Privacy Policy

1. Who We Are

Boolip is operated by Boolip Ltd, a company registered in Israel (company no. 517350443), David Saharov 3, Rishon LeZion, Israel (“Boolip”, “we”, “us”). Boolip is a social arcade: a curated feed of quick mobile games, friend-to-friend duels, and daily leaderboards. This Policy explains what we collect, why, and your rights.

2. What We Collect

Account data.

Your email address, display name, avatar, and any profile information you provide. When you sign in with a third party (Apple or Google), we receive the basic profile fields that provider returns — typically your name, email, and avatar.

Date of birth.

We ask for your date of birth when you create an account. We use it to confirm you meet our minimum age of 13 and to apply the protections required for younger teens: if you are under 18, you can send a game only to accounts you follow. We store the date on your account and never show it to other users.

Activity & content data.

The comments you post, the likes and saves you give, the people you follow, the messages you send to other users, and any gameplay clips you choose to record and share. With each message we also keep who sent it, who received it, the game it shares, and when it was sent and read.

Gameplay data.

Scores, play durations, completion status, duel results, and leaderboard/coliseum progress. We collect this to power leaderboards, challenges, duels, and your own statistics. We generate a random identifier on your device and send it only to Boolip’s servers with gameplay records, including when you play without an account, to understand repeat play and improve games; we do not send this identifier to PostHog or advertising partners. If you allow tracking (section 4), we also record whether the app was installed from an ad and, if it was, which campaign and ad, next to that same random identifier on Boolip’s own servers, so we can see which campaigns bring players who keep playing. That record holds campaign and ad names and identifiers only — no name, email or account — and we do not share it, or the random identifier in it, with PostHog or advertising partners.

Your profile shows anyone, including people without a Boolip account, the five games you have played most and roughly how long you have played each. You can hide them from everyone else with “Hide most played games” when you edit your profile.

Safety & moderation data.

We log reports you file and reports filed against your content or profile, along with the moderation decision and reasoning. This data is used for safety, audit, and to improve our filters.

Technical data.

IP address, user agent, device type, approximate location (country and city, derived from IP), referrer, and usage telemetry (screens viewed, games shown, opened and played, load and start-up times, crashes and memory warnings), and how smoothly games ran on your device (frame timing, no content). We use this for security, abuse prevention, and product analytics.

Search queries.

When you type into a search box (to find games and players, someone to challenge or mention, or a name in a list of followers), the app sends what you type to our servers in the address of the request. We use it to return results; we do not save it to your account or to our database. Because it travels in that address, our hosting provider (Vercel) can record it in its request logs and our crash-reporting service (Sentry) in its error reports, where Sentry’s trail of recent app activity places it next to your pseudonymous user ID once you sign in (both are listed in section 4). We keep those records only to operate search and to diagnose errors, and for no longer than the server logs in section 6. The app also keeps your last few searches on your device so you can repeat them; you can clear them under Recent on the search screen.

Purchase history.

If you buy virtual items (Boolip Coins), we receive from the App Store a record of the transaction: the product you bought, the store’s transaction identifier and receipt, the date, and later refund or revocation events. We use it to credit your balance, to honour refunds, and to prevent fraud. It is linked to your account. We never receive your card number, bank details, or payment-account credentials — the store handles the payment and tells us only that it succeeded.

Character Box openings.

When you open a Character Box, we record which character you received, its rarity, whether the box was free, the odds that were shown to you before you opened it, and the time. We use this record to show your collection, to be able to prove the odds we displayed, and to answer support and refund questions. It is linked to your account.

Boolip Coins balance and history.

We keep your Boolip Coins balance and a record of every Coin you earn, buy or spend: how many, what for, and when. We use it to show your balance, to keep it correct, and to answer refund and support questions. It is linked to your account.

Notifications.

If you enable push notifications, we store a device push token, plus the app version of that device (so an invite is only sent to a device that can open it), so we can send you duel invites, leaderboard updates, and important account notices. Leaderboard updates include a note when another player passes you on the day’s Arena board. You can turn notifications off at any time in your device settings.

Guest notifications.

If you enable notifications without creating an account, we store your device’s push token, language, app version, registration and last-seen times, and whether and when we tried to send each reminder. We use this to send up to two score-to-beat reminders about a Boolip game: one a few hours after you allow notifications, and one around 24 hours after. We also store the country your device registered from, to keep the first reminder out of the night. For each reminder, and when that device later signs up for an account, we keep a record of the platform, country, app version, when the device allowed notifications, which reminder it was and the outcome (with the reason, when a reminder could not be delivered), without your token. This guest record is not linked to a Boolip account or our gameplay installation identifier. You can stop notifications in your device settings.

3. How We Use Your Data

• To provide and operate the Service (create your account, serve games, host your content);
• To power social features — leaderboards, duels, follows, and messages;
• To process purchases of virtual items, credit balances, and handle refunds and chargebacks;
• To moderate content and enforce our Terms (reports, review, enforcement actions);
• To prevent fraud, abuse, and unauthorized access (rate limits, anomaly detection);
• To communicate with you about your account, safety reports, or material policy changes;
• To open the app on the game a Boolip link shows: when you open a boolip.com game link on your phone, we add one to an hourly count of opens of that game in your country. The country is read from your IP address at that moment; the address itself is kept only for our usual rate limit and is dropped within an hour. While one game clearly leads those counts, a new install of the Boolip app in that country may start on it. The count holds no address, device or account, and is never used for advertising;
• To improve the Service (which games people enjoy, where the app can be faster or clearer).

