Legal

Privacy Policy

Effective date: May 6, 2026 · Last updated: October 11, 2026

This Privacy Policy explains how BE PLUS S.R.L. ("we", "us", "our") collects, uses, and protects information when you use the BomberzBoard mobile application (the "App"). We respect your privacy and are committed to protecting it through compliance with this policy.

BomberzBoard is published by BE PLUS S.R.L. This policy covers both editions of the App:

• iOS — bundle identifier com.pydevsolutions.bomberzBoard, distributed through the Apple App Store.
• Android — application ID plus.beplus.bomberzboard, distributed through Google Play.

The two editions are the same game and share the same backend, so everything below applies to both unless a point is explicitly marked iOS only or Android only. Platform differences exist mainly where the operating system itself differs: identifiers, push delivery, payment processing, and how you are asked for advertising consent.

1. Information We Collect

We collect the following categories of information when you use the App:

1.1 Account & identity data

• User ID — a unique identifier we generate when you create an account. Used to keep your progress synchronized across sessions and devices.
• Display Name (callsign) — generated by our server when your account is created, in a fixed form such as Rookie-1a2b; it cannot be edited and contains nothing you typed. It is always public to other players on the global Leaderboard, in matchmaking, and during multiplayer matches, regardless of the in-app "Activity in Intel Feed" privacy setting.
• Anonymous device account — on both platforms the App creates your account automatically on first launch, with no email, name, or password. It is bound to a cryptographic key held on the device (in the iOS Keychain, in the Android Keystore), which is what proves the device is yours on later launches. Playing does not require you to identify yourself to us at all.
• Sign-in identity — you may optionally sign in to link that anonymous account to an identity, so you can recover it on another device. On iOS this is Sign in with Apple (we receive an opaque identity token — no email or real name unless you choose to share them). On Android this is Google Sign-In (we receive your email address and Google profile name); Android does not offer Sign in with Apple. Sign-in is optional on both platforms: without it you play on the anonymous device account, but a purchase needs a signed-in account.
• Game Center Player ID (iOS only) — when you choose to sign in to Apple Game Center (optional), we receive your Game Center player identifier (gamePlayerID). We use this only to report achievement unlocks to Apple Game Center on your behalf. We never receive your real name, Apple ID, or email through Game Center. You can use BomberzBoard without signing into Game Center; this is entirely optional. The Android app does not connect to Google Play Games Services; achievements there are tracked only by us.

1.2 Device data

• Device identifier — a random identifier the App generates on first launch and sends when registering your device. It is not a hardware serial or an operating-system identifier, it is ours alone, and it cannot be used to recognize you in any other app. On iOS it is stored in the Keychain; on Android it is stored in the app's private storage. We use it to register the device, to keep your session valid, and to prevent duplicate accounts on the same device.
• Analytics install identifier — a per-installation identifier used to measure retention (how many players come back) and to group installs by cohort. On iOS this is a random identifier held in the Keychain. On Android it is Settings.Secure.ANDROID_ID, the identifier Android scopes to our app's signing key: it is unique to this app on this device, is not shared with other developers' apps, and is reset by a factory reset. Both survive reinstalling the App, which is exactly what makes retention measurable; neither identifies you personally.
• Push notification token — so we can send you gameplay-related notifications (daily missions, tournament reminders). Issued by Apple Push Notification service (APNs) on iOS and by Firebase Cloud Messaging (FCM) on Android.
• Device model + operating system version — for example "iPhone 15 Pro, iOS 18.4" or "Pixel 7, Android 14". Included in diagnostic logs to help us reproduce and fix bugs, and recorded with analytics events.
• App version — to correlate issues with specific releases.
• Advertising identifier — used by our advertising partner (Google AdMob) to serve relevant rewarded video ads. On iOS this is the IDFA, and only if you grant tracking permission via the App Tracking Transparency prompt. On Android the equivalent is the Advertising ID (AAID), which you can reset or delete at any time in the Android settings; where the law requires consent, Google's consent form decides whether it may be used to personalize ads (Section 5.3).
• IP address and approximate location — when an ad is requested, on either platform, Google AdMob receives your device's IP address and derives an approximate location from it (for example your country or city), to select and measure ads and to prevent ad fraud. The App itself never reads your location for this, and we do not receive it from AdMob.

The App does not collect your contacts, photo library, microphone, calendar, health data, or files, and does not read any cross-app operating-system identifier beyond the advertising identifier described above. Camera access is optional, and both the camera and the compass work locally on your device, as Sections 1.5 and 1.6 explain.

