Boot Sale: Hidden Objects — Privacy Policy

1. Who We Are

Boot Sale: Hidden Objects is a mobile game for iPhone, iPad, and Android published by Olaverse Labs ("we", "us", or "our"), which also maintains this website at olaverse.co.uk. This policy covers the game only. Our website privacy policy covers olaverse.co.uk separately.

In the game you search car boot sale locations such as Granny's Garage, Car Boot Chaos, and the Vintage Stall for hidden treasures, earn stars and coins, and build a collection. Endless Mode unlocks once every location is cleared, and coins buy hints or let you continue after running out of lives.

2. What Stays on Your Device

The game saves the following in its own storage on your device. It is never sent to us or to any server of ours. We do not have any servers for the game.

• Game progress: your coin balance, the treasures you have found, stars and best score for each location, how many times each location has been cleared, total finds, best streak, games played, and your Endless Mode best score and rounds.
• Settings: whether sound is on or off, and whether vibration is on or off.

Deleting the game deletes this data. Coins are not linked to any account, so we have no record of your balance and cannot restore coins for you after you reinstall or change phones.

3. What Leaves Your Device

The game's own code makes no network requests. Two third-party components inside the app do:

• Google AdMob, which requests, shows, and measures ads. See section 4.
• RevenueCat, together with the App Store or Google Play, which processes purchases and restores them. See section 5.

Neither of them receives your game progress from us. We do not send your scores, collection, or coin balance anywhere.

4. Advertising

The game is free and is paid for by ads supplied by Google AdMob. There are three kinds:

• Banner ads at the bottom of the Play and Collection screens.
• Interstitial ads, shown full screen between locations.
• Rewarded ads, which are optional. You choose to watch one to continue after running out of lives.

To serve and measure these ads, Google's SDK collects data from your device. According to the privacy manifest Google publishes with the SDK, that data is:

Google handles this data as its own controller, under the Google Privacy Policy. Google explains how it uses data from apps like this one in How Google uses information from sites or apps that use its services. We do not receive this data about you as an individual. We see only totals, such as how many ads were shown and what they earned.

What this means on each platform:

• iPhone and iPad: the game never shows the App Tracking Transparency prompt, so iOS does not give Google your advertising identifier (IDFA). Ads are not personalised using the IDFA, and nothing is tracked through it across other companies' apps and websites.
• Android: the AdMob SDK can read your device's Android advertising ID, as it does in most ad-supported apps. Google may use it, together with the data above, to choose ads based on your interests, cap how often you see the same ad, and detect fraud. You can delete or reset the advertising ID in your device settings. See section 7.
• UK, EEA, and Switzerland: the game does not currently show a consent prompt for personalised advertising. Under Google's policies, apps that do not collect that consent are not eligible to show personalised ads to users in these regions, so you will see limited or non-personalised ads. If we add a consent prompt in a future version, we will update this policy first.

We never send Google your game progress, your purchases, or anything that identifies you by name.

5. In-App Purchases

The game is free to play. You can also buy:

• Remove Ads, a one-time purchase you can restore. It removes banner and interstitial ads for good. Optional rewarded ads stay available if you want to use them to continue.
• Pouch of 1,000 Coins, a consumable purchase that adds 1,000 coins.
• Sack of 5,500 Coins, a consumable purchase that adds 5,500 coins.

Prices are shown in the App Store or Google Play before you buy and vary by country.

• Apple or Google takes the payment, not us. Your card number, billing address, and payment details go to the App Store or Google Play under their own privacy policies. We never see them. See Apple's privacy policy and the Google Privacy Policy.
• RevenueCat records the purchase. RevenueCat, Inc. processes purchases and restores for us as our data processor. It creates an anonymous user ID for your installation. That ID is a random string, and the game never gives RevenueCat your name, email address, or advertising ID. RevenueCat receives the store receipt for the purchase and basic technical context with each request: the platform, app version, store country, and the IP address the request comes from. Its privacy manifest declares purchase history, not linked to your identity, used only so the app works. See RevenueCat's privacy policy.
• What we see: purchase counts and revenue tied to those random IDs. We cannot work out who you are from it, and we do not try.

