Box Of Clicks Privacy Policy
Effective 14 October 2026
1. Who we are and what this covers
Box Of Clicks Ltd ("we", "us") makes mobile apps. This policy explains what information our apps collect, why, who we share it with, and the choices you have. The first part of the policy (sections 1 and 2) and the last part (sections 4 to 10) apply to all our apps. Section 3 describes, app by app, exactly what each one collects.
Box Of Clicks Ltd is a company registered in the United Kingdom. We are the "controller" of the personal data our apps collect, for the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018). This policy applies to the apps listed in section 3. It does not cover third-party sites or services our apps link to.
2. Our commitments
We do not sell your personal information, and we do not share it with data brokers.
We collect only what each app needs to work, to be improved, and to show ads where the app has them.
You can ask us at any time for a copy of your data or to delete it (section 5).
3. Our apps
3.1 Chess & Toast
The short version. You do not need to create an account or give us your email address or real name. We store the games you play, your rating and your friends list so the game works across sessions and devices. We use Google Firebase to understand how the app is used and to find crashes. The app shows ads (Google AdMob), and they are only personalised if you allow tracking when the app asks.
Information Chess & Toast collects
What
Why
Player ID. A random identifier our server gives your device the first time you play. It is not your name and is not linked to your phone number or email.
To keep your games, rating and progress together.
Display name and avatar. The name you choose or your Game Center alias, and, if you use Game Center, your Game Center profile picture (we keep only the latest copy).
To show you to opponents and friends.
Game Center identity. If you sign in to Game Center, its player identifier and alias.
So your games follow you to a new phone and so achievements can be recorded.
Linked chess accounts (optional). If you choose to link a Lichess or Chess.com account, the public username and rating.
To set your starting rating and to confirm the account is yours.
Gameplay data. Games, moves, results, your rating, daily puzzle results, achievements, and the friends you add using invite codes.
To run the game, including games against friends and bots that continue while the app is closed.
Push notification token. An address issued by Apple (or Google) for your device, used only if you allow notifications.
To tell you it is your turn and to update Live Activities and widgets.
Usage and diagnostics. Which screens you open, which features you use, how levels go, crash reports, performance information, device model and operating system version.
To fix bugs and improve the game.
Advertising information. The app uses Google AdMob. AdMob may collect your device's advertising identifier (only if you allow tracking), IP address (which gives approximate location), and information about how you interact with ads.
To show and measure ads, including the optional ads you can watch for extra energy.
Chess & Toast does not access your contacts, precise location, camera, microphone, photos or health data.
How Chess & Toast uses it
To provide and operate the game, including correspondence games, friends, ratings and notifications.
To understand how the app is used and to find and fix problems.
To show advertising and measure how it performs.
To keep the service safe and prevent abuse.
Under UK data protection law, our lawful bases are: performing our contract with you, which is providing the game you asked for (gameplay data, player ID, notifications); our legitimate interests in running, securing and improving the game (analytics, crash reports); and your consent (personalised ads and tracking, which you can refuse or withdraw at any time). Where we or our advertising partners store or access information on your device, such as the advertising identifier, we ask for your consent first, as the Privacy and Electronic Communications Regulations (PECR) require.
Who Chess & Toast shares it with
Google (Firebase Analytics and Crashlytics; AdMob), for usage statistics, crash reports and ads. See policies.google.com/privacy and firebase.google.com/support/privacy.
Apple (Game Center, push notifications, TestFlight and the App Store) and, where used, Google for push delivery.
Our hosting provider (Oracle Cloud Infrastructure), which stores the data on our server.
Other players. Opponents and friends can see your display name, avatar, rating and the games you play with them.
We may also disclose information if the law requires it.
Tracking and advertising choices
On iOS, the app asks permission before it uses your advertising identifier to personalise ads. If you decline, you will still see ads, but they will not be personalised using that identifier, and the whole game remains playable. You can change this at any time in iOS Settings, Privacy & Security, Tracking. In regions where it is required, the app also shows a consent form for ads.
How long Chess & Toast keeps it
We keep your player record, games and ratings for as long as you use the app, and delete them when you ask us to (section 5). Avatars are overwritten each time you upload one, so only the latest is kept. Analytics and crash data are kept by Google for the retention periods configured in our Firebase settings.
4. Security
Data is sent between our apps and our servers over encrypted connections (HTTPS), and access to our servers is restricted. No system is perfectly secure, but we take reasonable steps to protect your information.
5. Your choices and rights
Under UK data protection law you have the right to: be told how your data is used (this policy); get a copy of your data; have inaccurate data corrected; have your data deleted; restrict or object to our use of it; receive your data in a portable format; and withdraw consent at any time where we rely on it. To use any of these, email us at the address in section 10 and tell us which app you mean. For Chess & Toast, give us your display name and the approximate date you started playing so we can find your record. We will respond within one month, and we do not charge for this. Deleting an app from your device does not by itself delete the data on our servers.
If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113.
If you live outside the UK, for example in the EU or in a US state with a privacy law, you may have similar rights under your local law, and you can use them in the same way. We do not sell your information or share it for cross-context behavioural advertising except through the Google ad services described in section 3, which you control through the tracking choice in the app and in iOS Settings.
6. Children
Our apps are not directed at children under 13, the age at which a child in the UK can consent to an online service themselves, and we do not knowingly collect personal information from them. If you believe a child has given us information, contact us and we will delete it.
7. International transfers
Our servers and our providers may process information outside the UK, including in the United States. Where we transfer personal data outside the UK, we make sure it is protected, either because the destination has a UK adequacy decision (including the UK-US data bridge where a provider is certified under it) or by using the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
8. Changes
If we change this policy we will update the date at the top. If a change is significant, we will tell you in the app.
9. Third-party services
Services we use, such as Google, Apple and our hosting provider, have their own privacy policies, and we encourage you to read them.
10. Contact
Box Of Clicks Ltd, registered in England and Wales, company number 06806922
Registered office: 80 Temple Road, Oxford, OX4 3DL, United Kingdom
Email: tim@boxofclicks.com