Privacy Policy

for the boba. app and this website

1. Who is responsible?

Burak Erduran
Harsdörfferplatz 13
90478 Nürnberg
Germany
Email: legal@playboba.app

More details are in the legal notice.

2. Data in the app: only on your iPhone

So that boba. remembers your group, the app stores the following only locally on your iPhone:

• Profile: your name or nickname, your age group (optional), your gender (optional), the app's language and look. The app currently uses age group and gender only for your profile.
• Group: the names of the people you play with.
• Journal: which game you played and when, who took part, which cards came up, points and result.
• Favourites, settings and best scores: for example look, light or dark mode, cards per round, deselected categories and your best results in some games.

The app stores this on your iPhone because it is strictly necessary for the features you use (§ 25(2) no. 2 TDDDG). It transfers none of it to me or anyone else; I have no access to it. Please only enter other people's names if they are fine with it.

Sharing: Only if you share something yourself, for example the picture at the end of “Doodle Drama” via “Share the chain”, does it go to the app or person you pick in the share sheet. The picture shows the players' names.

Deleting: In the app, Settings → Delete data removes group, journal, favourites, profile, settings (including deselected categories), best scores and leftover Back to Front recordings. Deleting the app from your iPhone removes the data as well.

iPhone backup: Depending on your settings, Apple may include the app's data in your iCloud backup or in a backup on your computer. You control this in the iPhone settings. “Delete data” only removes the data from the iPhone, not from existing backups.

3. Microphone (only in the game “Back to Front”)

The game “Back to Front” records short singing clips so you can listen to them during the game. The app asks for permission first. The recordings stay on your iPhone, are not transferred, and are deleted when the round ends or is cancelled. If the app is closed or crashes mid-round, the clips stay in the app's temporary folder until the next Back to Front round and are deleted then; “Delete data” removes them immediately. You can withdraw the permission at any time in the iPhone settings for boba. No other game uses the microphone.

4. Purchases and subscription

A subscription and a one-time purchase through the App Store are planned for later. If boba. offers purchases or a subscription, Apple handles them through the App Store. Only Apple receives payment details; the Apple Privacy Policy applies. On your iPhone, the app receives a signed confirmation from Apple about which content is unlocked and checks it there. Apple gives me sales and subscription reports with country, device type and a random ID per buyer, but without names or contact details.

5. Statistics and crash reports from Apple

If you have turned on Share With App Developers on your iPhone under Settings → Privacy & Security → Analytics & Improvements, Apple provides me with crash reports and usage statistics (for example installs and sessions), which according to Apple are aggregated or do not identify you. Apple collects this data, not the app; details in App Analytics & Privacy. I only use it to fix bugs and improve the app. Insofar as it can relate to you after all, the legal basis is my legitimate interest in an app that works properly (Art. 6(1)(f) GDPR). You can turn sharing off in the iPhone settings at any time.

6. Test versions (TestFlight)

If you use a test version through Apple's TestFlight, Apple shares certain data with me. If you were invited by email, this includes your email address and your name as I entered them for the invitation. It also includes, among other things: type and status of the invitation, installs, app version, device model and device ID, iOS version, device language, number of sessions and crashes, and crash logs. If you send feedback in TestFlight, your comments and screenshots are added, along with technical details such as carrier, time zone, connection type, free storage and battery level. If you joined through a public link, I see neither your name nor your email address.

I only use this information to test and improve the app and do not pass it on. The legal basis is my legitimate interest in an app that works properly (Art. 6(1)(f) GDPR). When the test ends, or if you ask me, I remove you from the test groups. What Apple itself stores is described in TestFlight & Privacy.

Retention (sections 4 to 6): I view these reports and details in App Store Connect and Xcode, where Apple keeps them under its own rules (beta feedback for one year according to Apple, crash logs and usage data until the bugs are fixed). Anything I download I delete once I no longer need it, at the latest twelve months after downloading.

7. Contact by email

If you write to me, I process your email address and your message in order to reply. The legal basis is Art. 6(1)(b) GDPR if your request concerns a purchase, otherwise my legitimate interest in answering requests (Art. 6(1)(f) GDPR). I delete messages once the matter is settled, unless legal retention obligations require otherwise. My mailbox is run by Apple (iCloud Mail; in the EU, Apple Distribution International Ltd., Ireland, is responsible). According to Apple, transfers outside the EU are based on standard contractual clauses (Art. 46 GDPR).

8. This website

This website is hosted on GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. St., San Francisco, CA 94107, USA. When you visit it, GitHub logs your IP address for security purposes (GitHub Pages); GitHub decides how long and does not state a fixed period. The website sets no cookies, measures nothing and loads no fonts, scripts or images from other servers. The legal basis is my legitimate interest in providing the website securely (Art. 6(1)(f) GDPR). GitHub is certified under the EU-U.S. Data Privacy Framework; the transfer to the USA is therefore based on the European Commission's adequacy decision (Implementing Decision (EU) 2023/1795, Art. 45 GDPR). See the GitHub Privacy Statement.

9. No ads, no tracking, no selling

boba. shows no ads, contains no advertising or analytics components from other companies, and does not track you across other apps or websites. I do not sell data. Data only goes to the services named here (Apple, GitHub) or to bodies I am legally required to provide it to. There is no automated decision-making about you.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Just write to legal@playboba.app. The data in the app is only with you; you can view, change and delete it there yourself.

Right to object: Where I process data based on my legitimate interests (sections 5 to 8), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). An email to legal@playboba.app is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country or German state where you live. The authority responsible for me is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

11. Changes

If the app changes in a way that involves other data, I will update this policy beforehand.

Last updated: 26 October 2026