4. Third-Party Processors

We share specific data with the following processors strictly to operate the Service. Every processor in the table below is bound by an agreement to protect your data at least as this Policy does. We do not sell your personal data and we do not track you across other companies’ apps or websites. The one exception is install attribution in the Boolip app, to know which ad brought a new player: only if you tap “Allow” when iOS asks, through App Tracking Transparency, whether Boolip may track you, does the app share Apple’s advertising identifier and install details with AppsFlyer and, for installs that came from a Meta ad, with Meta Platforms. Until you answer, and if you choose “Ask App Not to Track”, the app sends nothing to AppsFlyer. Apple’s own SKAdNetwork can still report an install to the ad network that showed the ad, in aggregate and without any identifier, and send AppsFlyer a copy of that report. See the AppsFlyer row below. Meta receives install data from AppsFlyer only after you allow tracking, and uses it under the Meta Business Tools Terms and its own policy.

5. Where Your Data Lives

Our primary database (Neon) is hosted in EU regions. Media and assets are stored on Vercel (multi-region with EU presence). Some processors may process limited data outside the EEA; where required, we rely on Standard Contractual Clauses or other lawful transfer mechanisms.

6. Retention

• Account data: while your account is active, plus up to 30 days after a deletion request.
• After a deletion, an anonymous account record stays, with no email address, name, handle, password or date of birth, so the plays, scores and duel results it took part in stay correct for other players.
• Usage analytics: when you delete your account, we delete your analytics profile and its events at our analytics service (PostHog) within 30 days.
• When you delete your account, we remove installation identifiers from gameplay records linked to that account or the same installations; gameplay statistics remain without that installation link.
• Content you publish (comments, clips): retained while published; removed on takedown and hard-deleted within 30 days.
• Safety & moderation logs and reports: retained 24 months for safety and audit.
• Purchase records (product, transaction identifier, date, refund events): retained while your account is active and for as long as tax and accounting law requires.
• Character Box records (character received, rarity, odds shown, time): retained while your account is active, and after a deletion kept with the purchase records under the anonymous account record.
• Boolip Coins records (your balance, and every Coin you earned, bought or spent, free Coins such as a sign-up bonus or a streak reward included): retained while your account is active, and after a deletion kept with the anonymous account record.
• Your play-streak record (such as your longest streak and any streak freezes): retained while your account is active, and after a deletion kept with the anonymous account record.
• Guest notifications: we retain the token record to prevent repeated score reminders. We remove it when the same token is registered to an account or Apple’s push service reports that it is invalid during a delivery attempt. Turning notifications off does not automatically delete this record. You may request deletion using the contact details below.
• Guest reminder records (one for each reminder and for a later sign-up, without the token): deleted after 180 days.
• Game-link counts (country, game, number of opens): deleted within three hours.
• Server logs: retained up to 90 days for security and debugging.

7. Your Rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to processing, or to lodge a complaint with a supervisory authority. EU residents may exercise rights under the GDPR; California residents may exercise rights under the CCPA. To exercise any right, email support@boolip.com. We respond within 30 days.

Deleting your account.

You can delete your Boolip account and its associated personal data at any time from within the app (Profile → Settings → Account → Delete my account), or by emailing support@boolip.com from your registered address. When you delete your account, we erase your personal data within 30 days, except limited records we are legally required to retain (such as safety logs or fraud-prevention data) as described in Retention above.

8. Cookies & Local Storage

We use a session cookie to keep you signed in, and local-storage entries on your device to remember preferences and app state (for example theme, last-viewed feed position and your last few searches), to keep the random gameplay identifier described in section 2, to count your visits and play days for analytics, and to hold install-measurement events until our analytics service confirms receipt. Once you agree to this Policy (and, in the European Economic Area, the United Kingdom and Switzerland, once you turn usage analytics on), our analytics service (PostHog) also keeps an analytics identifier in a first-party cookie and in local storage on your device. We do not use third-party advertising cookies. Our analytics are first-party and do not identify you across other companies’ sites or apps. In the European Economic Area, the United Kingdom and Switzerland, the visit and play-day counts and install-measurement events are not stored on your device, and our analytics service keeps no identifier there, until you turn on usage analytics in Settings → Account → Privacy.

9. Children’s Privacy

The Service is not directed at children under 13. We do not knowingly collect personal information from children. In the European Economic Area, the United Kingdom and Switzerland, usage analytics beyond the limited list in section 4 run only with the account holder’s separate consent, which users below the age of digital consent in their country (between 13 and 16) cannot give. If you believe a child has provided us with personal information, contact support@boolip.com and we will delete it.

10. Security

We use industry-standard safeguards: encryption in transit (HTTPS/TLS), encryption at rest for our database, strong password hashing, principle-of-least-privilege internal access, automated security monitoring, and regular review of our infrastructure. No method of transmission or storage is 100% secure; we work to continuously improve.

11. Changes to This Policy

We may update this Policy. When we make material changes, we update the “Updated” date above and, where the law requires it, ask you to accept them again.

12. Contact

Privacy questions, data-rights requests, or general support: support@boolip.com.