Privacy Policy
• Google AdMob — Google LLC. Serves rewarded video ads. Collects the advertising identifier only when you consent (Section 5). AdMob Privacy & Data Policy
• Apple Push Notification Service (APNs) (iOS only) — Apple Inc. Used to deliver in-game notifications.
• Firebase Cloud Messaging (FCM) (Android only) — Google LLC. The Android counterpart of APNs: it issues the token we send notifications to and delivers them. We use Firebase only for messaging; we do not use Firebase Analytics, Crashlytics, or Firebase authentication. Firebase Privacy & Security
• Google Play Billing (Android only) — Google LLC. Processes in-app purchases on Android and returns a purchase token we verify with Google. We never see your payment details. Google Privacy Policy
• Amazon Web Services (AWS) — our backend infrastructure (Lambda, DynamoDB, API Gateway, S3) is hosted on AWS. AWS processes your data only as a service provider on our behalf. Our first-party product-analytics service (see Section 1.3) also runs on this AWS infrastructure. Data is stored in AWS regions us-east-1 and eu-west-1 depending on availability requirements.
• GoatCounter — privacy-friendly pageview analytics on the marketing website bomberzboard.com (NOT inside the App). Cookieless, no IP address storage, no personal data collection by design. We only see aggregated pageview counts, top referrers, and top pages — never individual user behavior. GoatCounter Privacy Policy

4. Data Sharing & Disclosure

We do not sell your personal information.

We share data only in the following limited circumstances:

• With other players — your callsign (display name), in-game rank, and game outcomes are public to other players on the global Leaderboard, in matchmaking, and during multiplayer matches. This is core to the multiplayer experience and applies whenever you play online, independent of the "Activity in Intel Feed" setting (which governs only whether your purchases and gifts appear in the social Intel Feed).
• With our service providers — Google (AdMob, and on Android also Firebase Cloud Messaging and Play Billing), Apple (Sign In, Game Center, push, in-app purchases on iOS), AWS (hosting). Each acts under contractual obligations limiting their use of your data to providing the service to us.
• For legal compliance — if required by valid legal process (subpoena, court order), regulatory request, or to investigate fraud, abuse, or violations of our terms.
• In a corporate transaction — if BE PLUS S.R.L. is acquired, merged, or sells assets, your data may be transferred to the successor entity. You will be notified of any such change in this policy.

5. Advertising and Your Consent

BomberzBoard shows rewarded video ads: short optional ads you choose to watch in exchange for in-game currency. There are no forced ads, no banners, and no interstitials.

5.1 Where ads run today

Rewarded ads are currently served only in the iOS app. The Android app ships with the ads SDK bundled but disabled: it requests no ads, displays none, and does not read your Advertising ID (AAID) while that is the case. If we enable ads on Android, they will work exactly as described here, and Google Play's Data safety disclosure will be updated alongside this policy.

5.2 iOS — App Tracking Transparency (ATT)

iOS requires apps to request your permission before tracking your activity across other apps and websites. BomberzBoard uses ATT for one purpose only: to allow Google AdMob to serve personalized rewarded ads using your IDFA.

5.3 Android — Google's consent form (UMP)

On Android there is no ATT prompt. Where EU, UK, or similar rules require it, we present Google's User Messaging Platform consent form before any ad is requested, and your choice there governs whether AdMob may personalize ads.

5.4 United States

If you are in a US state with an applicable privacy law, we present a "My data preferences" screen with two choices: allow the sale or sharing of your data, or "Don't sell or share my data". Choosing the second tells our advertising partner not to use your personal information to select the ads you see. You may still see ads — they are simply not selected using your data. This is in addition to the iOS ATT prompt described above, not a replacement for it.

5.5 Changing your choices later

On both platforms you can reopen the relevant privacy form at any time from Settings → Privacy → Privacy choices. That row appears only where your region gives you a choice to record — the EEA, the UK, and the US states covered above. On iOS you can additionally change the tracking permission at any time in the system Settings app, under Privacy & Security → Tracking.

5.6 Your choice does not affect your rewards

On either platform, whichever way you choose, you receive identical rewards for watching ads. Declining simply means the ads you see are less personalized.

