Boosterr Privacy Policy

1. Who is responsible for your data

The controller is Grupa Kavarito Sp. z o.o., operating the EpicTale Games studio, al. Jana Pawła II 27, 00-867 Warszawa, Poland. Polish tax number (NIP): 5272889906. Company register (KRS): 0000781212.

For questions, privacy requests or requests relating to a child’s data, email play@epictalegames.com. You may also write to the postal address above, marked “Boosterr privacy”.

2. Data used by the game

You can use the current test version with a guest player profile. It does not require an email address, password or Google sign-in. A pseudonymous profile is still personal data when it can be linked to a player.

• Profile and session data: a generated player identifier, alias, profile code, authentication/session information and test-access information. A session credential and settings are also stored in the app’s local data.
• Gameplay and virtual economy: cards and ownership, albums, discoveries, experience, virtual currency, rewards, tasks, game results, marketplace listings, exchanges and transaction histories. Purchases in the current test build are demo transactions, with no real-money charge.
• Optional social features: profile visibility, pinned cards, reactions, wishes, decorations, rankings and exchanges. A profile is private by default. Information you choose to make public may be visible to other players.
• Activity and performance: the current game screen, activity timestamps, frame-rate measurements, game events and operation results linked to the player profile. We use this first-party telemetry to understand performance and faults in the test service.
• Connection logs: the game hosting service records IP addresses, browser or app User-Agent information, requested paths and timestamps for operation and diagnostics.
• Security records: suspected invalid actions, repeated requests, ownership conflicts and related records needed to prevent abuse and protect the game economy.
• Support communications: your email address, message and any information you choose to send us. Do not send passwords, authentication tokens or payment-card details.

Our guest-profile flow does not ask for your real name, phone number, contacts, date of birth or precise GPS location. This does not mean that the app or its advertising provider processes no device or network information.

3. Google advertising and device information

The current Android test build includes the Google Mobile Ads SDK and can request official Google test ads. A test advertisement can still involve communication with Google and processing of device information.

Google describes the SDK’s default data categories as IP addresses, which can indicate approximate location; app and advertisement interactions; diagnostic information; and device or account identifiers, such as advertising or app-set identifiers. What is transmitted depends on the device, SDK configuration and available privacy controls. The current sample-ad configuration applies child-directed treatment and a G content rating; this should not be interpreted as a guarantee that the SDK processes no data.

See Google’s SDK data disclosure, Google’s Privacy Policy and Google’s advertising information. You can manage or reset available advertising identifiers in Android settings. This does not delete your Boosterr player profile.

We do not currently provide real-money purchases or Google player sign-in in this testing version. Adding production advertising, sign-in or purchases will require the corresponding privacy information and controls.

4. Why we use data

• To create and authenticate a player profile, save progress, maintain card ownership and provide game features.
• To operate optional social features and exchanges that a player chooses to use.
• To diagnose performance problems, improve the testing version, secure the service and prevent fraud or misuse.
• To respond to support and privacy requests and meet applicable legal obligations.
• To request and display the test advertisements described above.

Where the GDPR applies, our legal bases are performance of the game service requested by you, legitimate interests in operating a reliable and secure service and resolving enquiries, and applicable legal obligations. Consent applies where the law requires it for a particular activity, including advertising or access to device information. You can object to processing based on legitimate interests and withdraw any consent you have given. Withdrawal does not affect earlier lawful processing.

5. Who receives data

We use Railway for the game backend and storage, Cloudflare for the information website, network delivery and email forwarding, and email-service providers to receive and answer your messages. These providers process the data needed to supply their services, including technical connection information. The game’s Google advertising SDK communicates with Google as explained above.

Other players can receive the information needed for social features, public profiles, rankings, marketplace listings and exchanges. Only make a profile public if you are comfortable sharing its display information.

Data may also be disclosed where legally required, to protect rights or investigate abuse, or as part of a lawful transfer of the service with appropriate safeguards. We do not sell personal data.

