This policy applies to the web version of “Boberek,” its Telegram version, and the Android and iOS apps.

Who is responsible for your data

The game operator and controller of personal data processed for game operation, accounts, progress synchronization, analytics, and support is Maksim Amosov, IE, a sole proprietor in the Republic of Armenia.

The publisher and seller of the iOS app on the App Store is Elena Amosova, a sole proprietor in the Republic of Serbia. She is separately responsible for information she receives for sales, refunds, accounting, and compliance with legal requirements.

Apple independently processes App Store account and payment information under its own privacy notices.

For privacy enquiries or to contact either sole proprietor, email boberek@gull.games.

In short

• You can play without creating a separate account.
• Without a separate account, your game progress is stored on your device and is not sent to the account database.
• Infrastructure providers process standard technical request data to deliver and protect the game.
• In the web and Telegram versions, Vercel Web Analytics collects anonymized usage statistics so that we can understand how the game is used and improve it. This analytics is not used in the Android and iOS apps.
• When the game is launched inside Telegram, the platform provides the game with technical launch data and profile information available to a Mini App.
• If you create or sign in to an account, your account data and game progress are stored so they can be synchronized across devices.
• The web and Telegram versions contain no advertising. In the Android and iOS versions, Google AdMob shows ads to players without Premium.
• Premium can be purchased with Telegram Stars in Telegram, through Google Play on Android, and through the App Store on iOS. We do not receive bank card or bank account details. We keep records of Telegram purchases on our server; Google Play and App Store purchases are not stored on our server, and their status is checked on the device itself. We do not sell personal data.

What data we process

1. Playing without a separate account

The following data may be stored on your device:

• current level and unlocked cards;
• answer statistics;
• travel progress and quiz high score;
• available energy and the time it was last updated;
• selected language, avatar, and other game settings.

This game data is stored in the local storage of your browser or the environment in which the game runs. It is not sent to the account database unless you sign in or use a feature that requires such a transfer.

If you clear the site's data or move to another device without signing in, your local progress may be lost and cannot be restored.

2. Technical data collected when the game loads

As with any online service, our servers and infrastructure providers may automatically process:

• IP address;
• date and time of the request;
• browser or app type and version;
• device type and operating system;
• requested page address;
• technical session identifiers;
• error and security event information.

In the web and Telegram versions, Telegram's Mini Apps library is loaded from telegram.org on every page. It allows the game to work consistently inside the messenger and in a browser. The Android and iOS apps do not load this library. When the library is loaded, Telegram also processes the technical request data listed above, as any provider does when a file is loaded from its server.

This data is needed to deliver the game, maintain sessions, diagnose errors, prevent abuse, and keep the service secure.

We do not request your device's precise location. Infrastructure providers may use the IP address to determine an approximate country or region for routing, security, and service operation.

3. Usage analytics

In the web and Telegram versions, we use Vercel Web Analytics to understand how the game is used, which pages and screens users visit, and what needs improvement. Vercel Web Analytics is not included in the Android and iOS apps.

The following data may be processed for this purpose:

• the page or route viewed;
• date and time of the view;
• referral source (referrer);
• approximate country or region;
• device type, browser, and operating system;
• anonymized visitor and session information needed to count visitors and page views.

Vercel Web Analytics does not use cookies for analytics and stores analytics data in anonymized form. We do not use this analytics data to identify users, serve advertising, track users across websites, or create personal profiles.

We configure analytics so that page addresses, URL parameters, and event names do not contain email addresses, tokens, account identifiers, or other data that directly identifies a user.

4. Advertising in the Android and iOS versions

In the Android and iOS versions, Google AdMob may show ads to players without Premium. To deliver and measure ads, limit their frequency, diagnose problems, and prevent abuse, Google may process:

• the Android advertising ID, the iOS advertising identifier (IDFA) where access is permitted, and similar device identifiers;
• IP address and technical information about the device and app;
• app launch information and interactions with the app and ads;
• privacy choice information and diagnostic data.

The extent of this processing depends on the user's region, device settings, privacy choices, and the type of ads served.

For users in the European Economic Area, the United Kingdom, and Switzerland, we use Google User Messaging Platform (UMP) to request consent where required. You can change or withdraw your choice in the game under “Profile” → “Privacy settings.” This affects future processing but does not undo processing that was lawfully carried out before the change.