1.3 Gameplay & purchase data

• Game outcomes — match results (win/loss), tournament participation, daily mission progress, login streaks.
• Currency balances — fuel, medals, insignia, plane skins, and other in-game inventory.
• Friend & rival connections — the user IDs of players you've added as friends or rivals, and gifts sent or received.
• Invites — if you redeem another player's invite code, we record on your account that you have redeemed one, add one to the inviter's referral count, give both of you the in-game reward, and make you allies unless one of you has reached the allies limit or the inviter has marked you as a foe. Sharing your invite code can also be recorded in the analytics events described below, with the code. Opening an invite link or redeeming a code can be recorded there too, with how the code reached the App but not the code itself. Versions of the App before 1.0.10 could also record the code itself when it came from an invite link that opened the App, from Google Play's install referrer on Android, or, on iOS, from an invite link opened before installing that our server matched to the install by IP address and device characteristics (OS version, screen size, language and region setting, time zone) until October 2026: in versions 1.0.4 to 1.0.9 only after tracking permission was granted, in earlier versions whatever the tracking permission, even when it had been refused. Since then, a code reaches us only when you open an invite link with the App installed, type it in, or, on Android, when Google Play passes the App the link you installed from (the install referrer). We no longer match installs to links by IP address or device characteristics.
• Achievement progress — counters that track your progress toward in-game achievements (e.g. number of PvP wins, login streak days, fleet variety used). On iOS, if you sign in to Apple Game Center, achievement unlocks are also reported to Apple Game Center under your Game Center Player ID so they appear in your Game Center profile. On Android, achievements are held only on our own backend.
• Purchase history — records of in-app purchases (which pack you bought, when, and whether the purchase was successful, refunded, or restored). Payment is processed by Apple on iOS and by Google Play on Android — we never see your card number, billing address, or full transaction details.
• Ad interaction events (Advertising Data) — when an advertisement is shown to you and when you complete a rewarded video ad. We log these events for reward grant verification and ad-funnel analytics. Our advertising partner (Google AdMob) may also use them to personalize ads, within the choices described in Section 5: on iOS only with your tracking permission, on Android as your consent and opt-out choices allow.
• In-app analytics events — we record first-party product-analytics events (for example: screens viewed, buttons tapped, matches started and finished, tournament participation, purchases, and ad views), linked to your User ID and to the analytics install identifier described in Section 1.2. Each event also records which platform it came from, so we can compare how the game behaves on iOS and on Android. These events are sent to our own analytics service hosted on our AWS infrastructure — not to a third-party advertising network — and are used only to understand how the game is used and to improve it.

1.4 Diagnostic data

• Crash logs — automatically generated when the App stops unexpectedly, so we can fix the issue.
• Error events — non-fatal errors, logged with your User ID and technical context only (no other personal identifiers).
• Performance metrics — aggregate timing data for slow operations.

1.5 Camera access (QR scanning)

BomberzBoard requests camera access for one optional feature: scanning a friend's QR code to join a live multiplayer match. The camera is used only to read the on-screen room code locally on your device. We do not capture, store, transmit, or otherwise collect any photo or video, and the camera is never used for any other purpose. You can decline camera access and still join a match by typing the room code manually. This works the same way on iOS and on Android.

1.6 Compass

The compass ring on the main menu turns to point north, a single cosmetic feature. From version 1.0.10 the App works out which way the phone is facing from its motion sensors (accelerometer, gyroscope and magnetometer), which needs no permission; the Android app has always done it this way. iOS versions before 1.0.10 read the device heading from the location service instead and asked for "While Using the App" location access for it; declining left the ring still and the rest of the game unaffected. In every version we read only the direction the phone is facing, never your coordinates, and use it only to rotate a graphic on screen: nothing from this feature is stored, transmitted or logged, and none of it reaches our servers or any third party. Separately from this feature, advertising uses an approximate location derived from your IP address (Section 1.2).

