Boule-Boy
Privacy Policy
1. Data Controller
The party responsible for processing personal data in the Boule-Boy app is:
Andreas Spang
Simpert-Kramer-Str. 46
87629 Füssen
Germany
E-mail: service@bouleboy.de
2. Scope
This policy describes which personal data is processed when using the Boule-Boy Android and iOS app, for what purpose, and on which legal basis. It applies to all versions of the app distributed via the Google Play Store and the Apple App Store.
3. What data we process
3.1 Account data
When registering or creating a player account, we process:
- E-mail address (for login and password recovery)
- First and last name (shown in the player list and the pyramid)
- Optional: profile picture (uploaded by the user)
The data is stored at our processor Supabase (see section 6) in a secured database. Passwords are stored as hashes only; plain-text passwords are accessible neither to us nor to Supabase.
3.2 Game-related data
Within a tournament, the following data is created and stored:
- Participant list (linking player account and tournament)
- Game results (date, score, notes)
- Position in the pyramid (row, slot, promotion and demotion history)
- Challenges between players (appointments, status)
- In-app messages between players (e.g. demotion notices)
3.3 Technical data
When syncing with the server, the following technical data is typically processed in the server logs:
- IP address (truncated after processing)
- Request timestamp
- HTTP status code and path
- Authentication token (for session handling)
This data is retained only as long as it is necessary for error analysis and server security (typically ≤ 30 days).
3.4 What we do not collect
- No location data (no GPS, no Wi-Fi or cell-tower positioning)
- No contacts from the device's address book
- No advertising IDs, no tracking via ad networks
- No analytics tools such as Firebase Analytics, Google Analytics, etc.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Contract performance (app functionality, tournament management) | Art. 6(1)(b) |
| Authentication and account security | Art. 6(1)(b) and (f) |
| Sending in-app and transactional e-mails | Art. 6(1)(b) |
| Server logs for security and error analysis | Art. 6(1)(f) |
5. Recipients of the data
Data is shared exclusively with the technical service providers listed in section 6, who act on our behalf. Data is not shared with ad networks, data brokers, or other third parties.
6. Processors
We use the following services on the basis of data-processing agreements:
- Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992 — hosts the Postgres database, the authentication system, and the edge functions. Data location: EU (Frankfurt, Germany). Privacy: supabase.com/privacy
- PowerSync Pty Ltd. — synchronises data between the user's device and the Supabase database. PowerSync has no read access to the data; only the encrypted replication protocol is passed through. Privacy: powersync.com/privacy
7. Retention
- Account data: for as long as the player account is active; after a deletion request, within 30 days.
- Game-related data: for as long as the associated tournament is active or archived. For reasons of sporting traceability, game results remain even after an individual player account is deleted, kept in a pseudonymised form (first-name initial + last-name initial).
- Server logs: 30 days maximum.
8. Your rights
Under the GDPR, you have the right at any time to:
- Access (Art. 15) — which data is stored about you
- Rectification (Art. 16) — correct inaccurate data
- Erasure (Art. 17) — delete account and associated data
- Restriction of processing (Art. 18)
- Data portability (Art. 20) — export your data in a machine-readable format
- Object (Art. 21) to processing based on legitimate interests
- Lodge a complaint with a supervisory authority (Art. 77) — in Germany, e.g. the Bavarian State Office for Data Protection Supervision (BayLDA).
You can send requests informally to the e-mail address listed in section 1. We respond within the legally prescribed period (usually within one month).
9. Deletion by the user
You can have your account and all linked data deleted at any time in two ways:
- In the app: under "Account" → "Delete account" (if available in your version).
- By e-mail: informal request to the address listed in section 1.
The deletion is completed within 30 days. Any legally required retention obligations (e.g. tax law, if applicable) remain unaffected.
10. Security
Transmission between the app and the server is exclusively encrypted via HTTPS/TLS. Passwords are never stored in plain text; Supabase uses industry standard methods (bcrypt/Argon2). A local copy of the game data resides on the end device in a SQLite database — this file is accessible only to the app itself.
11. Changes to this privacy policy
In the event of material changes, we will inform you on your next login. The current version is always available at the link registered with the Play Store and App Store listings.
12. Contact
For questions about the processing of your data or to exercise your rights, please contact: