Boxly Privacy Policy

Last updated: 1 November 2026 · Applies to the Boxly app for iOS and Android

1. Who we are

Boxly is published by Sleepy Panda S.R.L., Strada Hipodrom nr. 29, Bl. L2, Sc. 1, Ap. 3, Brăila, Romania, registered with the Brăila Trade Register under no. J2021000584095, tax identification code (CUI) 44581681 ("we", "us"). For anything about this policy or your data, write to marius.cetanas@sleepypanda.ro.

2. What the app itself stores

The app keeps the following on your device, in its own private storage. We cannot read it, and uninstalling the app deletes it from the device:

• Your settings: sound, haptics, theme, language, reduce motion, color-blind friendly and high contrast.
• Your match results, your record against each opponent (each AI personality and a friend), how many times you have used "Show the best move" today (a daily count, which is how the ten-a-day limit works), how many games you have played and when the recent ones ended, when you installed the app, whether you have seen the tutorial, and when you were last asked to rate the app. The game and install times exist only so the app can keep ads sparse (for example, no ad right after you install).
• Temporary sound files the app generates in its cache. They contain no information about you.
• Whether the "Remove ads" purchase is owned, so the app knows not to show ads.

Your phone's backup. If your phone's own backup is turned on (on Android, the backup to your Google account; on iPhone and iPad, iCloud Backup or a backup to your computer), it can include a copy of what the app keeps in its private storage: the data above, apart from the temporary sound files, and what the consent message and the ads SDK keep there, such as your consent choice. The copy is kept in your Google or Apple account or on your computer. Uninstalling the app does not delete it: it stays until the backup is deleted or replaced. If you reinstall the app on Android, restore a backup, or copy your apps and data to a new phone, your settings and results can come back. We have no access to the backup. You can turn it off or delete it in your phone's backup settings, or on your computer for a computer backup. The "Remove ads" purchase comes back through "Restore purchases" either way (section 5).

If you use "Share", the app draws a picture of the finished match, with the game's name, the score, the board and a link to get the game, and hands it with a line of text (the score, the game's name and the link) to your phone's own share sheet. What happens next is up to the app you pick; nothing is sent to us. Matches against a friend are played on the same phone; nothing about them is sent to anyone.

3. Advertising (Google AdMob)

Unless you have bought "Remove ads", the app shows an interstitial ad after some games and an optional rewarded ad when you choose "Show the best move" (once per match, at most ten a day; free with "Remove ads"). These ads are served by Google AdMob through the Google Mobile Ads SDK, which is software from Google LLC that runs inside the app.

To serve and measure ads, the SDK may collect and send to Google:

• Your device's advertising identifier (Google Advertising ID on Android, IDFA on iOS, only if you allow tracking), and other device and app information such as model, operating system, language, time zone and the app's name and version.
• An identifier shared by one developer's apps on a device: the app set ID on Android, given by Google Play services, and the identifier for vendor (IDFV) on iOS, given by Apple. Unlike the advertising ID, neither has a reset in the settings; they change when you uninstall the last of our apps or factory-reset the phone.
• Your IP address, from which an approximate location may be derived.
• How you use the app and its ads: app launches, taps, that an ad was shown, viewed or tapped, video views, and which rewarded ad you completed.
• Diagnostic information about how the app and the SDK perform, such as app launch time, hang rate and energy use.

Google uses this data for advertising (showing ads and, where you have consented or allowed tracking, personalizing them), for analytics (measuring ads and how the app and the SDK perform) and to prevent fraud. Google acts as an independent controller for that processing. How Google handles the data is described in the Google Privacy Policy and in How Google uses information from sites or apps that use our services. Google is certified under the EU-US Data Privacy Framework for transfers outside the EEA.

Legal basis (EEA, UK, Switzerland). Personalized ads and the storing or reading of identifiers on your device happen only with your consent (GDPR Article 6(1)(a), ePrivacy rules); you can withdraw it at any time as described in section 4, which does not affect what was done before. Showing non-personalized ads, measuring them and preventing fraud rely on Google's and our legitimate interest in funding a free app and keeping ads safe (Article 6(1)(f)); you can object through the same choices. The consent message's own processing (section 4) relies on the obligation to obtain and be able to show your consent (Articles 6(1)(c) and 7(1)) and, for working out which rules apply where you are, on the legitimate interest in showing you the right message (Article 6(1)(f)). We make no decisions about you by automated means that have legal or similarly significant effects.

Google may work with the ad technology providers it lists at Ad technology providers; the consent message in the app names the ones active for Boxly. We do not place any other ad network, tracker or analytics service in the app.

4. Consent and your choices

EEA, UK and Switzerland. Before the first ad, the app shows a consent message (Google's User Messaging Platform). You can accept, or choose "Manage options" to decide purpose by purpose, including objecting to processing based on legitimate interest. If you do not consent to personalized ads, Google serves ads that are not based on your personal data. You can change your choice at any time from the app's Settings, under "Privacy options".