On iOS, access to IDFA and tracking that requires Apple's permission are permitted only with authorization through App Tracking Transparency (ATT). You can change this permission in the iOS system settings. UMP choices do not replace ATT permission, and declining tracking does not prevent you from using the game.

5. Telegram version

Telegram processes user data independently under its own terms, policies, and platform settings. We do not control the processing that Telegram performs to operate its app and Telegram accounts.

When the game is launched as a Telegram Mini App, Telegram provides it with a signed initData package containing:

• Telegram user ID;
• name and username, if provided;
• language code;
• a link to the profile photo, if available;
• launch time and package signature.

The game also receives information about the platform and Telegram app version.

The initData information arrives as a single signed package each time the game is launched inside Telegram; Telegram cannot provide only part of the package. Each time the game launches, it sends this package to our server to verify the launch and session.

For players who have not made a purchase, information from the package is not stored after verification. If a player purchases Premium, their Telegram user ID is stored with the Premium status and payment information. The player's name, username, language code, and profile photo link are not stored in these records.

We do not receive the contents of private messages, contact lists, or phone numbers from Telegram unless a user separately provides such data through a Telegram feature. The current version of the game does not require this.

6. Premium and payments

Premium is paid for using Telegram Stars in Telegram, through Google Play on Android, and through Apple In-App Purchase on iOS.

To verify a purchase, provide Premium, restore access, and handle refunds, the following information may be processed:

• the Telegram user ID (which is also the player number), for Telegram purchases;
• the product purchased, Premium type and status, activation date, and expiration date;
• the payment or transaction identifier and technical purchase verification information, such as a purchase token or store receipt;
• payment date and status, the amount in Stars, or the amount and currency where provided by the store;
• refund information, if applicable.

Telegram purchase information is stored on our server together with the Telegram user ID. Google Play and App Store purchase information is not sent to our server: the app verifies the purchase and Premium status with the store on the device itself and stores the result locally. Resetting game progress does not itself cancel a purchase.

Telegram, Google, or Apple handles payment in the relevant version. We do not receive bank card numbers, bank account details, or other payment method details. Elena Amosova receives iOS sales information and Apple reports needed for accounting within her role as publisher and seller.

7. Separate account data

You can use a separate game account in the web and mobile versions. In the web version, you can sign in with Google or with an email address and password; in the Android version, with Google; in the iOS version, with Apple.

When you register or sign in, the following data may be processed:

• email address;
• internal user ID;
• sign-in method and information about account creation and recent use;
• when signing in with Google, your Google ID and available basic profile information, such as your name and profile picture;
• when signing in with Apple, your Apple ID identifier, your email address or, if you chose to hide it, an Apple private relay address, and your name if you chose to share it. Apple provides the name only at the first sign-in; it becomes the player name in your profile;
• when signing in with a password, a secure password hash and data needed for authentication and session management.

We do not see your password in plain text. Authentication is handled by Supabase Auth.

The Telegram version does not create a separate account or allow account sign-in: the player is recognized through Telegram itself. Game progress in this version is stored on the device and is not transferred to a separate game account in the web or mobile versions. Premium status and purchase information are stored separately on our server, linked to the Telegram account, and remain available after progress is reset or the device is changed. They are not transferred to a separate game account in another version.

The account may also store:

• player name and selected avatar;
• current level and unlocked cards;
• answer and completion statistics;
• travel progress and quiz high score;
• available energy and the time it was last updated;
• Premium status, its type, acquisition date, and expiration date;
• related game settings.

When you sign in for the first time, local progress may be transferred to your account so it is not lost and can be used on other devices.

8. Support requests

If you contact us, we process your email address, the contents and date of the correspondence, and any other information you choose to include. We use this data to respond, fulfill your request, resolve disputes, and protect legitimate interests.

If you contact us using the /paysupport command, we also process your Telegram user ID, player number, and the contents of your request.

Why we process data and our legal bases

If applicable law requires a different legal basis for a particular activity, we will rely on the basis required by that law.