2. How We Use Your Data

3. Third-Party Services

BomberzBoard integrates the following third-party services. Each operates under its own privacy policy:

• Sign in with Apple (iOS only) — Apple Inc. We do not request your email or name unless you choose to provide them. Apple Privacy Policy
• Apple Game Center (iOS only) — Apple Inc. Optional service that tracks achievement unlocks under your Game Center Player ID and surfaces them in your Game Center profile. Sign-in is voluntary; declining or skipping Game Center does not affect gameplay or in-game rewards. We do not use Game Center leaderboards or multiplayer matchmaking. Apple Game Center Terms · Apple Privacy Policy
• Google Sign-In — Google LLC. Optional sign-in method on Android. We receive your Google email and profile name. Google Privacy Policy
• Google AdMob — Google LLC. Serves rewarded video ads. On iOS it reads the advertising identifier only with your tracking permission; on Android it reads the AAID, and your consent choices govern ad personalization (Section 5). On both platforms it receives your IP address and derives an approximate location from it. AdMob Privacy & Data Policy
• Apple Push Notification service (APNs) (iOS only) — Apple Inc. Used to deliver in-game notifications.
• Firebase Cloud Messaging (FCM) (Android only) — Google LLC. The Android counterpart of APNs: it issues the token we send notifications to and delivers them. We use Firebase only for messaging; we do not use Firebase Analytics, Crashlytics, or Firebase authentication. Firebase Privacy & Security
• Google Play Billing (Android only) — Google LLC. Processes in-app purchases on Android and returns a purchase token we verify with Google. We never see your payment details. Google Privacy Policy
• Amazon Web Services (AWS) — our backend infrastructure (Lambda, DynamoDB, API Gateway, S3) is hosted on AWS. AWS processes your data only as a service provider on our behalf. Our first-party product-analytics service (see Section 1.3) also runs on this AWS infrastructure. Data is stored in AWS regions us-east-1 and eu-west-1 depending on availability requirements.
• GoatCounter — privacy-friendly pageview analytics on the marketing website bomberzboard.com (NOT inside the App). Cookieless, no IP address storage, no personal data collection by design. We only see aggregated pageview counts, top referrers, and top pages — never individual user behavior. GoatCounter Privacy Policy

4. Data Sharing & Disclosure

We do not sell your personal information.

We share data only in the following limited circumstances:

• With other players — your callsign (display name), in-game rank, and game outcomes are public to other players on the global Leaderboard, in matchmaking, and during multiplayer matches. This is core to the multiplayer experience and applies whenever you play online, independent of the "Activity in Intel Feed" setting (which governs only whether your purchases and gifts appear in the social Intel Feed).
• With our service providers — Google (AdMob, and on Android also Firebase Cloud Messaging and Play Billing), Apple (Sign in with Apple, Game Center, push, in-app purchases on iOS), AWS (hosting). Each acts under contractual obligations limiting their use of your data to providing the service to us, with one exception: when Google AdMob personalizes ads, Google uses the data it receives for its own advertising purposes as an independent controller, under its own privacy policy and within your choices in Section 5.
• For legal compliance — if required by valid legal process (subpoena, court order), regulatory request, or to investigate fraud, abuse, or violations of our terms.
• In a corporate transaction — if BE PLUS S.R.L. is acquired, merged, or sells assets, your data may be transferred to the successor entity. We will tell you about it as described in Section 12.

5. Advertising and Your Consent

BomberzBoard shows rewarded video ads: short optional ads you choose to watch in exchange for in-game currency. Ads are never forced on you, and there are no interstitials. Some screens show a small banner for our own other apps; we serve it ourselves, with no advertising network involved.

5.1 Where ads run

Rewarded ads are served in both the iOS and the Android app, in the same places and on the same terms described here.

5.2 iOS — App Tracking Transparency (ATT)

iOS requires apps to request your permission before tracking your activity across other apps and websites. BomberzBoard today uses ATT for one purpose only: to allow Google AdMob to serve personalized rewarded ads using your IDFA. Until October 2026, versions 1.0.4 to 1.0.9 of the App also used your permission for the invite-link match described in Section 1.3.

5.3 Android — Google's consent form (UMP)

On Android there is no ATT prompt. Where EU, UK, or similar rules require it, we present Google's User Messaging Platform consent form before any ad is requested, and your choice there governs whether AdMob may personalize ads.

5.4 United States

If you are in a US state with an applicable privacy law, you can opt out of the use of your data for targeted advertising at any time, on your device: on iOS by not granting, or by withdrawing, the tracking permission (Section 5.2); on Android by deleting your Advertising ID in the Android settings, after which Google AdMob cannot use it to select the ads you see. You may still see ads; they are simply not selected using that identifier. You can also contact us at privacy@bomberzboard.com.

5.5 Changing your choices later

On both platforms you can reopen the relevant privacy form at any time from Settings → Privacy → Privacy choices. That row appears only where your region requires a consent form: the EEA, the UK and Switzerland. On iOS you can also change the tracking permission at any time in the system Settings app, under Privacy & Security → Tracking; on Android you can reset or delete your Advertising ID at any time in the Android settings.