Restoring purchases. If you reinstall or move to a new device, tap Restore Purchases in the Shop to get Remove Ads back. Coins cannot be restored, because they are consumed when you buy them and your balance is stored only on your device.

Refunds are handled by the store you paid. For the App Store, go to reportaproblem.apple.com. For Google Play, request a refund from your order history in Google Play.

6. What We Never Collect

• No account. No name, email address, phone number, postal address, sign-in, or user profile. Buying something does not create an account.
• No permission requests. The game does not ask for access to your camera, photos, contacts, location, microphone, or notifications. On Android, the only permissions are the ones the ad SDK needs automatically, for internet access and the advertising ID. They do not show a prompt.
• No analytics or crash reporting of our own. There is no Firebase, Mixpanel, Sentry, or similar tool in the game. We do not know how often you play or how far you have got. The diagnostic data listed in section 4 goes to Google for its ad service, not to us.
• No payment details. Apple and Google handle all payments.
• No selling. We do not sell, rent, or trade your information.

If we ever change what the game sends off your device, we will update this policy and the app's store privacy disclosures before that version ships, not after.

7. Your Choices

• Personalised ads on iPhone and iPad: tracking is already off for this game, because it never asks. You can check under Settings → Privacy & Security → Tracking.
• Personalised ads on Android: delete or reset your advertising ID. On most phones this is under Settings → Privacy → Ads, or Settings → Security & privacy → More privacy settings → Ads. Once the ID is deleted, apps can no longer use it to personalise ads.
• Fewer ads: buy Remove Ads to switch off banner and interstitial ads. Rewarded ads are only ever shown when you choose to watch one.
• Delete all your game data: delete the game. Your progress exists only on your device, so this removes it completely.
• Data held by Google or RevenueCat: contact those companies directly using the links in sections 4 and 5, or email us and we will help.

8. Device Backups

If you have iCloud Backup or Google's device backup switched on, your backup may include the game's data along with everything else on the device. Restoring that backup may bring your progress and coins back. The backup is created and held by Apple or Google under their own privacy policies and encryption. We have no access to it and no involvement in it, and we cannot recover progress from it for you.

9. Deleting Your Data

For anything the game stores, you do not need to ask us. Delete the game and its local storage is removed. There is no account to close and no copy of your progress on our side.

Some records can persist after you uninstall. RevenueCat and Apple or Google keep the purchase record, and Google keeps the ad data it holds under its own policy. You can ask us to erase our side of the purchase record by emailing us. It is held under a random ID, so you may need to send us that ID or your store receipt for us to find it, and we may need to keep the underlying transaction record where tax or accounting law requires.

10. If You Email Us

The one case where we receive personal information directly is when you choose to contact us. If you email us for support, we receive your email address and whatever you write. We use it only to reply, keep it only as long as needed to resolve the matter and for basic records, and do not add you to a mailing list.

11. Children

The game is not directed at children under 13, or under 16 in EU countries that set a higher age for consent to data processing, and it is not registered as a child-directed app in the App Store or Google Play. We do not knowingly collect personal information from children. If you believe a child has used the game in a way that caused their data to be collected, contact us and we will help. In-app purchases should only be made by the holder of the App Store or Google Play account, or with the account holder's permission. Both stores provide parental controls for purchases.

12. App Stores

Downloading the game and making purchases are transactions between you and Apple or Google. They collect their own data about downloads, purchases, and crashes under their own policies, which we do not control. Any crash reports Apple or Google share with us are aggregated and provided by the platform, not gathered by the game.

13. Changes to This Policy

If we change this policy, we will update the date at the top of this page. We will do so before shipping any version of the game that changes what data is handled.

14. Contact

Questions about this policy: contact@olaverse.co.uk

Appendix: Legal Detail

The sections above are the whole picture in plain English. This appendix restates the same facts in the formal terms that data protection law uses, for anyone who needs them.

A. Controller, Processors, and Scope

For the purposes of the UK GDPR and EU GDPR, the controller is Olaverse Labs, contactable at contact@olaverse.co.uk. Game progress and settings are processed entirely on your own device and are never transmitted to us, so they are not personal data under our control.

