Privacy Policy - Stratforge

1. Introduction

This Privacy Policy explains how Bosphor Studio I/S (CVR: 46346335), Istedgade 42B, 3., 1650 København V, Denmark ("we," "us," "our") collects, uses, stores, and protects your personal data when you use the StratForge mobile application ("App" or "Service").

We are committed to protecting your privacy and handling your data transparently and in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable data protection laws.

By using StratForge, you acknowledge that you have read and understood this Privacy Policy. If you have questions, contact us at support-stratforge@bosphorstudio.com.

2. Data Controller

The data controller responsible for your personal data is:

Bosphor Studio I/S
CVR: 46346335
Istedgade 42B, 3.
1650 København V, Denmark
Email: support-stratforge@bosphorstudio.com

We have not appointed a Data Protection Officer (DPO) as our processing activities do not require one under Article 37 of the GDPR. All privacy inquiries should be directed to the email address above.

3. What Personal Data We Collect

We collect and process different categories of data depending on how you interact with the Service.

3.1 Account Data

When you create an account, we collect:

Email address — used for account identification, login, email verification, and password reset communications
Display name — your chosen name visible to team members within the App
Password — if you register with email and password, we store a securely hashed version (Argon2) of your password. We never store or have access to your plain-text password.
Third-party identity data — if you sign in via a supported identity provider (e.g., Google), we receive a unique account identifier and your verified email address from that provider. We do not receive or store your password from the identity provider.

3.2 Profile Data

You may optionally provide:

Profile image — uploaded and stored via our content delivery network
Preferred in-game roles — stored as part of your profile preferences

3.3 Team and Content Data

When you use team features, we process:

Team metadata (name, description, team image)
Team membership and role assignments
Strategies, callouts, grenade placements, and match schedules you create
Favorited grenade utilities

This data is stored on our servers and is accessible to other members of your team based on their role permissions.

3.4 Device and Technical Data

Push notification tokens — if you enable push notifications, we store an encrypted device token to deliver notifications to your device. These tokens are encrypted at rest using AES-256 encryption.
IP address — temporarily processed for rate limiting and security purposes (e.g., preventing brute-force login attempts). IP addresses are not stored persistently or linked to your account.

3.5 Analytics Data (Anonymized)

We use the privacy-friendly analytics service TelemetryDeck (TelemetryDeck GmbH, Von-der-Tann-Str. 54, 86159 Augsburg, Germany) to understand how the App is used. TelemetryDeck does not collect any personally identifiable information. All user identifiers are cryptographically anonymized before they leave your device, using a one-way hash that cannot be reversed or traced back to you. The data collected includes only anonymous usage signals (e.g., "app opened," "screen viewed") and contains no personal data as defined by the GDPR.

For more information, see TelemetryDeck's privacy policy at https://telemetrydeck.com/privacy.

3.6 Crash Reports (Anonymous)

We use a crash reporting service to collect anonymous diagnostic data when the App encounters errors. Crash reports do not contain any user identifiers, email addresses, or personally identifiable information. They include only technical data such as device type, operating system version, and stack traces to help us identify and fix bugs.

3.7 Data We Do NOT Collect

StratForge does not collect:

Location or GPS data
Contacts or address book data
Photos, camera, or microphone data
Health or biometric data
Payment or credit card information (handled entirely by the App Stores)
Advertising identifiers (IDFA/GAID)
Browsing history or data from other apps

4. Why and How We Use Your Data (Legal Basis)

Under the GDPR, we must have a valid legal basis for each processing activity. The table below summarizes our purposes and their legal grounds.

Purpose	Data Used	Legal Basis (GDPR)
Account creation and authentication	Email, password hash, display name, third-party ID	Contract performance — Art. 6(1)(b)
Email verification and password resets	Email address	Contract performance — Art. 6(1)(b)
Providing the Service (teams, strategies, maps, schedules)	Team data, content data, profile data	Contract performance — Art. 6(1)(b)
Subscription and entitlement management	Subscription status, entitlement records	Contract performance — Art. 6(1)(b)
Push notification delivery	Encrypted device token	Contract performance — Art. 6(1)(b)
Rate limiting and security	IP address (temporary)	Legitimate interest — Art. 6(1)(f)
Anonymous product analytics	Anonymized usage signals (TelemetryDeck)	Legitimate interest — Art. 6(1)(f). Note: this data is not personal data under GDPR.
Crash reporting and bug fixes	Anonymous crash data	Legitimate interest — Art. 6(1)(f). Note: this data is not personal data under GDPR.
Compliance with legal obligations	Account data, subscription records	Legal obligation — Art. 6(1)(c)

Regarding legitimate interest: Where we rely on legitimate interest, we have conducted a balancing assessment to ensure our interests do not override your fundamental rights and freedoms. Our analytics are fully anonymized (TelemetryDeck) or contain no personal data (crash reports), minimizing any impact on your privacy. Rate limiting uses IP addresses only temporarily and never stores them linked to your identity.

