Privacy Policy

Effective date: 21 September 2026

1. Who is responsible

This policy covers the mobile games operated by BOOPFUN LIMITED ("we", "us"), Rm D07, 8/F, Kai Tak Fty Building, No. 99 King Fuk Street, Sanpokong, Kowloon, Hong Kong, that link to this policy from their store listing or from inside the game ("the games", each "a game"). We are responsible for how we use the information described in this policy.

For privacy enquiries, contact contact@boopfun.com.

A game of ours, or an earlier version of a game, that links to a different privacy policy is covered by that policy instead. Our offline versions, which include none of the analytics and advertising described here, each link to their own.

Not every game uses every service described here. Where a practice applies only to some games or to some app versions, this policy says so. The Data safety section of each game's Google Play listing summarises what that particular game collects and shares.

2. No game account is required

You can play without registering an account or providing your name, email address, phone number or identity documents. The games do not access your camera, microphone, contacts, photos, clipboard or precise device location.

We do not ask you to enter your date of birth or specific age, and the games do not store those details.

If you contact us by email, we receive your email address and the information you choose to include so that we can respond. Please do not send passwords or identity documents unless we have explained why specific information is needed for your request.

3. Game saves on your device

Each game stores progress and preferences on your device. Depending on the game this includes your unlocked levels, the game you are part-way through, your best results, sound and vibration settings, colour theme, tutorial progress, difficulty progression and your acceptance of the terms. We do not provide an account or cloud-save service for these save files.

Separate analytics events describe parts of your gameplay, as explained below. Keeping a save file on your device does not mean that the games collect no online data.

4. Analytics and advertising data

Analytics. We use Google Analytics for Firebase to understand how the games are played. Each game reports to its own Analytics property. It collects an app instance identifier; a random installation identifier that the app generates and keeps in its local data alongside your save (we use it as the Analytics user ID, so that your play history stays with your save if the save is restored from a backup, and, in games that use AppsFlyer, pass the same identifier to AppsFlyer as its customer user ID so that install attribution and analytics refer to the same installation); and, where available, the Android advertising ID; the app set ID, an identifier shared by our apps on the same device that lets us tell whether the same device also played another of our games, and which resets when you uninstall all of them; device and app information such as model, operating system, language and app version; installation-source information; and activity such as first opening the app, sessions and time spent playing. Google derives an approximate location from the connection's IP address. The games do not request GPS location.

The games also send events about playing levels - depending on the game, starting, finishing, restarting, leaving and resuming them, and reviving after losing - and about using the aids a game offers, for example continuing after losing hearts, hints, undos, locators and other helper items, as well as changing the colour theme where a game has one. Depending on the game and the event, these events include relevant level identifiers, the level collection's version, the board size, progress or outcome, time spent, move, retry and failure counts, remaining pieces, and which aid or theme was used. Versions of the games that use AppLovin MAX also send an event each time an ad is shown, with the level being played, the ad format, the in-game placement, the ad network that served it, the ad unit and the revenue that AppLovin reports for that ad. Versions of the games with ad-flow analytics also send Firebase events about opportunities to show ads; decisions to show or skip an ad or, in some games, to provide an aid for free; ad loading and display requests and their success or failure; ad clicks and closing; and whether an ad watched for a reward qualified for it and whether the game delivered that reward. Depending on the game and the event, these include the relevant game context, the aid type, the in-game placement, ad network and unit, elapsed time, error codes and reasons, and randomly generated identifiers that connect the events from the same request or interaction. We use these events to understand ad availability, investigate failed or slow ads and check reward delivery. These additional ad-flow events are sent to Firebase, not AppsFlyer. The games also send events about Google's consent tool described below: each time the game asks the tool whether an advertising choice is needed; where one is, when the consent form starts loading, is about to be shown and is closed; and, in versions with an in-game privacy options entry point, when that form is opened and closed. The event for closing the consent form includes which advertising purposes you agreed to there.

These identifiers and events can distinguish an app installation and describe its activity. They may be personal data even though the games have no account and do not ask for your real name.

Advertising. The games are free and show advertising: banner ads during play, full-screen ads at certain transitions, and optional rewarded video ads that you can choose to watch for an in-game benefit - depending on the game, continuing or reviving after losing, or extra undos, hints, locators or other aids. Which advertising provider serves them varies by game and by app version. Newer versions of the games use AppLovin MAX, a mediation platform that runs an auction between AppLovin's own ad network and the mediated networks we enable - currently Unity Ads, Pangle and Meta Audience Network - for every ad slot; earlier versions of some games use Google AdMob or Unity Ads directly. Versions served by Google AdMob use the Google Mobile Ads SDK, which collects and shares information with Google, including:

• the connection's IP address, which can indicate approximate location;
• advertising ID, app set ID and, where applicable, other identifiers associated with signed-in accounts on the device;
• device and app information and interactions, such as app launches, taps and video views;
• performance and diagnostic information, such as launch time, hangs and energy usage, and crash reports for debugging and analysis.

