Privacy Policy — numbup Alpha
Effective Date: 2026-09-24
Replaces: Version of 2026-08-23
App Version: Alpha (Closed Testing)
Publisher: Optional Industries, Vienna, Austria
Contact: hello@optionalindustries.com
This Privacy Policy describes how Optional Industries ("we", "our", "us") collects, uses, and protects your personal data when you participate in the Closed Alpha test of numbup ("the App").
1. Scope
This policy applies only to the numbup Closed Alpha test build, distributed to invited testers as a direct Android download (sideloaded APK) and via Apple TestFlight. It does not apply to any future public release, which will be governed by an updated policy.
One part of it is not about the App at all: §10 covers this website, optionalindustries.com, which anyone can read without installing anything.
2. Data We Collect
| Data | Why | Stored Where | How Long |
|---|---|---|---|
| Anonymous account ID (UUID) | Created automatically on first app start (no sign-up screen) to identify your game account, sync your progress, and isolate your data from other players. The app shows it as your Player ID | Supabase (EU, Ireland) | Until you request deletion or end of Alpha; after that only in the Alpha archive (see below), deleted no later than 12 months after launch |
| Session tokens | Keep you signed in between app starts | Locally on your device (app-private storage) | Until sign-out, deletion, or uninstall |
| Cloud save (game progress) | Back up and restore your full game state (currencies, items, progression — no free-text content) | Supabase (EU, Ireland) | Until you request deletion or end of Alpha |
| Server game records | Anti-cheat: premium currency balance, summon results, collections, and dungeon progress are tracked server-side | Supabase (EU, Ireland) | Until you request deletion or end of Alpha |
| Gameplay telemetry events | Understand how the game is played (see §3); events are linked to your anonymous account ID | Supabase (EU, Ireland) | Deleted when the Alpha ends, and in any case no later than 12 months after the event |
| Display name | Shown next to your messages in World Chat, on the public Power Rankings list, and above the public stat sheet that other players can open from any chat line. Auto-generated (e.g. "BraveEagle42837") — never your real name unless you change it to one | Supabase (EU, Ireland) | Until you request deletion or end of Alpha; after that only in the Alpha archive (see below), deleted no later than 12 months after launch |
| Chat messages (World Chat) | Communication between testers; visible to all testers | Supabase (EU, Ireland) | 8 hours. Messages older than that are deleted automatically, except the 10 most recent ones, which stay so that the chat is not empty after a quiet night. Messages that have been reported or hidden are kept for up to 180 days instead, because they are the evidence behind a moderation decision. Deleting your account removes all of your messages immediately, whatever their age |
| Public profile snapshot | The stat sheet other players see, and the power value the Power Rankings sort by: which equipment slots you have filled, their level and rarity, ten aggregated substats and two totals. Deliberately nothing else — no currencies, no progress, no inventory. The rankings are part of the service we provide under our agreement with you (Art. 6(1)(b)); if you do not want to appear there, you can delete your account at any time | Supabase (EU, Ireland) | Until you request deletion or end of Alpha |
| Moderation records | Reports you send or that name you (the reason and your optional note), players you have blocked, and a suspension end date if you have one. If a message of yours is rejected by the word filter, we also store the text you tried to send, the terms it matched and how severe they were — without it a suspension can neither be justified nor appealed. That text was never posted and is never shown to other players | Supabase (EU, Ireland) | Reports and hidden messages up to 180 days; everything else until you request deletion or end of Alpha |
| Connection data (IP address) | Every request to our servers carries your IP address. We do not use it to profile you and we do not copy it into our own tables; it appears in our providers' technical logs, which exist to keep the service running and to defend against abuse | Supabase (EU, Ireland) · Sentry (EU, Germany) | Our providers' log retention — we hold no copy of our own |
| Email address | Only if you choose to link an email address to your account (in the app, confirmed with a one-time code we send to it), so that you can secure your account and restore it on another device. Accounts start anonymous; linking an email is optional | Supabase Auth (EU, Ireland) | Until you request deletion or end of Alpha; after that only in the Alpha archive (see below), deleted no later than 12 months after launch |
| Crash and performance reports | Active since the 2026-08-21 build. Diagnose crashes, freezes and performance problems. Contains device model, OS version, app version and a stack trace; personal identifiers are removed on your device before sending (see §4) | Sentry — EU region (Germany) | Up to 90 days |
Gameplay telemetry in detail: events such as session start/end, level and dungeon attempts, currency spending, summons, crafting, equipping, enhancing, hatching, research, idle rewards, the purchase and reroll of battle tips, and feature unlocks — together with the platform name (e.g. "iOS") and a debug-build flag. Telemetry contains no name, email, message content, device identifiers, or location.
