Privacy
Policy
BOSSFYTE is a game about photographing real cars in the real world. That means it asks for two genuinely sensitive things — your camera and your precise location — and it would be dishonest to bury that. This page says exactly what is taken, why it is needed, and what happens to it.
The short version
- You do not need an account to play. The app creates an anonymous one on your device. No email, no name, no phone number.
- There are no advertising or analytics SDKs in the app. It has exactly two third-party components: the client for our own database, and a rendering library. Nothing in the app is reporting your behaviour to anyone. This website is a separate thing and does use analytics — see This website.
- We do not sell your data. There is no mechanism to, and no business model that would want to.
- There is no payment code in the app at all, so there is no payment information to collect. Nothing in BOSSFYTE can be bought.
- A catch you strike is published to other players, including its location. This is the one to read carefully — see What other people can see.
What we collect
| What | Why | How long |
|---|---|---|
| Your capture photograph | It is the card. Card art is only ever your own photograph, and it is fixed to the card when the card is struck. | Until you delete the card or your account |
| Precise location of the catch | Latitude, longitude, accuracy and compass bearing, read at the moment of the shutter. It is the card's provenance, and it is how we detect impossible sequences of catches. | For the life of the card |
| Time of the catch | Provenance, and first-to-spot ordering — who caught a model first is decided on this. | For the life of the card |
| A visual fingerprint of the photo | A perceptual hash, used with the location to work out whether two catches are the same physical car. It cannot be turned back into the photograph. | For the life of the card |
| Device attestation | Apple's App Attest gives us a key that proves catches came from a genuine, unmodified copy of the app. We store the key identifier and public key. It does not identify you or your device to us. | While the account exists |
| Your spotter number and handle | Your identity in the game. The number is issued in order of arrival and never changes. | While the account exists |
| Game state | Cards, balances, streaks, sets, battles and the ledger those are derived from. | While the account exists |
| Things you post | Comments, reactions, follows, blocks and reports on the social feed. | Until you delete them or your account |
| Push token | Only if you allow notifications. It lets Apple deliver a message to your device; it is not tied to anything else about you. | Until you turn notifications off |
If you link an Apple account
Linking is optional and exists for one reason: an anonymous account lives on one device, and linking is what lets your garage survive a lost phone. Sign in with Apple handles it. If you use Apple's Hide My Email, we only ever receive the relay address — we never see your real one.
What we deliberately do not collect
We do not read your photo library. The app has no photo picker, no share sheet and no file path into capture anywhere — a catch is born inside the camera or it does not exist. We do not track you across other apps or websites, we do not build advertising profiles, and we do not collect contacts, calendars, health data or anything else the game has no use for.
What other people can see
This is the part that deserves your attention before you play.
When you strike a card it appears on the public feed. Other players can see your spotter number and handle, the car, when you caught it, your photograph, and where the catch happened. The location is shared at the precision it was recorded, and it is what places your catch on the globe.
Consider what that means over time. A pattern of catches can describe where you live, where you work, and when you are usually there. If you would rather a particular catch not carry that, do not strike it near somewhere private to you.
We think coarser public locations are the better default, and reducing the precision shared with other players is on the roadmap. Until it ships, the paragraph above is the honest description of how it works today.
Where it is kept
Photographs and game data are held in our Supabase project — managed Postgres and object storage. Apple handles notification delivery and, if you link an account, sign-in. Those two companies are the only processors involved in running the app. The app itself uses no analytics, advertising, attribution or crash-reporting service of any kind.
Everything is sent over TLS. The app uses only the encryption Apple's operating system provides.
Your choices
- Camera and location are asked for by iOS and can be withdrawn at any time in Settings. Withdrawing the camera stops you catching cars — the whole game is the shutter. Withdrawing location stops a catch carrying provenance, which means it cannot be struck.
- Notifications are optional and can be turned off in Settings.
- Delete a catch and its photograph and location go with it.
- Delete your account and we remove your photographs, locations, cards, posts and profile. Ask at info@bossfyte.com and we will confirm when it is done. Some records are kept where the law requires it, and anonymised counts that cannot be traced back to you may remain in aggregate statistics.
Depending on where you live you may have additional rights — to a copy of your data, to correct it, or to object to how it is used. Write to the address above and we will honour them.
This website
Everything above is about the app. This website — bossfyte.com — is separate, and unlike the app it does measure traffic.
We use Google Analytics to count visits and see which pages people read and whether they go on to TestFlight. It sets Google's own cookies in your browser and sends Google your IP address, browser and device type, the pages you view and the site you arrived from. Google processes that as a data processor on our behalf, and their handling of it is governed by Google's privacy policy. We use it to understand whether the site is working, not to build a profile of you, and we do not run advertising, retargeting or any other tag.
If you would rather not be counted, Google publishes a browser opt-out add-on, and any browser setting or extension that blocks analytics or third-party cookies will stop it. Nothing on the site breaks if you do — blocking it costs you nothing.
We also use Vercel Web Analytics, from the company that hosts the site. It counts page views without cookies and without any identifier stored in your browser, and it does not follow you to other websites.
The site loads its typefaces from Fontshare and Google Fonts, which means those two receive your IP address when a page loads. Beyond the Google Analytics cookies described above, the site sets no cookies of its own, and there is no account, login or form anywhere on it.
Children
BOSSFYTE is not directed at children under 13, and we do not knowingly collect anything from them. If you believe a child has given us data, write to info@bossfyte.com and we will delete it.
Changes
If this policy changes in a way that affects what we collect or who sees it, we will say so in the app rather than quietly updating the date at the top of this page.