BoosterMap
BoosterMap Privacy Policy
Version: 2026-10-06
This English policy covers the BoosterMap application and website. Choosing a residence country does not select a translated edition. Contract acceptance and optional permissions or data consents are separate.
BoosterMap serves a general audience and is not specifically directed at children. This notice describes our current practices, including an unresolved issue concerning local crash diagnostics explained below.
The replacement iOS App Store candidate, version 1.0.0 build 37, has been verified without Firebase Crashlytics or Firebase Sessions. It was uploaded to Apple and rejected on 5 October 2026 for beta/test references on the purchase page; an updated candidate is being prepared with manual release after approval. Android and older installed iOS builds still contain Crashlytics; their local-capture and consent-capacity questions are not closed by removing it from the replacement iOS build.
One-time PLUS launch grant
To prevent the same recognized registration identity receiving the one-time PLUS campaign benefit again, we keep purpose-separated keyed digests of the supplied normalized registration email and recognized Apple/Google provider identifiers. A digest is pseudonymous personal data, not an anonymous record, and a supplied email does not establish mailbox ownership. These records never authenticate, restore or link another account and never extend an original grant's expiry.
We retain only the digest, original claim reference where available, purpose, creation time and review date. They may remain after account deletion while the same one-time campaign remains available, because deleting them would permit repeat claiming. We review necessity at least annually and remove campaign-recognition records when this campaign is permanently closed and no specifically documented legal retention ground applies. Use is restricted to preventing repeat grants. This limited anti-abuse processing relies on our legitimate interest in administering the one-time benefit fairly; you may object or request erasure using the contact below, and we assess the applicable conditions individually. It does not create a payment, subscription renewal or advertising profile.
Who is responsible and how to contact us
The controller for BoosterMap's own processing is Filip Černý, IČO 08131384, Hvězdova 1280/27, Nusle, 140 00 Praha 4, Czech Republic. Write to info@boostermap.com for privacy questions or to exercise a right. You may also use the postal address. Acknowledging this notice means you have received information; it does not give us consent for every purpose.
A short explanation for younger users
BoosterMap helps you find places and see reports about trading cards. We need some information to make the app work. A nickname is not a guarantee that nobody can recognise you. Do not put your home address, school, phone number or secrets into a nickname or a message. Stock reports use choices rather than public comments or photos. Messages you send to support are still read by people helping with the service. You can ask us what we know about you, ask for correction or deletion, and ask for an explanation in simpler words. You do not need to know legal terminology to contact us.
Information and purposes
We obtain information from you, your device when you use a feature, your chosen sign-in or purchase provider, people reporting an issue, and public place-data sources. We distinguish necessary service processing from optional consent-based purposes. The following legal bases apply only where their conditions are met; describing a purpose as part of a service does not make all collection necessary.
| Purpose | Information involved | Basis and why it is needed |
|---|---|---|
| Create and operate an account | Email, handle, account ID, password hash for password accounts, chosen provider's account identifier and supplied profile details; session/authentication records | Performance of the account contract where validly formed; necessary pre-contract steps at your request. Without necessary sign-in data we cannot create or authenticate that account. |
| Prove contractual actions and deliver notices | Document versions and hashes, market/languages, action source and times, release and acceptance evidence, pseudonymous proof linked to an account | Legitimate interests in demonstrating the agreed terms and defending claims; legal obligation where particular records are legally required. This is not proof of optional consent unless that separate action was recorded. |
| Deliver maps and place information | Requested map area, searches/filters and network metadata, such as IP address; device/request details needed to return tiles | Performance of the requested service where applicable; legitimate interests in delivering and securing public browsing. A manually selected map area need not be your physical location. |
| Provide an optional current-location alert function | Precise coordinates, location time, device/account association and preferences | Separate consent for the optional precise-location purpose. Refusal means this location-based function cannot work, not that all browsing must stop. |
| Save your chosen watch locations and preferences | Named locations, exact map centres, radius, game/edition/product choices, saved product-search queries and notification settings | Performance of the feature you request. A saved map point can identify a home or routine even if manually chosen. You can remove saved locations separately. |
| Verify and publish structured stock reports | Place, catalogue selections, status, time, reporting account, verification location sent by the device, accuracy, capture time, mock-location signal, distance/verification evidence and request identifiers | Performance of the reporting feature and legitimate interests in accurate, abuse-resistant community information. Precise device verification remains subject to the applicable device-permission/consent rules; we do not infer permission from Terms acceptance. |
| Deliver requested alerts | Push token or browser subscription, installation/device ID, platform/version, alert content and delivery status | Performance of requested notifications; legitimate interests in maintaining reliable delivery. Marketing would need its own applicable basis and is not authorised by enabling stock alerts. |
| Verify purchases, grant paid access and understand subscription performance | App account ID, store/product and transaction identifiers, purchase/renewal/expiry/refund states, entitlement and restoration events | Performance of subscription services; applicable accounting/legal obligations and legitimate interests in preventing billing fraud, resolving disputes and understanding subscription performance through RevenueCat reports. These reports concern subscription operation, rather than advertising tracking. A payment provider handles payment credentials; do not send card details to BoosterMap support. |
| Answer support, review place suggestions and investigate reports | Your message, contact details, submitted place details, optional evidence, subject IDs, correspondence and decisions | Contract performance for service requests; legitimate interests in corrections, safety and dispute handling; legal obligations for applicable rights requests and unlawful-content procedures. |
| Protect the service and enforce fair participation | Security events, request metadata, rate-limit or abuse signals, reputation/quality information and moderation decisions | Legitimate interests in account and service security and reliable reports; legal obligation where a specific duty applies. These purposes require necessity, proportionality and particular care for children. |
| Crash diagnostics in Android and older iOS builds: local processing and report submission | Crash/nonfatal traces, app/device and session information and installation identifiers, described below | Optional submission to Google is intended to rely on your consent through Enable diagnostics. Native recording and local storage can occur before that choice. We have not yet established the applicable legal basis and device-storage authority for those earlier operations. A later choice does not retrospectively authorise them. |
We do not require you to supply unrelated sensitive information to support. If a report includes information about another person, provide only what is needed and tell us why it matters. For publicly sourced business information that identifies a person, the purpose is to maintain a useful place directory and correct its accuracy, on the basis of our legitimate interests subject to that person's rights.
Public information, location and historical content
Structured reports can show the reported place, selected scope/products, status, time and reporter label/tier. Reporter identifiers and leaderboard handles can allow reports to be linked to a person or pattern of activity. Choosing a nickname does not make the underlying records anonymous. A leaderboard visibility preference concerns that display; it should not be understood as erasing all report attribution.
The report-verification flow can send precise GPS information to our server. The report service does not retain the original coordinates in the new report's reported_from field, but retains verification information such as distance, accuracy and time. A pending local report can retain its location while waiting to send. This is different from current-location alerts and saved watch locations, each of which has a separate lifecycle.
New stock reports do not publish free-text comments or user-uploaded report photos. Historical comments/photos are suppressed from current public report responses and displays. Suppression alone does not delete database records, stored objects, previously issued URLs or third-party copies. Private support, moderation and place-suggestion text still exists and may contain personal data. Approved place information can become public after editorial review.
Service providers and other recipients
People who operate support, security and moderation access information relevant to their duties. Public report and place information is available to other users. When a function uses an external provider, the provider receives the information required for that function; its role can differ between providing services to us and operating its own user-facing service.
- Roští.cz, s.r.o. hosts the application, database and local uploaded files in the Czech Republic and supplies outgoing SMTP email delivery. Hosting includes provider-operated backup and security processes. Our support mailbox receives messages you send to our contact address.
- OpenFreeMap delivers map styles and tiles directly to the map client and receives your IP address, technical request information and requested map area. OpenStreetMap is a source for the base map; map attribution does not mean its contributors receive your account or precise location.
- Cloudflare supports website delivery and app updates. Update checks and downloads use Workers, release metadata in D1 and bundle storage in R2. These requests disclose network and technical update information. Our current upload storage is on Roští, rather than in R2.
- Apple and Google process information when you choose their sign-in or store services. RevenueCat, Inc. uses the app account identifier and purchase, entitlement, restoration and refund information to manage subscription access and provide subscription-performance reports. Account identity synchronization can occur without a purchase.
- Apple Push Notification service, Firebase Cloud Messaging, Expo and browser push providers route requested notifications. They receive delivery tokens or subscriptions and notification payloads. Older app versions can still use Expo.
- Google Ireland Limited / Firebase Crashlytics provides the diagnostics integration described below. Server Sentry reporting is currently disabled.
- OpenAI supplies configured moderation checks. Relevant submitted text or images can be sent to its API to assess content safety. This concerns support, suggestions and moderation paths where a check is used; it does not mean every structured stock report sends a message or image to OpenAI.
- Courts, regulators and professional advisers can receive limited information where disclosure is legally required or necessary to establish, exercise or defend a legal claim.
TCGGO supplies edition and sealed-product catalogue information to our server through its free API plan. A free plan does not itself certify rights to third-party artwork. Using that catalogue does not require sending your BoosterMap account or precise location to TCGGO. A directly loaded supplier image can disclose your IP address and request metadata to its image host.
Some providers process information outside the European Economic Area, including in the United States. GDPR requires an applicable adequacy decision or safeguards such as the European Commission's standard contractual clauses for these transfers. The provider arrangements include separate data-processing terms; contact info@boostermap.com for information about the safeguards applicable to your data and how to obtain a copy.
