Privacy Policy — numbup Alpha
Effective Date: 2026-06-04 Replaces: Version of 2026-05-16 App Version: Alpha (Closed Testing) Publisher: Optional Industries, Vienna, Austria Contact: hello@optionalindustries.com
This Privacy Policy describes how Optional Industries ("we", "our", "us") collects, uses, and protects your personal data when you participate in the Closed Alpha test of numbup ("the App").
1. Scope
This policy applies only to the numbup Closed Alpha test build, distributed exclusively via Apple TestFlight and Google Play Internal Testing to a limited group of invited testers. It does not apply to any future public release, which will be governed by an updated policy.
2. Data We Collect
| Data | Why | Stored Where | How Long |
|---|---|---|---|
| Anonymous account ID (UUID) | Created automatically on first app start (no sign-up screen) to identify your game account, sync your progress, and isolate your data from other players | Supabase (EU, Ireland) | Until you request deletion or end of Alpha |
| Session tokens | Keep you signed in between app starts | Locally on your device (app-private storage) | Until sign-out, deletion, or uninstall |
| Cloud save (game progress) | Back up and restore your full game state (currencies, items, progression — no free-text content) | Supabase (EU, Ireland) | Until you request deletion or end of Alpha |
| Server game records | Anti-cheat: premium currency balance, summon results, collections, and dungeon progress are tracked server-side | Supabase (EU, Ireland) | Until you request deletion or end of Alpha |
| Gameplay telemetry events | Understand how the game is played (see §3); events are linked to your anonymous account ID | Supabase (EU, Ireland) | No fixed retention period during Alpha; a retention period will be defined before public release |
| Display name | Shown next to your messages in World Chat. Auto-generated (e.g. "BraveEagle42837") — never your real name unless you change it to one | Supabase (EU, Ireland) | Until you request deletion or end of Alpha |
| Chat messages (World Chat) | Communication between testers; visible to all testers | Supabase (EU, Ireland) | Until you request deletion or end of Alpha |
| Email address | Only if you sign in with an email Magic-Link. This option is not available in current Alpha builds — accounts are anonymous | Supabase Auth (EU, Ireland) | Until you request deletion or end of Alpha |
| Crash and performance reports | Currently disabled in Alpha builds. If we enable them, they go to Sentry with personal identifiers filtered out before sending (see §4) | Sentry — hosting region to be confirmed before activation | Retention to be configured before activation |
Gameplay telemetry in detail: events such as session start/end, level and dungeon attempts, currency spending, summons, crafting, equipping, hatching, research, and feature unlocks — together with the platform name (e.g. "iOS") and a debug-build flag. Telemetry contains no name, email, message content, device identifiers, or location.
We do not collect:
- Real names, addresses, phone numbers, or government IDs
- Payment information (Alpha is fully free, no in-app purchases active)
- Location data (no GPS)
- Contacts, photos, microphone, or camera data
- Advertising identifiers (IDFA/AAID) — the App contains no advertising or tracking SDKs
- Browsing or app activity outside numbup
3. How We Use Your Data (and on What Basis)
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide your game account, cloud save, and anti-cheat integrity | Account ID, cloud save, server game records | Performance of contract (GDPR Art. 6(1)(b)) |
| World Chat between testers | Display name, message text | Performance of contract (Art. 6(1)(b)) |
| Improve game balance and find where testers get stuck | Gameplay telemetry | Legitimate interest (Art. 6(1)(f)); the basis is under review before public release |
| Fix crashes and performance problems (when enabled) | Crash/performance reports | Same basis as telemetry |
| Authentication via email (when offered) | Email address | Performance of contract (Art. 6(1)(b)); never used for marketing |
4. Data Sharing
We do not sell or share your personal data with third parties for advertising or marketing.
Technical processors who handle data on our behalf:
- Supabase (Supabase Inc.): Database, authentication, and realtime infrastructure. Project hosted in the EU (Ireland, AWS eu-west-1). Supabase Privacy Policy
- Sentry (Functional Software, Inc.): Crash and performance reporting — currently inactive in Alpha builds.
- Apple / Google: Distribution via TestFlight / Internal Testing. Subject to their respective privacy policies.
5. Data Storage and Security
- All game data is stored on EU-based servers (Supabase, Ireland).
- Access is protected via Row Level Security — each account can only read its own data; chat messages are readable by all testers by design.
- Server-side writes go through validated endpoints only; save data is integrity-protected (HMAC).
- Session tokens are stored in the App's private storage area on your device. They are not encrypted at rest beyond what the operating system provides for app-private files; storing them in the platform keystore (iOS Keychain / Android Keystore) is planned before public release.
- All network traffic is encrypted in transit (TLS).
6. Your Rights (GDPR)
If you are in the EU, EEA, UK, or Switzerland, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your account and all associated data
- Export your data in a portable format
- Object to processing or restrict it
- Withdraw consent at any time (where processing is based on consent)
- Lodge a complaint with your local data protection authority (for Austria: dsb.gv.at)
Deletion and export are available in the app: open your profile, then Settings → Account, where you can Delete Account or Export My Data. Export gives you a machine-readable JSON copy of your data via the clipboard (a portable format, GDPR Art. 20). In-app deletion takes effect immediately and is irreversible — deleting your account removes all server-side data linked to it (account, saves, wallets, collections, chat messages, telemetry). As a fallback — for example if you have uninstalled the app — you can also email us at hello@optionalindustries.com, and we will fulfil deletion and export requests within 30 days.
7. Children
numbup Alpha is not intended for users under 16. We do not knowingly collect data from children under 16.
8. International Transfers
Game data is stored within the EU (Ireland). No transfers to third countries take place under the current Alpha scope. If crash reporting (Sentry) is activated with US hosting, this section will be updated with the applicable transfer mechanism (EU-US Data Privacy Framework / SCCs) before activation.
9. Cookies, Tracking, and Analytics
The App does not use cookies, advertising identifiers, or third-party advertising/tracking SDKs, and it does not track you across other companies' apps or websites.
The App does collect first-party gameplay telemetry linked to your anonymous account ID, as described in §2 and §3 — used solely to improve numbup, never for advertising, and never shared for marketing purposes.
10. Changes to This Policy
We will notify Alpha testers via the in-app World Chat or email if this policy changes materially. Continued use of the App after such notice constitutes acceptance of the updated policy.
11. Contact
Data Controller: Nikolaus Petr, natural person trading as "Optional Industries" Email: hello@optionalindustries.com Website: https://optionalindustries.com
This policy was drafted for the closed Alpha test phase. It will be replaced with a full GDPR-compliant public policy before any commercial release.