5. Third-Party Data Processors

We share personal data with the following categories of third-party service providers, each of which processes data on our behalf under a Data Processing Agreement (DPA):

Provider / Category	Purpose	Data Shared	Location
Identity provider (e.g., Google)	User authentication via OAuth	Authentication token (verified server-side only)	United States / EU
Subscription management service	Subscription state and entitlement verification	User identifier, subscription status	EU / United States
Push notification service (Firebase Cloud Messaging)	Delivering push notifications	Encrypted device token, notification content	United States (Google)
Crash reporting service (Firebase Crashlytics)	Anonymous crash diagnostics	Anonymous crash data (no PII)	United States (Google)
Analytics service (TelemetryDeck GmbH)	Anonymous product analytics	Anonymized, non-personal usage signals	Germany (EU)
Content delivery network	Hosting profile images, team images, and video content	Uploaded images, video streams	EU / Global edge network
Transactional email service	Sending verification codes and password resets	Email address, email content	EU / United States
App Stores (Apple / Google)	App distribution, billing, and refunds	As per App Store terms (we do not control this data)	United States / Global

We do not sell, rent, or trade your personal data to any third party. We only share data with processors as described above, and each processor is contractually bound to use it solely for the purposes specified.

6. International Data Transfers

Our primary servers are located in the European Union (EU). However, some of our third-party processors operate in the United States or other countries outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, including:

European Commission adequacy decisions — where the destination country has been deemed to provide an adequate level of data protection
EU–U.S. Data Privacy Framework — for transfers to U.S.-based processors that are certified under the framework
Standard Contractual Clauses (SCCs) — EU-approved contractual terms that bind the processor to protect your data to EU standards

You may request information about the specific safeguards applied to any transfer by contacting us.

7. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy.

7.1 Active Accounts

While your account is active, we retain all account data, profile data, and content data necessary to provide the Service.

7.2 Deleted Accounts

When you delete your account through the App:

Your account data (email, display name, profile image) is anonymized or deleted as soon as technically possible
Your team memberships, favorites, and notification tokens are removed
Content you created within teams (strategies, callouts, schedules) persists but is attributed to a generic placeholder and no longer linked to your identity

7.3 Subscription Records

If you have an active subscription at the time of account deletion, we may retain limited subscription-servicing and compliance records for a defined period. These records are kept solely to verify entitlement, handle refunds or chargebacks, or assist you in re-linking a subscription to a new account. They are stored separately, access-restricted, and deleted when no longer necessary.

7.4 Anonymized and Aggregated Data

Anonymized analytics data (TelemetryDeck) and anonymous crash reports cannot be traced back to you and may be retained indefinitely for product improvement purposes. This data is not personal data under the GDPR.

7.5 Legal Obligations

We may retain certain data beyond the periods stated above where required by law (e.g., tax, accounting, or legal compliance obligations).

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

Encryption at rest — push notification tokens are encrypted using AES-256
Encryption in transit — all data transmitted between the App and our servers uses HTTPS/TLS encryption
Password hashing — passwords are hashed using Argon2 with salt and pepper, an industry-leading algorithm resistant to brute-force attacks
Token security — refresh tokens are stored hashed and rotated on each use
Access controls — access to personal data is restricted to authorized personnel only
Rate limiting — login and registration endpoints are rate-limited to prevent abuse

While we take reasonable precautions, no system is completely secure. We cannot guarantee absolute security of your data, but we are committed to promptly addressing any security incidents.

9. Your Rights

Under the GDPR and applicable data protection laws, you have the following rights regarding your personal data:

9.1 Right of Access (Art. 15 GDPR)

You have the right to request a copy of the personal data we hold about you and information about how it is processed.

9.2 Right to Rectification (Art. 16 GDPR)

You may update your display name, profile image, and other profile information directly in the App at any time. For corrections to other data, contact us.

9.3 Right to Erasure (Art. 17 GDPR)

You can delete your account at any time through the App. This will anonymize or delete your personal data as described in Section 7. You may also contact us to request erasure.

9.4 Right to Restriction of Processing (Art. 18 GDPR)

You may request that we restrict the processing of your personal data in certain circumstances, such as while we verify the accuracy of your data or assess an objection you have raised.

9.5 Right to Data Portability (Art. 20 GDPR)

You have the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.

9.6 Right to Object (Art. 21 GDPR)

You have the right to object to processing based on legitimate interest. If you object, we will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

9.7 Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Danish Data Protection Agency (Datatilsynet):

Datatilsynet
Carl Jacobsens Vej 35
2500 Valby, Denmark
https://www.datatilsynet.dk

If you reside in another EU/EEA member state, you may also lodge a complaint with your local supervisory authority.

9.8 How to Exercise Your Rights

To exercise any of the above rights, contact us at support-stratforge@bosphorstudio.com. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

10. Children's Privacy

StratForge is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have inadvertently collected personal data from a child under 13, we will take steps to delete that data as soon as possible.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support-stratforge@bosphorstudio.com.

11. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information.

We do not sell or share your personal information as defined by the CCPA/CPRA. We do not use your personal information for cross-context behavioral advertising.

As a California resident, you have the right to:

Know what personal information we collect, use, and disclose
Request deletion of your personal information
Non-discrimination for exercising your privacy rights

To exercise these rights, contact us at support-stratforge@bosphorstudio.com.

12. Push Notifications

If you opt in to push notifications, we store an encrypted device token on our servers to deliver notifications. This token cannot identify you personally without access to your account data.

You may disable push notifications at any time through your device's system settings. When you disable notifications or delete your account, your device token is removed from our servers.

We periodically remove invalid or expired tokens from our systems to maintain data hygiene.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.

When we make material changes, we will:

Update the "Effective Date" at the top of this document
Notify you through the App or via email

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes are published constitutes acceptance of the updated policy.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Bosphor Studio I/S
CVR: 46346335
Istedgade 42B, 3.
1650 København V, Denmark
Email: support-stratforge@bosphorstudio.com
Website: www.bosphorstudio.com

Table of Contents