Crash diagnostics and your device
Replacement iOS version 1.0.0, build 37: Firebase Crashlytics and Firebase Sessions are excluded from its native dependencies. It offers no optional Crashlytics diagnostics control and does not submit crash/error reports through that integration. This statement applies only to build 37 and later builds that retain the same exclusion; it does not describe earlier installed iOS builds. Removing the SDK from a new build does not recall reports already sent to Google or certify deletion of files created by an older build.
Android and older iOS builds: Standard Firebase Crashlytics is retained. Reports can contain crash time, exception details and stack traces, app/OS versions, device information and installation or session identifiers. Firebase Sessions also groups app-quality reports using session information, including foreground/background timing. They are not necessarily anonymous. Our limited billing-error categories do not remove native SDK metadata.
The following description applies to Android and older iOS builds that contain the SDK.
Explicitly choosing Enable diagnostics after the in-app explanation enables automatic sending to Google, including pending reports created while Off. It is not a separate approval for each report. The explanation identifies the report categories, Google recipient, US and other-country processing, retention and withdrawal limits. Choosing Keep off does not enable sending. The app stores the diagnostic choice, notice-policy version and decision time locally. Previous notice-version opt-ins require a new choice. This choice is separate from precise location and is not required to buy a plan or accept the Terms.
Off blocks new app-requested events through our reporting control and asks the SDK to disable automatic sending and delete pending reports. Native capture and local storage can continue while Off. This does not guarantee immediate shutdown of recording, completed deletion, or cancellation of every handed-off or in-flight report. Reports already sent cannot be recalled by the switch; residual session data and caches may remain. If saving or applying the choice fails, follow the displayed error/retry guidance: a failed write may leave an older saved choice that returns after restart. No success is promised under storage failure.
The app uses a native startup safeguard to reset automatic sending before Firebase starts; restoring your saved choice can then enable it. If applying or saving your choice fails, follow the displayed retry guidance. An unsuccessful save can leave a previously saved choice in effect after restart.
Google states that crash traces and associated identifiers are retained for 90 days before deletion begins from live and backup systems. It is not a guarantee that all copies disappear on day 90 and is not the local cache-retention rule. Account deletion does not itself prove Google-side diagnostic deletion.
Unsent native reports can remain in local app storage across launches until the SDK sends, deletes or evicts them, or the relevant local app data is removed. Our Off control requests deletion of pending reports after the choice is applied, but native recording can then create further local data. The installed iOS SDK limits the number of unsent reports; this is not a maximum duration in days, nor a guarantee that all diagnostic preferences, identifiers or caches are removed. We do not promise a universal elapsed-time expiry for local diagnostics.
Withdrawing consent does not invalidate earlier lawful processing, but does not authorise new processing relying solely on withdrawn consent. The technical limits above are not a legal exception. The unresolved assessment also covers consent requirements for younger users and effective handling of withdrawal, objection and erasure for diagnostic data. General-audience positioning does not establish a younger user's capacity to consent. Publishing or acknowledging this notice does not resolve these issues.
Firebase's processing terms, incorporated into its Crashlytics agreement, describe international-transfer arrangements, including the EU–US Data Privacy Framework for certified US entities and applicable standard contractual clauses when that transfer solution is unavailable. Email info@boostermap.com to request information or a copy of the safeguards applicable to your data. Notice of US processing is separate from establishing these safeguards.
For younger users: Off does not stop all crash information being saved on your device. On can send saved reports to Google. This explanation is not by itself valid consent. See Device Technologies.
Retention and deletion
We use category-specific purposes and cleanup rules. Deletion and external-provider cleanup can take time; a failed operation needs to be retried. The following rules distinguish active data from retained evidence and backups.