Google uses advertising data to provide and measure ads, analyse performance and prevent fraud. For versions served by Google AdMob, we limit requested ad content to Google's General audiences (G) rating. The games do not determine a player's age group, and leave their developer-provided age treatment unspecified. Google may personalise ads or apply additional protections using its own available information, settings and applicable requirements. These settings do not verify each player's age, guarantee that every teenager is identified, or disable all advertising data collection.

Google's SDKs transmit collected data using encrypted connections. This protects data in transit; it does not make the data anonymous.

AppLovin MAX. Versions of the games that use AppLovin MAX send every ad request to AppLovin. The AppLovin SDK collects and shares with AppLovin the advertising ID, the connection's IP address (which can indicate approximate location), device and app information such as model, operating system, language, app version and screen size, ad impressions, clicks and video views, and performance and crash diagnostics. AppLovin uses this information to select, deliver and measure ads, detect invalid activity and improve its services, and passes each request to the mediated networks that bid for the slot; each of those networks receives the same information for the ads it serves. A small number of devices that we register as test devices receive test ads instead of live ones; this does not change what is collected. AppLovin's handling of information is described in its Privacy Policy.

Pangle. In versions that use AppLovin MAX, Pangle - ByteDance's advertising network - bids through it. For the ads it bids on or serves, Pangle receives the advertising ID (it does not collect non-resettable hardware identifiers), the connection's IP address, from which it infers a city-level location, device and app information, ad impressions and interactions, and crash and performance diagnostics related to its ads. Pangle uses this information to deliver and measure ads, prevent fraud and analyse its service. Its handling of information is described in its Privacy Policy.

Meta Audience Network. In versions that use AppLovin MAX, Meta Audience Network - Meta's advertising network - bids through it. For the ads it bids on or serves, Meta receives device identifiers, including the advertising ID; device attributes such as model, screen size, operating system and the versions of the mediation platform and its SDK; ad performance information such as impressions, clicks, the ad placement and viewability; and, as with any request to its servers, the connection's IP address. The Audience Network SDK uses the Android advertising ID and honours the device's setting to limit ad tracking. Meta uses this information to deliver and measure ads. Its handling of information is described in its Privacy Policy.

Unity Ads. Versions served by Unity Ads - directly, or through AppLovin MAX - use Unity and its service providers to deliver, measure and check the quality of ads. They may process device and advertising identifiers, IP-derived approximate location, device and app information, ad impressions and interactions, and advertising diagnostics. Ad-quality components may use an SDK-generated identifier and information about ad content and interactions to identify problematic ads. These data support advertising, measurement, quality, security and fraud prevention.

The games do not offer in-app purchases or intentionally send purchase events to Unity. We do not treat the app's target age as verification of your age or as consent to personalized advertising. In the European Economic Area, the United Kingdom and Switzerland, the games use Google's consent tool (the User Messaging Platform) to ask for your advertising choices where that tool requires it, and start their advertising SDK - AppLovin MAX, or Unity Ads in earlier versions of some games - only after the tool allows ad requests, that is, after you have made a choice there. If the tool cannot complete its request, ads may be unavailable. The tool stores your choices on your device in the IAB Transparency and Consent Framework format, which advertising providers can read. Test ads and content-age filters do not mean no data is processed. For Unity's processing and privacy rights, see Unity's Game Player and App User Privacy Policy.

Attribution and ad revenue. Some of the games include the SDK from AppsFlyer, our mobile measurement partner, to attribute app installs and sessions to the marketing campaign that led to them. A game without that SDK does not send install, app-open or session events directly to AppsFlyer. Separately, the server-to-server ad revenue reporting described below can be enabled for a game without the AppsFlyer SDK. In games with the AppsFlyer SDK, AppsFlyer receives the advertising identifier, an AppsFlyer-generated device identifier, the random installation identifier described above, IP-derived approximate location, device and app information, and app-open and session events. On Android it also reads the Google Play install referrer. In versions of those games that use AppLovin MAX and have the ad revenue SDK API enabled, each time an ad is shown we also send AppsFlyer the revenue that AppLovin reports for it, with the ad network, ad format, ad unit and the country that AppLovin infers from the connection. For some games using AppLovin MAX, including games without the AppsFlyer SDK, at our request, AppsFlyer also retrieves from AppLovin a report of the revenue from each ad shown. The report links that revenue to the device's advertising identifier and includes the ad unit, ad format, country and device type and, for full-screen ads, the point in the game where the ad appeared - for example continuing after losing hearts, getting a hint or another aid, moving on after completing a level, or restarting after failing one. Apart from what those points in the game show, we do not send gameplay information - level numbers, level results, time spent or item use - to AppsFlyer. We have not enabled AppsFlyer's conversion-data callback or its collection of TCF consent data, and versions that do not use AppLovin MAX do not send ad revenue to AppsFlyer. For AppsFlyer's processing and privacy rights, see AppsFlyer's Services Privacy Policy.

