STRATFORGE
Effective Date: September 16, 2026
Bosphor Studio I/S
CVR: 46346335
Copenhagen, Denmark
Last updated: September 16, 2026
This Privacy Policy explains how Bosphor Studio I/S (CVR: 46346335), Istedgade 42B, 3., 1650 København V, Denmark ("we," "us," "our") collects, uses, stores, and protects your personal data when you use the StratForge mobile application ("App" or "Service").
We are committed to protecting your privacy and handling your data transparently and in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable data protection laws.
By using StratForge, you acknowledge that you have read and understood this Privacy Policy. If you have questions, contact us at support-stratforge@bosphorstudio.com.
The data controller responsible for your personal data is:
Bosphor Studio I/S
CVR: 46346335
Istedgade 42B, 3.
1650 København V, Denmark
Email: support-stratforge@bosphorstudio.com
We have not appointed a Data Protection Officer (DPO) as our processing activities do not require one under Article 37 of the GDPR. All privacy inquiries should be directed to the email address above.
We collect and process different categories of data depending on how you interact with the Service.
When you create an account, we collect:
You may optionally provide:
When you use team features, we process:
This data is stored on our servers and is accessible to other members of your team based on their role permissions.
We use PostHog (PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA), hosted on PostHog's EU Cloud in Frankfurt, Germany, to understand how the App is used and to improve it.
PostHog runs in anonymous mode. We do not send your email address, display name, account ID, team names or any content you create. Instead, PostHog generates a random identifier on your device when the App is first opened and attaches it to the usage events it records. This identifier is not linked to your account, cannot be used by us to look you up, and is reset when you reinstall the App. We have turned off PostHog's location lookup, so no country, region or city is derived from your IP address.
The data recorded includes:
Because this data is tied to a random per-install identifier, we treat it as pseudonymous personal data and process it on the basis of our legitimate interest in understanding and improving the App (Art. 6(1)(f) GDPR). It is never combined with your account data.
For more information, see PostHog's privacy policy at https://posthog.com/privacy.
We use a crash reporting service to collect anonymous diagnostic data when the App encounters errors. Crash reports do not contain any user identifiers, email addresses, or personally identifiable information. They include only technical data such as device type, operating system version, and stack traces to help us identify and fix bugs.
StratForge does not collect:
Advertising identifiers (IDFA on iOS, Advertising ID on Android) are collected only if you opt in as described in Section 3.8.
Marketing links and install attribution. We promote StratForge through creators and social channels. Our marketing links are managed by AppsFlyer (AppsFlyer Ltd., 14 Maskit Street, Herzliya, Israel), which stores our data in its European Union data center. When you install or open the App from one of our links, AppsFlyer resolves the link and tells the App which channel, campaign, placement and format it came from, and where in the App to take you. On Android the App also reads the Google Play Install Referrer, which carries the same campaign information. We use this to route you to the right screen and to measure which of our own channels bring players to StratForge. This processing does not use advertising identifiers and does not share data with advertising networks. It is based on our legitimate interest in operating and measuring our own marketing (Art. 6(1)(f) GDPR).
Sharing with advertising partners. In addition, and only if you choose "Allow" on the "Share Activity" screen (and, on iOS, also allow tracking in the system prompt), we share the following with our advertising partners through AppsFlyer so they can measure which ads bring new players to StratForge and show StratForge ads to people who are likely to enjoy it:
Our advertising partners are:
| Partner | Entity for EEA users | Privacy policy |
|---|---|---|
| Meta Ads (Facebook, Instagram) | Meta Platforms Ireland Ltd. | https://www.facebook.com/privacy/policy |
| TikTok for Business | TikTok Technology Ltd. (Ireland) | https://www.tiktok.com/legal/privacy-policy |
| Google Ads | Google Ireland Ltd. | https://policies.google.com/privacy |
These partners use the data for their own advertising measurement and optimisation and act as independent controllers for that processing. Their own privacy policies apply. On iOS, Apple's SKAdNetwork framework may additionally report install attribution to these partners in a privacy-preserving way without revealing your identity.