| Category | Rule or retention criterion |
|---|---|
| Active account, settings and saved locations | Kept to provide the active account/feature until removed or account deletion is processed, subject to specific lawful exceptions below. |
| Current alert location | Explicit withdrawal clears current device/user location when the withdrawal request succeeds; the stale-location rule clears entries older than 30 days. This is not the rule for saved map centres or report evidence. |
| Account deletion | An in-app deletion request soft-deletes the account; the purge selects accounts deleted more than 30 days ago. Verified web confirmation invokes permanent internal deletion without that waiting period. External provider cleanup can remain pending. See Account Deletion for the distinction. |
| Export contents | Download/export payload expires after 24 hours and the hourly cleanup removes the payload; an audit row can remain. |
| Device/delivery records | Device cleanup targets failed push devices or devices not updated for 180 days. Legacy sent alerts have a 90-day rule; separate notification history has a 365-day rule. |
| Moderation text | Description redaction is scheduled after 12 months from creation and decision reasons after 12 months from decision. This is not deletion of all contacts, structured decisions or appeal evidence. |
| Historical rejected photos and orphan uploads | Rejected-photo cleanup targets 30 days after moderation; orphan upload cleanup depends on ticket expiry. This is not a universal maximum for all pending or historical photos. |
| Provider operational/security logs | Roští publishes a maximum retention of one year, except where a specific security incident, service abuse or legal obligation requires longer. This is a provider maximum, not a claim that every HTTP request is logged or kept for that full period. Exact upstream HTTP fields and ordinary retention are not exposed in the reviewed documentation/API. Our own Nginx access logging is disabled; the runtime daily Laravel channel retains daily logs for 14 days. Older single/emergency files are outside that daily rotation guarantee. |
| Backups | Roští maintains provider backups. Its application-hosting documentation describes daily backups and approximately 30 days of database history. These snapshots are not edited separately when one account is deleted; residual data ages out with backup rotation. Restored data must remain subject to previously requested deletion. We do not promise immediate removal from every backup. |
| Legal evidence, anti-abuse/deletion reconciliation and unresolved claims | Only the information necessary for the identified obligation, defence or outstanding cleanup should be retained, with restricted use. Pseudonymous legal proofs and anti-relink digests remain personal data; a review date is not an automatic erasure date. A deletion-race tombstone is scheduled for removal after 90 days. Other legal or dispute evidence is kept while the relevant legal obligation, applicable claim period, unresolved claim or deletion reconciliation requires it; it is not reused to operate a deleted account. |
Historical report facts may remain after removal of identifying material where genuinely anonymous. Removing an author field alone is not sufficient if an ID, hash, text, time, location or other linkage still identifies a person. Deleting an account does not cancel App Store or Google Play billing or automatically delete records those stores lawfully keep for their own obligations.
Your rights and choices
Subject to the conditions in applicable law, you can request access and a copy, correction, erasure, restriction, and portability of information you provided where processing is automated and based on consent or contract. You can object, on grounds relating to your situation, to legitimate-interest processing. We must then stop unless the applicable test for continuing is met; direct-marketing objections must be honoured. You can withdraw a consent as easily as giving it. These rights are not all interchangeable and do not require account deletion.
Email info@boostermap.com. Identify the relevant account or information, but do not send passwords, payment credentials or an identity-document copy unsolicited. We may seek proportionate verification if needed to prevent disclosure to someone else. Requests are normally free. Under GDPR we respond without undue delay and within one month; where legally justified by complexity or number, a further two months is possible, with notice and reasons within the first month. A refusal must explain the reason and available remedies.
You may complain to a supervisory authority, including the authority where you habitually reside, work or where an alleged infringement occurred. The Czech authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ). You do not have to complain to us first. Court remedies remain available.
Children, automated processing and changes
BoosterMap is intended for the general public and collectors, and is not specifically directed at children. These documents do not impose a blanket minimum age. Children may need a parent or guardian to authorize a contract or optional processing under the law that applies to them. Legal capacity to contract and capacity to consent to optional processing are separate questions. We do not interpret a child's use, a store account, OS permission or acceptance of Terms as proof of every required authorisation. No parental-approval workflow is represented as existing in this notice. A valid legal basis and any additional device/SDK conditions must be satisfied before the relevant processing is enabled.
Automated validation, report weighting and preliminary moderation can affect whether information appears and how it is presented. You can contest an incorrect decision through support or the reporting procedure and request human consideration. This notice does not make the unverified blanket claim that there is no automated processing or that none can ever have a significant effect.
We will update this notice when processing materially changes and give appropriate notice. A revised privacy notice does not by itself expand an existing consent. Necessary security controls reduce risk but are not a promise that no incident can occur; affected people and authorities will be notified where the law requires it.
Cookies and device storage
The website uses session and security cookies for sign-in, CSRF protection, OAuth sign-in attempts and confidential request receipts. The configured idle session lifetime is two hours; a new request can renew the session. Signing out or clearing browser data can remove related credentials. Blocking this storage can prevent sign-in or secure forms from working.
The browser stores your selected theme until you change it or clear local storage. Choosing to postpone the browser-notification prompt stores a reminder timestamp for 30 days; this does not authorize push notifications. The current website does not configure advertising or optional analytics cookies.
The app stores the authentication session, onboarding and permission choices, read-alert state, cached public place responses, place/report drafts and queued or failed reports locally. These records support features you request and can remain until they are replaced, delivered, removed through the applicable feature, or local app storage is cleared. Drafts and failed reports do not have a universal automatic expiry. A queued report can include verification location while awaiting delivery. Signing out should not be assumed to erase every draft or cache. Native secure storage can have an operating-system lifecycle separate from ordinary app files.
App-update software also stores the downloaded bundle and update state needed to run the installed app. Native Crashlytics capture and storage are separate, as explained above. A location or diagnostics switch is not a general cookie consent, and accepting the Terms does not authorize unrelated optional device storage.