6. Children's Privacy

BomberzBoard is not directed to children and is not intended for anyone under 13, and it is age-rated accordingly in the stores that distribute it (13+ on the Apple App Store). We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, please contact us at privacy@bomberzboard.com and we will delete it.

7. Your Rights

7.1 European Economic Area / United Kingdom (GDPR)

If you are in the EEA or UK, you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you.
• Right to rectification — correct inaccurate data.
• Right to erasure — request deletion of your account and associated data.
• Right to restriction — limit how we process your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — for processing based on consent (advertising consent: ATT on iOS, Google's consent form on Android).
• Right to lodge a complaint — with your national data protection authority.

Our legal bases for processing under GDPR are: (a) contractual necessity for account, gameplay, and purchase data; (b) consent for personalized advertising, collected through ATT on iOS and Google's consent form on Android; (c) legitimate interests for fraud prevention, analytics, and security.

7.2 United States — California (CCPA / CPRA) and comparable state laws

California residents, and residents of other US states with comparable laws, have the right to: know what personal information we collect; request deletion; opt out of the sale or sharing of personal information (we do not sell); and not be discriminated against for exercising these rights.

You can exercise the opt-out directly in the App, without contacting us: open Settings → Privacy → Privacy choices and select "Don't sell or share my data". See Section 5.4. You may also email us at privacy@bomberzboard.com.

7.3 How to exercise your rights

Contact us at privacy@bomberzboard.com with your request. We will respond within 30 days. We may need to verify your identity before fulfilling certain requests.

8. Data Retention

• Account data — retained while your account is active. If you delete your account, your personal data is removed within 30 days, except for legal/fraud-prevention records retained up to 12 months.
• Purchase history — retained for 7 years to comply with tax and consumer protection law.
• Diagnostic logs — retained for up to 90 days, then deleted automatically.
• Aggregated analytics — anonymized data may be retained indefinitely for product analytics.

9. International Data Transfers

Our backend is hosted on Amazon Web Services. Depending on your region, your data may be processed in the United States or in EU regions. For transfers from the EEA/UK to the US, we rely on the EU–US Data Privacy Framework and AWS's Standard Contractual Clauses where applicable.

10. Security

We protect your data using industry-standard measures: TLS encryption for all data in transit, AWS-managed encryption at rest, scoped IAM permissions, JWT-based authentication, and audit logging. No system is 100% secure — if we become aware of a breach affecting your data, we will notify you within 72 hours per applicable law.

11. Account Deletion

You can request deletion of your account at any time, on either platform:

• From within the App — open Settings → Account → Delete Account and confirm. The path is the same on iOS and on Android.
• By email — privacy@bomberzboard.com with the subject "Delete my account". Use this if you no longer have the App installed.

Deleting the account erases your player record on our servers: your progress, currency, inventory, friends, achievements, and any sign-in link. The App then continues to work as a fresh anonymous account, exactly as on a new install.

Deletion is permanent and cannot be undone. Personal data is removed within 30 days; purchase records are retained as required by tax and consumer protection law (see Section 8).

Whether you have one account or two across platforms depends on how you sign in. The App creates an anonymous account per installation. Signing in with the same provider on both devices — for example Google Sign-In on both your iOS and Android device — links them into one account, so your progress, purchases, and account deletion all apply across both. If you sign in with different providers on each platform (for example Sign in with Apple on iOS and Google Sign-In on Android), we have no way to tell the two accounts belong to the same person, so they remain separate records and deleting one does not delete the other. To keep a single cross-platform account, sign in with the same provider (Google) on every device. You can also email us and name the callsign of every account you want removed.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated through the App or by email. Continued use of the App after a change constitutes acceptance of the updated policy.

13. Contact

If you have any questions, requests, or concerns about this Privacy Policy or our data practices, please contact us at:

• Email: privacy@bomberzboard.com
• Support: support@bomberzboard.com
• Mailing address: BE PLUS S.R.L., Str. Dealul Țugulea nr. 77, etaj 1, birou 2, sector 6, 060865 București, Romania

For EU/UK residents, our designated contact for GDPR-related inquiries is also privacy@bomberzboard.com.