We do not collect:
- Real names, addresses, phone numbers, or government IDs
- Payment information (Alpha is fully free, no in-app purchases active)
- Location data (no GPS)
- Contacts, photos, microphone, or camera data
- Advertising identifiers (IDFA/AAID) — the App contains no advertising or tracking SDKs
- Browsing or app activity outside numbup
Alpha archive (Hall of Fame)
When the Alpha ends, all game data is wiped before numbup launches. From that wipe we keep a small archive, for two purposes only: a Hall of Fame that names the Alpha testers by their display names, and a cosmetic thank-you for Alpha testers in the launch version of numbup (no stats, no gameplay advantage). To give you that thank-you, we need to match your Alpha account to your new account after launch.
Who is in it: only accounts that accepted this version of the policy (or a later one) on the consent screen in the app. Every other account is deleted completely with the wipe — nothing of it goes into the archive.
The archive contains only:
- your account ID (the Player ID shown in the app)
- the email address linked to your account, if you added one
- your display name
We keep your Player ID and email address for one reason only: to match your Alpha account to your new account after launch, so that the thank-you reaches you.
It does not contain your save or any figures from it. Your cloud save, server game records, public profile snapshot, chat messages, moderation records and telemetry are deleted with the wipe at the end of the Alpha (or earlier, as the table above states) — none of them goes into the archive. The Hall of Fame names testers by their display names only — no stats, scores or rankings, and never a Player ID or an email address. It is a post in our tester Discord server, so Discord Inc. processes those display names in the United States (see §4 and §8).
How long: the archive is deleted no later than 12 months after the public launch of numbup. We remove the Hall of Fame post together with the archive, no later than 12 months after the public launch. This part of the policy keeps applying after the Alpha ends, until the archive is gone.
Deletion: a deletion request covers the archive too. If you delete your account in the app before the Alpha ends, no archive entry is ever made for you. After the Alpha ends, email hello@optionalindustries.com with your Player ID or your email address, and we delete your archive entry and take your name out of the Hall of Fame post as soon as we receive the request — within 30 days at the latest (see §6). You can also object to the archive at any time (Art. 21 GDPR); that deletes your entry and takes your name out of the Hall of Fame post as well.
3. How We Use Your Data (and on What Basis)
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide your game account, cloud save, and anti-cheat integrity | Account ID, cloud save, server game records | Performance of contract (GDPR Art. 6(1)(b)) |
| World Chat between testers | Display name, message text | Performance of contract (Art. 6(1)(b)) |
| Show your public profile and the Power Rankings | Public profile snapshot, display name | Performance of contract (Art. 6(1)(b)) |
| Keep World Chat usable: word filter, reports, blocks, suspensions | Moderation records, display name, message text | Legal obligation (Art. 6(1)(c)) under the Digital Services Act, and our legitimate interest in a chat that testers can stand to be in (Art. 6(1)(f)) |
| Operate and secure the servers | Connection data | Legitimate interest (Art. 6(1)(f)) |
| Improve game balance and find where testers get stuck | Gameplay telemetry | Legitimate interest (Art. 6(1)(f)); the basis is under review before public release |
| Fix crashes and performance problems (when enabled) | Crash/performance reports | Same basis as telemetry |
| Link an email address to your account (optional, confirmed with a one-time code) to secure it and restore it on another device | Email address | Performance of contract (Art. 6(1)(b)); never used for marketing |
| Hall of Fame and a cosmetic thank-you for Alpha testers in the launch version (after the Alpha ends) | Alpha archive: account ID, email address (if added), display name | Legitimate interest (Art. 6(1)(f)) in recognising the people who tested numbup; you can object at any time, which deletes your entry |
4. Data Sharing
We do not sell or share your personal data with third parties for advertising or marketing.
Technical processors who handle data on our behalf:
- Supabase (Supabase Inc.): Database, authentication, and realtime infrastructure. Project hosted in the EU (Ireland, AWS eu-west-1). Supabase Privacy Policy. A data processing agreement under Art. 28 GDPR is in place.
- Sentry (Functional Software, Inc.): Crash and performance reporting — active. Events are sent to Sentry's EU region (Germany); personal identifiers (display name, account ID, e-mail, tokens) are stripped on your device before the event leaves it.
- Discord (Discord Inc.): When you report a chat message, that report is forwarded to a private moderation channel on Discord, so that a person sees it within 24 hours. Forwarded are the reported message text, the author's display name and the internal account IDs of author and reporter. After the Alpha ends, we also post the Alpha Hall of Fame in our tester Discord server — it names testers by their display names only (see §2, "Alpha archive"). Nothing else reaches Discord — ordinary chat messages, your save, your profile and your telemetry do not. Discord Inc. is a US company; see §8. Discord Privacy Policy
- Apple: Distribution via TestFlight, subject to Apple's privacy policy. The Android build is distributed as a direct download (sideloaded APK) — no app store is involved and no store operator receives your data through it.