Provider information: Railway privacy and Cloudflare privacy.

6. International processing

The current game backend runs in Amsterdam, the Netherlands. Our providers nevertheless operate internationally, and technical logs, support or advertising information may be processed outside Poland and the European Economic Area, including in the United States. Railway states that its logging storage is in the US West region; choosing a European game server does not mean that every provider service processes data only in Europe.

Where a transfer is subject to the GDPR, it must be supported by an applicable legal transfer mechanism, such as an adequacy decision or the European Commission’s standard contractual clauses, as appropriate. Contact us for information about safeguards relevant to your data.

7. Retention and deletion

We retain server-side profiles, progress and gameplay records while they are needed to provide the testing service, handle requests, resolve disputes and protect the game against abuse. The current test service does not automatically erase a server profile simply because you uninstall the app or stop playing. A session expiring does not erase your gameplay data.

You can request deletion of your profile and associated data through the Boosterr data deletion page or by contacting us. Requests are handled manually. We may need limited information to identify the correct profile and verify that you are entitled to make the request.

If particular records must be retained for a legal obligation, security incident or dispute, we will explain the reason and applicable retention criteria when responding. Backup copies are periodically replaced, so deleted data may remain in a backup until that copy is replaced. Railway states that physical log storage has a 90-day retention period, even where a shorter plan-based viewing window applies. Other provider-controlled advertising and infrastructure records are subject to the relevant provider’s policies.

Local settings and session files can be removed by clearing the app’s data or uninstalling it. Doing that alone does not send us a server-side deletion request.

8. Security and device controls

Connections to the game backend use HTTPS. Google states that its Mobile Ads SDK encrypts transferred data using TLS. Player sessions use authentication credentials and the backend checks game actions and ownership. No security measure eliminates every risk; keep your device and session information secure.

Optional game reminders are local device notifications. You can change notification permissions in Android settings. Sound, vibration, visual-quality and language preferences are stored locally. The current Android app does not request camera, microphone, contacts or precise-location permissions.

9. Children and younger players

We recognise that younger players may be interested in Boosterr. The current test build uses generated guest profiles rather than asking players for a real name, email address or date of birth, and its Google test-ad requests use child-directed treatment. These settings do not remove the need to protect children’s data or to obtain parental authorisation where the law requires it.

If you are a parent or guardian and have questions about a child’s profile, or believe information has been provided without required permission, contact us at play@epictalegames.com. We will assess the request, verify authority where necessary and address access or deletion in accordance with applicable law. Do not include unnecessary information about the child.

10. Your privacy rights

Depending on applicable law, you may request access to your personal data, correction, erasure, restriction, portability or an explanation of how it is used. You may object to processing based on legitimate interests and withdraw consent where processing relies on consent. Some rights are subject to legal conditions or exceptions.

Contact play@epictalegames.com with a description of your request and enough information to locate your player profile. We will respond within applicable legal time limits. We may request proportionate verification, but do not send an identity document or secret session credential unless a necessary, secure verification method has been agreed.

You may complain to your local data protection authority. In Poland, this is the President of the Personal Data Protection Office (UODO).

11. This website

The Boosterr information website does not create player accounts, embed advertisements or add analytics cookies. Its pages and images are served by Cloudflare, which processes technical connection information such as IP addresses for delivery, reliability and security. Infrastructure protection may use technical mechanisms independently of the game.

Language links take you to a different page address; we do not store your language choice in a tracking cookie. Contact links open your email application. This website does not collect deletion requests through a web form.

12. Changes and contact

We will update this policy when the way Boosterr handles data changes. The effective date and version are shown on this page. Material changes that require additional information or consent will be addressed as required by applicable law.

Privacy contact: play@epictalegames.com.
Controller: Grupa Kavarito Sp. z o.o., al. Jana Pawła II 27, 00-867 Warszawa, Poland.