5. Purposes and this release's availability

We use gameplay analytics to understand level difficulty, improve the games and investigate problems. Advertising funds the free games. Ad interaction and diagnostic information helps Google, AppLovin, Unity, Pangle and Meta deliver and measure ads, maintain their services and detect invalid activity. In games that use it, attribution tells us which marketing campaigns bring players to a game, so that we can measure and direct advertising spending. Where a game sends ad revenue information, it tells us what that game's ads earn, in total and - in games that use attribution - from the players each campaign brings, so that we can judge whether that spending pays off. The app set ID additionally tells us whether the same device has played more than one of our games, so that we do not count one player as two when we measure that spending. Local game saves let you continue playing and retain your preferences. We use privacy correspondence to handle enquiries and meet applicable obligations.

Availability is set per game in its store listing. Some games, or some of their releases, are offered only outside the European Economic Area, the United Kingdom and Switzerland. Store availability is based on the store's country settings and does not identify every player's physical location.

Analytics and, where a game uses it, attribution start automatically when you open a game, and so does advertising - except that the games first ask for your advertising choices in the regions described in section 4. The games do not offer an in-game choice to disable analytics or attribution. The welcome screen's agreement to the terms is not such a choice. Where a game has asked for your advertising choices, you can change them later - in most games from inside the game, and otherwise as section 8 explains. That option, the available device controls and ways to contact us are described in section 8.

6. Recipients and international processing

Google provides the analytics and advertising services described above. Analytics data is processed for our reporting through Google Analytics for Firebase. Google also receives advertising data and processes it under its advertising terms and privacy policy; it is not used solely for our internal analytics.

For most of the games, we have not enabled Google Signals or linked the game's Analytics property to Google Ads, and we have disabled the Analytics setting that shares data with Google to improve Google products and services. A recently added game may not yet have these settings applied; until it does, Google's default Analytics settings apply to it, under which Google may also use its Analytics data to improve Google's products and services. Those settings do not disable the separate AdMob collection described in section 4.

These services may process information outside your country, including in the United States. Google's handling of information, service providers and applicable international-transfer arrangements are described in its Privacy Policy and information about partner sites and apps. Unity and its service providers also receive and process the information described in section 4 for versions served by Unity Ads. Their processing and international transfers are described in Unity’s privacy policy.

In games with the AppsFlyer SDK, it receives the attribution information described in section 4. For some games using AppLovin MAX, it also receives device-level ad revenue information from AppLovin even if the game has no AppsFlyer SDK. AppsFlyer processes these data for measurement; its processing and international transfers are described in its Services Privacy Policy. Versions of the games that use AppLovin MAX use it as their mediation platform: AppLovin receives the advertising information described in section 4 for every ad request and decides, through its auction, which network serves the ad; the mediated networks we enable (currently Unity Ads, Pangle and Meta Audience Network) receive that information for the ads they bid on. AppLovin's processing and international transfers are described in its Privacy Policy, Pangle's in its Privacy Policy, and Meta's in its Privacy Policy. Earlier versions of some games do not use a mediation platform.

7. Retention

Our Analytics properties use a retention setting of up to 14 months for event and user data to which that setting applies: 14 months for most games, and Google's shorter default period for a recently added game until we have changed it. Expired event data is removed through Google's periodic deletion process. Where the 14-month setting applies, the option to reset user-data retention on new activity is enabled: new activity starts a new 14-month period for the associated user data. An active user's data can therefore be retained longer than 14 months from their first visit.

This setting does not delete standard aggregated Analytics reports on the same schedule. Google explains these distinctions in its data retention documentation. Google, AppLovin, Unity, Pangle and Meta retain advertising data under their own policies, and AppsFlyer, where a game uses it, retains attribution data under its own; our Analytics setting does not control their retention.

Local game saves remain until you remove a game's local data or uninstall it. We keep privacy correspondence for as long as needed to deal with the request and any related legal or recordkeeping obligations.