For purchase data we are the controller, and RevenueCat, Inc. acts as our processor under a data processing agreement. Apple and Google act as their own controllers for the payment itself.

For advertising, Google acts as an independent controller for the data its AdMob SDK collects from your device. We do not receive that data and cannot access it at the individual level.

We are also the controller for correspondence you send us directly.

B. Lawful Basis for Processing

• Game progress and settings: no lawful basis is required of us, as we carry out no processing. Processing on your own device, under your sole control, is not processing by us.
• Purchase and entitlement data: performance of a contract (Article 6(1)(b)), to deliver and restore what you bought. For the underlying transaction records, compliance with a legal obligation (Article 6(1)(c)) under tax and accounting law.
• Limited or non-personalised advertising in the UK, EEA, and Switzerland: legitimate interests (Article 6(1)(f)), to fund a free game without profiling you. You can reduce advertising by buying Remove Ads, or object by contacting us.
• Email correspondence: legitimate interests (Article 6(1)(f)), to respond to a request you chose to send us.

C. Your Rights Under UK and EU GDPR

You have the right to request access to your personal data, and its rectification, erasure, restriction, or portability, and to object to processing. For game progress these rights are exercised directly on your device, since we hold no copy: you already have full access, and deleting the game is immediate erasure.

For purchase records and any email correspondence you have sent us, you can exercise all of these rights by writing to contact@olaverse.co.uk. We respond within one month, as required. Purchase records are keyed to a random identifier rather than to you, so we may need you to supply that identifier or your store receipt to locate them. For advertising data, Google is the controller, and you can exercise your rights with Google directly.

If you believe we have handled your personal data unlawfully, you may complain to the UK Information Commissioner's Office at ico.org.uk, or to your national supervisory authority if you are in the EEA.

D. United States State Privacy Rights

Under laws including the California Consumer Privacy Act as amended by the CPRA, and the comprehensive privacy laws of states such as Virginia, Colorado, Connecticut, Utah, and Texas, we disclose the following:

• Categories of personal information collected through the app: identifiers, limited to a random, app-generated purchaser identifier and the IP address accompanying a purchase request; and commercial information, being your purchase history. Both reach us only through RevenueCat. Game progress remains on your device and is not collected by us.
• Advertising: Google's AdMob SDK collects device identifiers, coarse location derived from IP address, ad interactions, and diagnostic data. On Android, Google may use the advertising ID to show ads based on your interests, which some state laws treat as "sharing" for cross-context behavioural advertising or as "targeted advertising". You can opt out by deleting your Android advertising ID in device settings, as described in section 7. On iOS the game does not request tracking permission, so the IDFA is not available for this.
• Sensitive personal information: none. Neither we nor the game collect precise geolocation.
• Sold: we do not sell personal information for money.
• Sources: your device, via RevenueCat, for purchase data; and you directly, when you email us.
• Retention: purchase records for as long as needed to provide and restore your purchases, and thereafter only as long as tax and accounting law requires; email correspondence for as long as needed to handle your enquiry.

You may exercise your rights of access, correction, deletion, opt-out, and appeal by emailing contact@olaverse.co.uk. We will not discriminate against you for doing so.

E. International Transfers

Your game progress is not transferred anywhere: it stays on your device. Purchase data is processed by RevenueCat, Inc. in the United States, and advertising data is processed by Google in the United States and elsewhere. Both rely on the Standard Contractual Clauses, with the UK International Data Transfer Addendum where applicable. Email you send us is handled by our email provider in the course of ordinary email delivery.

F. Security

Your game progress is protected by your device's own security: its passcode, biometrics, and platform encryption. Purchase data travels over encrypted connections to RevenueCat and to the app stores, and ad requests travel over encrypted connections to Google. No system is perfectly secure, but because we hold no game data, a breach of our systems could not expose your progress.

G. Automated Decision-Making

The game calculates scores, stars, and streaks on your device. We make no automated decisions producing legal or similarly significant effects and do not profile you. Where Google personalises ads, it does so as its own controller under its own policies.