Privacy policy

Effective date: October 14, 2026

Who we are

Boss Lab XYZ inc. operates Boss Lab, a game where you build a mechanical boss, play Campaign battles and challenge other players asynchronously. We are responsible for the personal data described in this policy. Contact us at support@bosslab.xyz for privacy questions or requests.

Account and gameplay information

We use Supabase for authentication and our game database. An account has a unique identifier, including when you play as a guest. If you link an email, we process that email and verification information for account access and recovery. Where Google sign-in is available, Google provides account identity information, including your Google account ID, email and profile information, to Supabase Auth so you can sign in and recover your career. We never ask you to give support your password or sign-in code.

We save your career and progression, collection, currencies and Gems, player-created names, boss configurations and published builds, battle actions and results, Arena ratings, reward records, and account-related purchase records. We use these to run the game, save progress, verify battles and rewards, prevent cheating, and resolve support requests. Moderation reports, block relationships and session/deletion records help protect players and operate accounts.

What other players can see

Published inventor and boss names, boss appearance and equipment builds, Arena ratings and information needed for challenges can be visible to other players. Your email, sign-in credentials, private moderation reports and account economic records are not part of the public Arena profile. Do not put personal or sensitive information in public names or builds.

Service providers and sharing

Supabase processes account authentication and game database information. Render hosts the game server. Service providers process data to operate, secure and support the service. We do not sell personal data. We may disclose information when required by applicable law or to investigate abuse and protect the service.

Depending on provider configuration, information may be processed outside your country. Providers have their own privacy and security practices: Supabase, Render, Google, and RevenueCat.

Rewarded advertising and consent

Rewarded ads are currently disabled in the production release configuration while provider verification is completed. Boss Lab has no forced ads. When enabled, Google AdMob will provide optional ads that you can choose to watch for an in-game reward.

Google’s advertising SDK may process advertising identifiers, IP addresses, device and app information, ad views and interactions, and diagnostic information for ad delivery, measurement, security and fraud prevention. This data may be shared with Google and the advertising partners identified in the applicable consent message. Boss Lab also uses an account ID, ad-session ID and transaction evidence to validate an earned reward. A disabled in-game ad feature does not establish that an installed third-party SDK collects no data.

When advertising is enabled, Google’s User Messaging Platform (UMP) will present applicable privacy and consent choices before ads are requested where required. You can revisit the available choices through the game’s Settings privacy options. Declining to watch a rewarded ad does not prevent you from playing; you will not receive that ad’s reward. Advertising personalization also depends on your choices and applicable device settings. See Google’s advertising information.

Purchases

Real-money purchases are currently disabled in the production release configuration. When enabled, Google Play will process payments and RevenueCat will validate purchase entitlements using your Boss Lab account identifier and transaction information. We do not receive payment-card numbers. We use purchase, refund and entitlement records to deliver guaranteed product contents, avoid duplicate grants, reconcile refunds and help with missing purchases. Third-party providers maintain their own transaction records under their policies.

Diagnostics, logs and security

Optional remote game diagnostics are off unless enabled. The game’s aggregate diagnostics contain allowlisted event counts without stored account identifiers. If a configured error-reporting service is enabled, it receives limited technical failure and release information. Hosting and authentication providers may process access and security logs, including IP addresses and connection metadata.

We use authenticated access, server verification and access restrictions to protect account and gameplay data. The production account interface requires HTTPS. The Android credential storage implementation encrypts session records using the Android Keystore. No security measure can guarantee protection against every risk.

Retention and deletion

We retain online account and gameplay data while your account exists. Our approved retention policy limits service logs to 30 days and encrypted backup expiry to 30 days. Deletion removes the online sign-in identity and associated progression, collection, builds, publications, battles, Arena/rating data, and game-owned purchase, Gem and ad-reward records through the account deletion process.

Private deletion-verification records remain to confirm completion and prevent conflicting retries. These include the former account UUID, request identifiers, timestamps and receipt-verification metadata; they do not contain your gameplay profile or collection. They currently have no scheduled automatic expiry. Provider logs, backups and third-party transaction records are separate from the active game database. Providers may retain records under their policies or legal obligations. Local offline builds or exports on your own device are not erased by online account deletion.

See Delete your account for request methods, consequences and processing information.

Your choices and rights

Contact support@bosslab.xyz to request access, correction or deletion of your information, or to ask a privacy question. We may need to verify account ownership before acting. Depending on your location, you may also have rights to restrict or object to processing, receive a copy of your data, withdraw consent, or complain to your local data-protection authority. Withdrawing consent does not undo processing that was lawful before withdrawal.

Account and gameplay processing supports the service you request; security and abuse-prevention processing protects the service and its players. Advertising consent is requested where applicable, and records may also be processed to meet legal obligations. The exact rights and legal basis applicable to a request depend on your jurisdiction.

Audience

Boss Lab is intended for players aged 13 and over, in regions where it is distributed through Google Play. It is not directed at children under 13. If local law requires a higher age or guardian permission, those requirements apply. If you believe an underage child has provided personal information, contact us so we can investigate and take appropriate action.

This website and policy updates

This website contains no advertising SDKs or analytics trackers. Its hosting service may process normal access and security logs to deliver the pages. We will update this policy when our practices change and show the effective date above. Updated disclosures will accompany the activation of advertising or real-money purchases.