Who may receive data

We use the following categories of recipients to operate the game:

• Supabase — authentication, database services, and storage of account data and game progress;
• Vercel and related infrastructure providers — hosting, page delivery, Web Analytics, technical logs, protection, and diagnostics;
• Google — Google sign-in, if the user chooses this option, and processing purchases through Google Play on Android;
• Apple — distribution of the iOS app, processing purchases and refunds through the App Store, purchase verification, and Apple sign-in if the user chooses this option;
• Elena Amosova, a sole proprietor in the Republic of Serbia — information needed for iOS sales and refunds, accounting, and compliance with legal obligations;
• Google (AdMob and User Messaging Platform, UMP) — serving and measuring ads in the Android and iOS versions, managing consent, diagnostics, and protection against advertising abuse;
• Telegram — operation of the Telegram version, launch of the Mini App, and processing of payments in Stars. Telegram's Mini Apps library is loaded from telegram.org on every page of the web version, including when the game is opened in a regular browser. When it loads, Telegram receives the IP address, browser information, and requested page address even if the player does not use Telegram. The Android and iOS apps do not load this library;
• email provider — receiving and sending support emails and service messages;
• government authorities or other parties — only when disclosure is required by law or necessary to protect rights and safety.

Providers process data under their own agreements, policies, and applicable laws. We provide them only with the data needed for the relevant function. App stores and Elena Amosova are independently responsible for processing they carry out for their own purposes within the roles described above.

Where data is processed

Infrastructure providers and their subcontractors may process data outside the user's country, the Republic of Armenia, and the Republic of Serbia. Depending on the selected service region and infrastructure, processing may take place in the European Economic Area and other countries where the relevant providers operate.

Where applicable law requires specific safeguards for international transfers, legally recognized mechanisms are used, including contractual safeguards provided by our service providers.

Analytics, advertising, and payments

In the web and Telegram versions, we use Vercel Web Analytics for anonymized usage statistics and to improve the game. Analytics is not used for advertising, cross-site tracking, or decisions about individual users.

The web and Telegram versions contain no advertising. In the Android and iOS versions, Google AdMob shows ads to players without Premium. Google may process advertising identifiers and the other data listed above, subject to consent and system permissions.

For users in the European Economic Area, the United Kingdom, and Switzerland, consent for advertising data processing is requested through Google UMP where required. You can change or withdraw your choice under “Profile” → “Privacy settings.” Refusing consent does not necessarily remove ads: non-personalized or limited ads may be shown instead.

Premium can be purchased with Telegram Stars in Telegram, through Google Play on Android, and through the App Store on iOS. For Telegram purchases, we receive the information needed to provide Premium, keep a payment record, and handle a refund where applicable. Google Play and App Store purchases are verified by the app with the store on the device itself, and the result is stored locally; purchase information is not sent to our server. The stores handle payments, refunds, and cancellations under their own terms and privacy policies. Bank card and bank account details are not shared with us.

Payments are not accepted in the web version.

This policy will be updated before we enable other payment methods, other advertising providers, other analytics services, or new SDKs.

Cookies, local storage, and sessions

The browser may use local storage, cookies, or similar technologies for game progress, settings, and account functions. The Mini App environment also uses these technologies.

Session data, including access and refresh tokens, is used to verify sign-in and is sent to the authentication service when protected requests are made. Signing out ends the session on all devices; an individual access token may remain technically valid until its short lifetime expires.

Vercel Web Analytics does not use analytics cookies. The web and Telegram versions do not use advertising cookies. In the Android and iOS versions, AdMob may use advertising identifiers and similar technologies subject to device settings, consent, and system permissions.

How long we keep data

• Local progress is stored until it is reset, local storage is cleared, or the game data is removed from the device.
• Account data and synchronized progress are stored while the account exists or for as long as needed to provide the service.
• Premium status and information linking a Telegram purchase to a player are stored for as long as needed to provide and verify purchased access. Records are deleted following a deletion request or discontinuation of the service unless they must be kept longer to comply with the law or resolve a dispute.
• Premium status for purchases made through Google Play or the App Store is stored on the device itself until the app's data is removed, and can be retrieved from the store again.
• Payment and refund information is kept for as long as needed to fulfill the purchase, process refunds, resolve disputes, prevent fraud, and meet accounting, tax, or other legal obligations. It is then deleted or anonymized.
• When an account is deleted, its data is removed from active systems without undue delay. Limited copies may remain temporarily in secure backups and technical logs until they are automatically overwritten under the provider's retention cycle. These copies are not used in the ordinary operation of the game.
• Security logs and technical data are kept only for as long as needed for diagnostics, security, abuse prevention, and compliance with legal obligations.
• Anonymized Vercel Web Analytics statistics are retained according to the limits and settings of our Vercel plan and are used only to understand use and improve the game.
• AdMob data and privacy choices are retained by Google under its settings, policies, and applicable law. Advertising reports available to us are kept for as long as needed for analysis, settlement, abuse prevention, and compliance with legal obligations.
• Support correspondence is kept until the request is completed and then for as long as reasonably needed to confirm that it was handled, resolve a possible dispute, and comply with the law.