8. Your controls and privacy requests

Advertising choices. Where Google's consent tool requires it - in practice in the regions described in section 4 - a game that has asked for your advertising choices normally shows a way back to Google's consent form: a Privacy Settings option, found - depending on the game - in its settings panel or on its legal information page, opened from the settings menu. The form lets you change or withdraw your advertising choices at any time. A game version that does not yet include this option has no in-game way to reopen the form; clearing that game's storage in Android settings removes the choices stored on your device (together with its local game saves), and the game asks again where the tool requires it. This does not stop analytics or attribution (section 5).

Device controls. Android offers advertising controls, which can include resetting or deleting the advertising ID and adjusting advertising privacy settings. Available controls and their names vary by Android version and device. These controls do not disable all analytics or advertising data collection and do not remove ads from the games. See Google's Android advertising ID guidance.

Local data. You can clear a game's storage in Android settings or uninstall it to remove its local game saves. This does not request deletion of information already sent to Google, AppLovin, Unity, Pangle, Meta or AppsFlyer and does not remove their advertising, analytics or attribution records.

Privacy requests. Depending on the law that applies to you, you may have rights to access or correct personal data, request deletion, restrict or object to processing, receive a copy, or complain to a relevant privacy authority. Contact contact@boopfun.com with your request. We will assess it under the applicable law and explain the information and steps needed to respond.

Because the games have no account linking your identity to an app installation, your email address alone generally cannot identify its analytics or advertising records. We may be unable to locate particular records without additional identifying information. There is no remote self-service deletion feature; contacting us does not automatically delete data. For information Google processes independently, its Privacy Policy describes Google's own request and control options. Unity's privacy policy linked above explains its processing and request options.

9. Age restriction

The games are intended for people 13 years of age or older, and for people 16 years of age or older in the European Union, subject in each case to any higher minimum age required by applicable law. They are not directed at children under 13. If you are under the minimum age that applies to you, you must not download, access or play the games.

The games do not ask for a date of birth, verify each player's age, or apply a separate check for players in the European Union. The advertising settings described in section 4 are not an age check.

If you believe a child has used a game and information has been collected, contact contact@boopfun.com. We will review the report and take the steps required by applicable law, subject to our ability to identify the relevant records as explained in section 8.

10. Changes

We will update this page and its effective date when our practices change. Where applicable law requires additional notice or a consent choice, we must provide that before the relevant change takes effect. This statement does not describe an additional feature already available in the current versions.

11. Additional notice for the EEA, the United Kingdom and Switzerland

This section applies to individuals in the European Economic Area, the United Kingdom and Switzerland.

Our role. We are the controller of the personal data described in this policy: we decide why and how it is processed. A provider that processes personal data on our behalf acts as our processor and follows our instructions.

Legal bases. We rely on the following legal bases under the GDPR:

Your rights. When we process your personal data, you have the rights below. We may limit them where the law requires or allows it, where granting a request would affect another person's privacy, where needed to protect our rights and property, or where a request has no legal basis.

• Access: obtain a copy of the personal data we hold about you and information about how we process it, such as the purposes, the categories of data and the recipients.
• Rectification: ask us to correct your personal data.
• Erasure: in some circumstances, ask us to delete your personal data. This right is not absolute; we may keep data where there are compelling legitimate grounds to do so.
• Restriction: in some circumstances, ask us to restrict processing, for example while you contest the accuracy of the data or after you have objected to its processing.
• Objection and withdrawal: object to processing based on our legitimate interests, and withdraw consent you have given. We may continue processing where the law provides an exception.
• Portability: in some circumstances, receive your personal data in a structured, commonly used and machine-readable format.
• Automated decisions: we do not make decisions based solely on automated processing that significantly affect you.
• Complaint: lodge a complaint with a data protection authority - in the EEA, your national authority (list of authorities); in the United Kingdom, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner.

We share your personal data for interest-based advertising or personalised marketing only after you have given your consent. If you do not give consent, or later withdraw it, we will not share your personal data with those partners for those purposes. You can withdraw your consent at any time; withdrawal does not affect processing carried out before it.

To exercise your rights, email contact@boopfun.com and tell us which right you want to exercise. We must verify that a request comes from you before acting on it, and may contact you or ask for information to do so (see also section 8).

Marketing messages. We send marketing messages by email, SMS or other electronic means only with your prior consent, or where the law otherwise allows it based on our legitimate interests, such as telling you about similar services. You can object to such messages or withdraw your consent at any time, free of charge.

International transfers. When personal data is transferred outside the EEA, the United Kingdom or Switzerland, we rely on safeguards permitted by data protection law, such as the European Commission's Standard Contractual Clauses, or on an adequacy decision for the recipient's country, or, in specific situations, on a derogation - for example, where the transfer is necessary to perform our contract with you.