Privacy Policy

App: Bootstrapped (Android and iOS)

Last updated: 4 November 2026

1. Overview

• No account. Your save stays on your device. Only if you use the leaderboard does our server store the name you choose and your best time (section 8).
• You only see ads when you start a video yourself (section 5).
• Personalised ads only with your consent, play statistics only if you say "Yes" in the app. You can change both at any time in the settings (sections 4 and 6).
• Purchases run through Google Play or the App Store and are verified via RevenueCat. We never see payment details (sections 7 and 14).
• We do not sell data.

2. Controller

We are not required to appoint a data protection officer, because none of the conditions of Art. 37 GDPR applies.

3. Data on your device

The app stores in its private storage on your device:

• your save (including the company name you enter) and a backup copy,
• your settings (such as language, appearance, notifications, offer hints),
• the status of your purchases (packs bought) and a random RevenueCat customer ID (section 7),
• daily counters for videos (for the visible daily limits),
• a randomly generated installation ID (section 6),
• if you use the leaderboard: a random player ID, your name there and the IDs of players you have hidden for yourself (section 8),
• a technical error log.

This data is not transmitted to us; what the app sends to services is described in the following sections. The storage is necessary for the game (Art. 6(1)(b) GDPR; Section 165(3) of the Austrian Telecommunications Act 2021).

You can delete all of it through Android (Settings › Apps › Bootstrapped › Storage › Clear data) or by uninstalling the app. "Reset game" in the app archives the old save on the device instead of deleting it.

4. Consent

For consent to advertising the app uses Google's User Messaging Platform (standard: IAB Transparency & Consent Framework). Where required, in particular in the European Economic Area, the United Kingdom and Switzerland, the app asks on first launch, before any ad is loaded. Your choice is stored on your device. For play statistics the app asks itself (section 6).

You can change or withdraw your choice at any time under Settings › Change ad consent (Art. 7(3) GDPR). The withdrawal applies from that moment. The game remains fully playable without consent.

5. Advertising (Google AdMob)

The app only shows rewarded videos, and only when you tap an offer. There are no banners and no ads that start on their own.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). When a video is loaded or shown, Google processes in particular your IP address (and from it an approximate location), your device's advertising ID, device and app information (such as model, Android version, language, app version) and your interaction with the ad (watched, cancelled, tapped). Google may store and read identifiers on your device for this.

Purposes: delivering ads, limiting frequency, measuring effectiveness, preventing fraud and, only with consent, personalising ads. With consent, the legal basis is Art. 6(1)(a) GDPR and Section 165(3) of the Austrian Telecommunications Act 2021. Without consent Google delivers at most limited, non-personalised ads; we base the processing this requires on our legitimate interest in funding the free app through voluntary advertising (Art. 6(1)(f) GDPR). If Google cannot deliver an ad, the offer does not appear.

Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). How long Google keeps the data is governed by Google's terms. You can reset or delete the advertising ID in the Android settings (usually under Privacy › Ads).

More information: policies.google.com/technologies/partner-sites.

6. Play statistics (GameAnalytics)

To understand where players get stuck and to improve game balance and offers, the app sends game events to GameAnalytics. The provider is GameAnalytics ApS, Denmark, acting as our processor (Art. 28 GDPR). What is sent:

• a random installation ID (not the advertising ID, no name, no email address) and a random session ID,
• time, Android version and app version (not device model or manufacturer),
• how often and how long you play (session number and length),
• game events, such as session started, tutorial step reached, milestone or rank reached (with game day), video offered or watched, shop opened, pack bought (pack, price and currency, without payment details),
• moves and decisions, such as product type built, employee hired, loan taken, option chosen in an event, company founded (difficulty, industry, strategy) or restarted, game days played per session, but never company or product names,
• features of your save: difficulty, packs bought and approximate playing time in the game (such as "Year 2"),
• for a program error, the type of error and the affected place in the program code (not the error text),
• for technical reasons, your IP address during transmission.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) of the Austrian Telecommunications Act 2021). The app asks once after the tutorial "Send game statistics?" and sends only after "Yes", the same in every country. Without an answer or with "No" it sends nothing. You can change or withdraw this at any time under Settings › Send game statistics.

The data is used only for analysis. We build no advertising profiles from it and do not pass it on. If you clear the app data or reinstall the app, a new installation ID is created; the old data can then no longer be linked to your device (Art. 11 GDPR). GameAnalytics stores the data with cloud providers (Amazon Web Services, Google Cloud). Where data is processed outside the EU, this is based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

More information: www.gameanalytics.com/trust/privacy-notice.