Your rights

Depending on applicable law, you may have the right to:

• ask whether we process your personal data and receive a copy of it;
• correct inaccurate or incomplete data;
• request deletion of your data;
• restrict processing;
• receive the data you provided in a portable format;
• object to processing based on legitimate interests;
• withdraw consent where a particular activity is based on consent;
• file a complaint with a data protection authority, including an authority in your place of residence where provided by law.

To exercise your rights regarding data processed by either sole proprietor, email boberek@gull.games. Your request will be handled by the sole proprietor responsible for the relevant processing. We may ask for reasonable proof of identity to avoid disclosing or deleting another user's data.

Resetting progress and deleting an account

You can reset game progress in the game under “Profile” → “Reset progress.” This deletes or resets game data but does not delete the account itself.

The Telegram version has no separate account. Game progress can be reset in the game under “Profile” → “Reset progress.”

To request deletion of your Telegram user ID, Premium status, and purchase information, email boberek@gull.games and include the player number shown by the /paysupport command. To protect your data, we may ask you to confirm the request through Telegram.

We will delete or anonymize data that is no longer needed. Payment information may be retained in a restricted form while required by law or for an unresolved refund or dispute. Once the Premium record is deleted, access cannot be restored from the previous purchase.

You can delete a separate account yourself:

• in the game, under “Profile” → “Delete account” (web version and the Android and iOS apps);
• on the page boberek.gull.games/account/delete — sign in to the account you want to delete and confirm. The page works even if the app has already been removed from your device. It supports Google and email sign-in; an account that uses Sign in with Apple can be deleted in the iOS app or by email request.

Deletion takes effect immediately and cannot be undone. It removes the account (email address, Google or Apple identifier, and sign-in data), the profile (player name and avatar), game progress and energy stored on the server, and the Premium status linked to the account. If you later sign in again the same way, a new empty account will be created.

If the account was created with Sign in with Apple, deleting it in the iOS app also revokes the game's Apple authorization. If revocation fails, the app will tell you, and you can disconnect the game from your Apple ID manually: Settings → your name → Sign in with Apple → Boberek.

Deleting the account does not affect:

• game progress stored on the device itself — it is kept locally and is not part of the account; you can reset it in the game or by clearing the app's data;
• Google Play and App Store purchases — deleting the account does not cancel or refund a purchase. Premium bought through a store will keep working on the device because its status is checked with the store, not on our server. Records of these purchases are kept in Google Play or App Store systems; cancellations and refunds are handled through the store;
• Telegram purchase records — they are linked to the Telegram user ID, not to the account, and are kept under the rules above; their deletion is requested separately as described above;
• your Google, Apple, or Telegram account.

If you cannot sign in, email boberek@gull.games from the address used to register the account. If you no longer have access to that address or the account uses a hidden Apple address, explain the situation and we will offer another reasonable way to verify that the request concerns your account.

Requests requiring manual handling are normally completed within 30 days. If applicable law permits a longer period and the request requires additional verification, we will let you know. Requests made by email are confirmed by a reply.

Children

The game is not directed to children and is not intended for them as its target audience.

The game can be used without a separate account. If a user has not reached the age at which they may independently agree to data processing and online service terms under applicable law, a separate account may be created only with the permission of a parent or legal guardian.

A parent or legal guardian may request information about the processing of a child's data or deletion of the child's game account by emailing boberek@gull.games.

We do not use children's data for advertising or advertising profiles.

Security

We use reasonable organizational and technical measures to protect data. Access to synchronized progress is separated by account identifier. Administrative access is limited to people and providers who need it to operate, secure, and support the service.

No system can guarantee absolute security. If an incident occurs, we will take appropriate action and comply with any notification obligations under applicable law.

Changes to this policy

The date at the top shows when this policy was last updated. If the data, purposes, providers, or game features change, the policy will be updated before the relevant processing begins.

We will notify users of material changes in the game or by another prominent method.

Contact

Game operator and data controller: Maksim Amosov, IE, a sole proprietor in the Republic of Armenia.

iOS publisher and seller: Elena Amosova, a sole proprietor in the Republic of Serbia.

boberek@gull.games