The consent message itself. The consent message is Google software that runs inside the app. To know which consent rules apply where you are and to show the right message, it uses your IP address, from which Google estimates your approximate region, together with information about the app and your device. It also records how the message performs and what you choose in it. Google uses this data to run the consent message, and Google declares that it does not link this data to your identity or use it for advertising. Your choice is stored on your device so the app can apply it (section 2).

iOS. On iPhone and iPad the app also shows Apple's App Tracking Transparency prompt. If you choose "Ask App Not to Track", the SDK does not read your IDFA. You can change this later in iOS Settings → Privacy & Security → Tracking.

Android. You can reset or delete your advertising ID and opt out of ad personalization in Android Settings → Google → Ads.

US states. Where a state privacy law gives you the right to opt out of the "sale" or "sharing" of personal data, the app shows a "Do not sell or share my personal information" choice through the same consent tooling.

No ads at all. Buying "Remove ads" turns the ads off, and with them the data the ads SDK collects. The consent message still runs at launch to check which rules apply where you are (above).

5. The in-app purchase

"Remove ads" is a one-time purchase made through the Apple App Store or Google Play. The store processes the payment and holds your payment details; we never receive your card or bank information. The store tells the app only that the purchase is owned, and the app remembers that on your device. "Restore purchases" asks the store again, for a new phone or a reinstall. Refunds and receipts are handled by the store under its own terms.

6. What we do not do

• No account, sign-in, email address or name is asked for or stored.
• No analytics or crash-reporting service of ours runs in the app. Apple and Google may share aggregated crash and usage statistics with us only if you have opted in to that in your device settings.
• No data is sold by us for money, and we hold no data of yours to sell. Under some US state laws, letting Google show you personalized ads can count as "sharing" personal data for cross-context behavioral advertising; section 11 explains the opt-out.
• No precise location, contacts, photos, microphone or camera access.

7. Children

Boxly is not directed at children under 13 (or the age of digital consent where you live), and we do not knowingly collect personal data from them. Ad requests are not flagged as child-directed.

If you think a child has used the app, here is what you should know. The app itself keeps no personal data; what it stores is kept on the device, and in the phone's backup if that is turned on (section 2). The data Google's software in the app sends goes to Google and is held under the Google Privacy Policy (section 3). We never receive it, so we cannot delete it for you. Where the app shows it, Settings → "Privacy options" changes the consent given for ads, and section 4 lists the other ad choices on the device; none of them deletes data already sent. For the data Google holds, use Google's My Ad Center and Google's privacy controls. If you need help with any of these, write to us at the email address in section 1.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive the personal data about you, to object to or restrict its processing, to withdraw consent, and to complain to a supervisory authority: in Romania the ANSPDCP, in the UK the ICO, or the authority where you live. Because we never receive the data the app stores, the practical ways to exercise these rights are: uninstall the app or clear its storage to delete that data from your device, and use your phone's backup settings to delete any copy in its backup (section 2); use the consent and tracking choices in section 4 for advertising; and for data Google holds, use Google's My Ad Center and Google's privacy controls. For anything else, write to us at the address in section 1; we answer within one month, and we will never treat you differently for exercising a right.

9. Retention and security

Data stored by the app stays on your device until you clear the app's storage (Android) or uninstall the app. A copy in your phone's backup stays until that backup is deleted or replaced (section 2). Google's retention of advertising data is described in Google's privacy policy. The app talks to Google's servers only over encrypted connections.

10. Changes

If we change how the app handles data, we will update this page and the date at the top, and, for material changes, tell you in the app before they apply.

11. California and other US states

This section adds what state privacy laws (such as the California Consumer Privacy Act) ask us to say, for residents of states that have them.

• Categories collected in the last 12 months, all by Google software in the app:
  • By the Google Mobile Ads SDK, only while ads are on: identifiers (advertising identifier, the app set ID on Android or the IDFV on iOS, IP address); internet or app activity (app launches, taps, ads shown and tapped, and diagnostic information about how the app performs); and approximate location derived from the IP address.
  • By the consent message (section 4): identifiers (IP address); internet or app activity (information about the app and your device, how the message performs, and the choices you make in it); and approximate location derived from the IP address.
  No sensitive personal information, and nothing linked to your name, because the app never asks for one.
• Purposes: serving and measuring ads, analytics on how the app and the SDK perform, preventing fraud, and, with your choice, personalizing ads; and showing the consent message that applies to you and recording your choices.
• Sale or sharing: we do not sell personal data for money. Personalized advertising through Google may count as "sharing" for cross-context behavioral advertising. To opt out, use the "Do not sell or share my personal information" choice the app shows where it applies, choose "Ask App Not to Track" on iOS, or turn off ad personalization in your Android or iOS settings. We do not knowingly sell or share the personal data of anyone under 16.
• Retention: as in section 9.
• Your rights: to know what we collect, to delete it, to correct it, to opt out of sale or sharing, to limit the use of sensitive data (we collect none), and not to be discriminated against for using these rights. To exercise them, write to the email in section 1; we reply within 45 days. You may use an authorized agent; we will ask the agent for proof that you allowed it.

Data at a glance