7. Purchases (Google Play, RevenueCat)

You buy packs (such as the Founder Pack, Style Pack, ad-free bonuses) through Google Play. Google handles payment, invoicing and refunds under its own responsibility; we do not receive your payment details.

To verify, unlock and restore purchases the app uses RevenueCat (RevenueCat, Inc., USA) as our processor (Art. 28 GDPR). The app also stores the purchase status on your device so that packs work without internet. If Google refunds a purchase, the app locks the pack again on the next launch. What is processed:

• a random customer ID created on first launch (no name, no email address, no account),
• your purchases in this app: product, Google Play purchase identifier, price and currency, date and status (such as refunded),
• technical details: app and Android version, language and country, IP address when connecting.

This happens at app launch, on purchase and on "Restore purchase" in the settings, regardless of your consent to ads and statistics, because purchases would not work otherwise. The legal basis is the performance of the purchase contract (Art. 6(1)(b) GDPR).

Only if you have agreed to play statistics (section 6) does the app also tell RevenueCat when you open the purchase page of a pack you do not own yet (which pack and when), and, for videos, when one is loaded or fails to load (with error code), when it is shown or tapped and what ad revenue Google reports for it, with ad unit, ad network, placement in the game (such as "Boost") and the same random customer ID, never with the advertising ID. This shows us how many players see a purchase page, how often videos are available and what advertising earns. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) of the Austrian Telecommunications Act 2021); you can withdraw it under Settings › Send game statistics.

RevenueCat stores the data in the USA (Amazon Web Services, Snowflake). The transfer relies on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) in the data processing agreement with RevenueCat.

More information: www.revenuecat.com/privacy.

In the Google Play Console, Google provides us with order information (such as order number, product, price, country, date). We use it for accounting, taxes and refunds. The legal basis is Art. 6(1)(b) and (c) GDPR. Google's privacy policy applies to the purchase itself.

8. Leaderboard (Cloudflare)

The leaderboard is voluntary. There is no account and no sign-in. What is processed:

• a random player ID created by the app (not the advertising ID), and a public short ID that others can use to report or hide you,
• the name you choose (3 to 16 characters, publicly visible, please not your real name),
• for each run with which you reach first place: difficulty, game days needed, a random run ID, the game's starting value and the app version (for plausibility checks), and the time,
• if you report a name: your player ID, the reported player, the reported name and the time.

As soon as you enter a name, the app sends it with the player ID to the server, which checks it immediately for prohibited words; it is only stored with your first first-place run. When you open the leaderboard, the app loads the list. Several credible reports replace a name for everyone with "Player 1234"; rank and time remain. We can review reported names and block players or entries.

The server runs at Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, as our processor (Art. 28 GDPR). Cloudflare technically processes your IP address when connecting; we do not store it. Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

The legal basis is the performance of the user agreement, because you use the leaderboard voluntarily (Art. 6(1)(b) GDPR); for name checks, reports and blocks, our legitimate interest in a fair list without offensive names (Art. 6(1)(f) GDPR).

Deletion: tap "Delete my data" in the leaderboard; the server then removes your name, all your entries and all reports by you and against you. Without this step the data stays stored as long as the leaderboard exists. If you no longer have the app, write to us with your leaderboard name; because names are not unique, we may ask for details (such as difficulty and the approximate date of your entry).

More information: www.cloudflare.com/privacypolicy.

9. Save backup and achievements (Google Play Games)

If you turn on backup in the settings, the app signs you in to Google Play Games and stores your save and your profile (unlocks, achievements, leaderboard name) as a saved game in your Google account. The data is held by Google and we cannot see it; we run no server of our own for this. If you are signed in to Google Play Games, the app reports unlocked achievements there. You can turn off the backup at any time; you delete the copy in the Google Play Games settings. Google's privacy policy applies.

10. Android backup

If you have turned on backup to your Google account on your device, Android backs up the app's save and settings (not the error log) so you can restore them on a new device. Google does this within your Google account; we have no access to it. You can turn off the backup in the Android settings.

11. Notifications

The app creates reminders (such as "Offline cap reached") directly on your device. No data is sent and no push service is used for this. The app only asks for the Android permission when you turn on notifications; you can turn them off in the app or in Android.

12. Error reports and contact by email

"Copy error report" in the settings copies the technical log to the clipboard. Nothing is sent; you decide whether to send it to us. We receive crash reports in aggregated form and without reference to you through the Google Play Console (Android vitals), if you have allowed Android to share usage and diagnostic data with Google.