5. Data Storage and Security
- All game data is stored on EU-based servers (Supabase, Ireland).
- Access is protected via Row Level Security — each account can only read its own data; chat messages are readable by all testers by design.
- Server-side writes go through validated endpoints only; save data is integrity-protected (HMAC).
- Session tokens are stored in the App's private storage area on your device. They are not encrypted at rest beyond what the operating system provides for app-private files; storing them in the platform keystore (iOS Keychain / Android Keystore) is planned before public release.
- All network traffic is encrypted in transit (TLS).
6. Your Rights (GDPR)
If you are in the EU, EEA, UK, or Switzerland, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your account and all associated data
- Export your data in a portable format
- Object to processing or restrict it
- Withdraw consent at any time (where processing is based on consent)
- Lodge a complaint with your local data protection authority (for Austria: dsb.gv.at)
Deletion and export are available in the app: open your profile, then Settings → Account, where you can Delete Account or Export My Data. Export gives you a machine-readable JSON copy of your data via the clipboard (a portable format, GDPR Art. 20). In-app deletion takes effect immediately and is irreversible — deleting your account removes all server-side data linked to it (account, saves, wallets, collections, chat messages, telemetry). One right currently has no button and runs by email: if you want to object to gameplay telemetry (Art. 21, because we collect it on the basis of legitimate interest), write to us and we will delete the telemetry we hold for your account. An in-app switch for this is planned.
As a fallback — for example if you have uninstalled the app — you can also email us at hello@optionalindustries.com, and we will fulfil deletion and export requests within 30 days.
7. Children
numbup is not made for children. The minimum age to use it is set out in our Terms of Service §3, and the age rating shown on the app's store page applies in addition.
Because accounts are created anonymously, we never ask for a date of birth — so we hold no age data and cannot verify anyone's age. If you are a parent or guardian and believe a child has created an account, write to hello@optionalindustries.com and we will delete the account and everything linked to it, the same way we handle any other deletion request (see §6).
8. International Transfers
Game data is stored within the EU (Ireland). Crash and performance reports are stored in the EU (Germany). Sentry's operator is a US company, so access from outside the EU cannot be ruled out for support purposes; that transfer is covered by the Standard Contractual Clauses in Sentry's Data Processing Addendum.
Reported chat messages are transferred to Discord (see §4) and are therefore processed in the United States. After the Alpha ends, we post the Alpha Hall of Fame — display names only — in our tester Discord server. Discord Inc. processes it in the United States. This affects reports and the Hall of Fame only — not ordinary chat, and nothing else in your account.
9. Cookies, Tracking, and Analytics
The App does not use cookies, advertising identifiers, or third-party advertising/tracking SDKs, and it does not track you across other companies' apps or websites.
The App does collect first-party gameplay telemetry linked to your anonymous account ID, as described in §2 and §3 — used solely to improve numbup, never for advertising, and never shared for marketing purposes.
10. This Website
optionalindustries.com is a plain static site. It sets no cookies, runs no analytics, tracking or advertising, and loads no fonts, scripts or images from anyone else — your browser talks to this domain and to nothing besides it. Nothing is written to your device, so there is nothing here for you to consent to.
The site is hosted on GitHub Pages (GitHub, Inc.) and delivered through GitHub's content-delivery network, Fastly, Inc. Every web request necessarily carries your IP address, and both companies process it — together with the address you asked for, your browser's user-agent string and the time — in technical server logs that exist to deliver the page and to fend off attacks. Those logs stay with them: we get no copy, we cannot query them, and nothing in them is joined to a player account or to any data in §2. Legal basis is our legitimate interest in running a reachable website (Art. 6(1)(f) GDPR); how long the logs live is the providers' own retention, not ours.
Both companies are US-based, so reading this site involves a transfer to the United States. The controller in §12 and your rights in §6 cover this site exactly as they cover the App.
11. Changes to This Policy
If this policy or our Terms change materially, the consent screen from your first app start appears again on the next start, showing the new version — that, not a chat message, is the notification. Continued use of the App after it constitutes acceptance of the updated policy.
12. Contact
Data Controller: Nikolaus Renato Petr, natural person trading as "Optional Industries"
Email: hello@optionalindustries.com
Report offensive content: report@optionalindustries.com (response within 24 hours)
Website: https://optionalindustries.com
This policy is written for the closed Alpha test phase and applies in full today. It will be updated for the public release, when the processing it describes changes.