5.6 Your choice does not affect your rewards

On either platform, whichever way you choose, you receive identical rewards for watching ads. Declining means ads are not selected using your personal data; in some regions this can mean fewer ads are available to watch.

6. Children's Privacy

BomberzBoard is not directed to children and is not intended for anyone under 13, and it is age-rated accordingly in the stores that distribute it (13+ on the Apple App Store). We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, please contact us at privacy@bomberzboard.com and we will delete it.

7. Your Rights

7.1 European Economic Area / United Kingdom (GDPR and UK GDPR)

If you are in the EEA or UK, you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you.
• Right to rectification — correct inaccurate data.
• Right to erasure — request deletion of your account and associated data.
• Right to restriction — limit how we process your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — for processing based on consent (advertising consent: ATT on iOS, Google's consent form on Android).
• Right to lodge a complaint — with your national data protection authority.

Our legal bases for processing under GDPR are: (a) contractual necessity for account, gameplay, and purchase data; (b) consent for personalized advertising, collected through ATT on iOS and Google's consent form on Android; (c) legitimate interests for fraud prevention, analytics, and security.

7.2 United States — California (CCPA / CPRA) and comparable state laws

California residents, and residents of other US states with comparable laws, have the right to: know what personal information we collect; request deletion; opt out of the sale or sharing of personal information (we do not sell); and not be discriminated against for exercising these rights.

You can opt out of targeted advertising on your device, as described in Section 5.4, or email us at privacy@bomberzboard.com.

7.3 How to exercise your rights

Contact us at privacy@bomberzboard.com with your request. We will respond within 30 days. We may need to verify your identity before fulfilling certain requests.

8. Data Retention

• Account data — retained while your account is active. If you delete your account, your personal data is removed within 30 days, except for legal/fraud-prevention records retained up to 12 months.
• Invite record — that you have redeemed a code is kept while your account exists and erased with it; the alliance lasts until either player removes it or deletes their account.
• Purchase history — retained for 7 years to comply with tax and consumer protection law.
• Diagnostic logs — retained for up to 90 days, then deleted automatically.
• Aggregated analytics — anonymized data may be retained indefinitely for product analytics.

9. International Data Transfers

Our backend is hosted on Amazon Web Services. Depending on your region, your data may be processed in the United States or in EU regions. For transfers from the EEA/UK to the US, we rely on the EU–US Data Privacy Framework and AWS's Standard Contractual Clauses where applicable.

10. Security

We protect your data using industry-standard measures: TLS encryption for all data in transit, AWS-managed encryption at rest, scoped IAM permissions, JWT-based authentication, and audit logging. No system is 100% secure — if we become aware of a breach affecting your data, we will notify the competent supervisory authority within 72 hours where the law requires it, and notify you without undue delay where the breach is likely to put your rights and freedoms at high risk or where applicable law otherwise requires it.

11. Account Deletion

You can request deletion of your account at any time, on either platform:

• From within the App — open Settings → Account → Delete Account and confirm. The path is the same on iOS and on Android.
• By email — privacy@bomberzboard.com with the subject "Delete my account". Use this if you no longer have the App installed.

Deleting the account erases your player record on our servers: your progress, currency, inventory, friends, achievements, and any sign-in link. The App then continues to work as a fresh anonymous account, exactly as on a new install.

Deletion is permanent and cannot be undone. Personal data is removed within 30 days; purchase records are retained as required by tax and consumer protection law (see Section 8).

Whether you have one account or two across platforms depends on how you sign in. The App creates an anonymous account per installation. Signing in with the same provider on two devices links them into one account, so your progress, purchases, and account deletion apply across both. iOS offers Sign in with Apple and Android offers Google Sign-In, so an iOS account and an Android account are separate records: we have no way to tell they belong to the same person, and deleting one does not delete the other. You can also email us and name the callsign of every account you want removed.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated through the App or by email. Continued use of the App after a change constitutes acceptance of the updated policy.

13. Contact

If you have any questions, requests, or concerns about this Privacy Policy or our data practices, please contact us at:

• Email: privacy@bomberzboard.com
• Support: support@bomberzboard.com
• Mailing address: BE PLUS S.R.L., Str. Dealul Țugulea nr. 77, etaj 1, birou 2, sector 6, 060865 București, Romania

For EU/UK residents, our designated contact for GDPR-related inquiries is also privacy@bomberzboard.com.