If you contact us by email, we process your email address, the content of the message and, if included, the log to answer your request. The legal basis is the performance of the contract where a purchase is concerned (Art. 6(1)(b) GDPR), and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). The mailbox is hosted by our host helloly GmbH in Austria. We delete the message 12 months after the request has been resolved, unless we must keep it longer, for example as a record of a refund (7 years, Section 132 of the Austrian Federal Fiscal Code, BAO).

13. What the app does not do

• no user account and no mandatory sign-in (signing in to Google Play Games is voluntary),
• no access to location, contacts, camera, microphone, photos or files,
• no data about you on our server other than the leaderboard details from section 8,
• no selling of data, no automated decisions and no profiles (Art. 22 GDPR).

Data leaves your device only encrypted (HTTPS/TLS). Save and settings are kept in the app's private storage, which other apps cannot access. The leaderboard server holds only the details from section 8; only we have access to review and block.

14. The iOS version

On iOS everything above applies with these differences:

• Purchases: you buy packs through the App Store. Apple (Apple Distribution International Ltd., Ireland) handles payment, invoicing and refunds under its own responsibility; we receive no payment details. RevenueCat receives Apple's purchase identifier instead of Google Play's (section 7). In App Store Connect Apple provides us with sales reports (such as product, price, country, date, without names), which we use for accounting and tax (Art. 6(1)(b) and (c) GDPR).
• Tracking: after the consent prompt (section 4) the app shows a short explanation and Apple's prompt asking whether it may track you across apps and websites owned by other companies (App Tracking Transparency). Only if you allow it there does Google receive your device's advertising ID (IDFA). You can change this at any time in the iOS settings under Privacy & Security › Tracking. Google can also measure whether an ad led to an install through Apple's SKAdNetwork; Google then receives only aggregated figures without an identifier of your device.
• Play statistics and RevenueCat receive the iOS version instead of the Android version, but no device identifier from Apple (neither IDFV nor IDFA).
• Google Play Games (section 9) is not available on iOS; the app does not use Game Center either.
• Backup: instead of Android backup (section 10), Apple can include the app data in your iCloud or device backup if you have turned that on in the iOS settings. We have no access to it.
• Notifications: iOS asks for permission to send notifications when you turn reminders on; you can turn them off in the app or under iOS Settings › Notifications.
• Crash reports: if you have agreed in the iOS settings to share analytics with app developers, Apple provides us in App Store Connect with aggregated crash reports that we cannot link to any person.
• Deleting: you remove all data on the device by deleting the app.

Apple's privacy policy: www.apple.com/legal/privacy.

15. Retention

• Save, settings, purchase status on the device: until you clear the app data or uninstall the app.
• Advertising data at Google: according to Google's periods; withdraw consent, reset or delete the advertising ID.
• Play statistics at GameAnalytics: at most 12 months, after which GameAnalytics deletes or anonymises them; turn off play statistics, clear app data (new ID).
• Leaderboard (name, entries, reports): until you delete them or the leaderboard is discontinued; Leaderboard › "Delete my data", otherwise by email with your name.
• Save backup at Google Play Games: until you delete it in the Google Play Games settings.
• Purchase history, purchase page views and ad events at RevenueCat: for as long as Bootstrapped is managed at RevenueCat; earlier on request by email with the order number.
• Order information: statutory retention period (7 years, Section 132 BAO), then automatically.
• Emails to us: 12 months after the request has been resolved, unless a legal duty requires longer.

16. Children

Bootstrapped is aimed at players aged 13 and over. In Austria you can give consent (advertising, play statistics) yourself from the age of 14 (Section 4(4) DSG); in other countries the limit is up to 16 (Art. 8 GDPR). Below that age a parent's consent is needed; without consent the game stays fully playable. We do not knowingly collect data from children under 13. If we learn that a child under 13 has used the leaderboard, we delete their entries.

17. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and the right to withdraw consent at any time (Art. 7(3)). The withdrawal applies from that moment; processing before it remains lawful.

Right to object: where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

To do so, write to support@gamificationlp.com. We reply within one month (Art. 12(3) GDPR). Because we keep no accounts, we usually cannot link data held by Google or GameAnalytics to a particular person; the quickest routes are therefore those in the app and in Android (change ad consent, turn off play statistics, Leaderboard › "Delete my data", clear app data, reset the advertising ID). We find and delete your purchase history at RevenueCat using the order number from the Google Play purchase confirmation (it starts with "GPA.").

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the country where you live. The authority responsible for us is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna: www.dsb.gv.at.

18. Changes

If the processing changes, for example through a new feature or a new service, we update this policy beforehand. The version published here applies; the date at the top shows when it was last updated.

Delete your data

Terms of use

Legal notice