We never share your name, email address, account ID, teams, strategies or any content you create with advertising partners.
Your choice. Sharing is off until you turn it on. The "Share Activity" screen is shown once when you start using the App; declining it does not change anything in the App. You can turn sharing on or off at any time in Profile > Share Activity. On iOS you can also disable it in Settings > Privacy & Security > Tracking. When you turn sharing off, the App stops collecting advertising identifiers, blocks all sharing with advertising partners, and removes the AppsFlyer identifier from your subscription profile. Data that was already shared before you turned it off is not recalled.
Your choice is stored on your device only and is not sent to our servers. We record whether you allowed or declined (without any identifier that could name you) in our analytics so we can understand how many players opt in. This sharing is based on your consent (Art. 6(1)(a) GDPR).
Under the GDPR, we must have a valid legal basis for each processing activity. The table below summarizes our purposes and their legal grounds.
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Account creation and authentication | Email, password hash, display name, third-party ID | Contract performance — Art. 6(1)(b) |
| Email verification and password resets | Email address | Contract performance — Art. 6(1)(b) |
| Providing the Service (teams, strategies, maps, schedules) | Team data, content data, profile data | Contract performance — Art. 6(1)(b) |
| Subscription and entitlement management | Subscription status, entitlement records | Contract performance — Art. 6(1)(b) |
| Push notification delivery | Encrypted device token | Contract performance — Art. 6(1)(b) |
| Rate limiting and security | IP address (temporary) | Legitimate interest — Art. 6(1)(f) |
| Pseudonymous product analytics | Per-install random identifier, usage events and context described in Section 3.5 (PostHog) | Legitimate interest — Art. 6(1)(f) |
| Marketing-link routing and first-party campaign measurement | Link parameters, install referrer, AppsFlyer device identifier (anonymised, no advertising ID) | Legitimate interest — Art. 6(1)(f) |
| Advertising attribution and sharing with advertising partners | Advertising identifier, IDFV, AppsFlyer identifier, installs, opens and paywall events, subscription events (Section 3.8) | Consent — Art. 6(1)(a); withdrawable at any time |
| Crash reporting and bug fixes | Anonymous crash data | Legitimate interest — Art. 6(1)(f) |
| Compliance with legal obligations | Account data, subscription records | Legal obligation — Art. 6(1)(c) |
Regarding legitimate interest: Where we rely on legitimate interest, we have conducted a balancing assessment to ensure our interests do not override your fundamental rights and freedoms. Our analytics use a random per-install identifier and are never combined with your account, and you may object at any time (Section 9.6). Crash reports contain no personal data. Rate limiting uses IP addresses only temporarily and never stores them linked to your identity.
We share personal data with the following third-party service providers, each of which processes data on our behalf under a Data Processing Agreement (DPA):
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Identity provider (Google, Apple) | User authentication | Authentication token (verified server-side only) | United States / EU |
| Adapty (Adapty Tech Inc., USA) | Subscription management, paywalls and entitlement verification | Pseudonymous customer ID, App Store / Google Play receipts and transactions, subscription status; with your consent, your AppsFlyer identifier | United States |
| AppsFlyer (AppsFlyer Ltd., Israel) | Marketing-link resolution, install attribution and, with your consent, forwarding to advertising partners | See Section 3.8 | European Union (data center) |
| Push notification service (Firebase Cloud Messaging, Google) | Delivering push notifications | Encrypted device token, notification content | United States |
| Crash reporting service (Firebase Crashlytics, Google) | Anonymous crash diagnostics | Anonymous crash data (no PII) | United States |
| Analytics service (PostHog Inc.) | Pseudonymous product analytics | Per-install identifier and usage events (Section 3.5) | Germany (EU Cloud) |
| Content delivery network | Hosting profile images, team images, and video content | Uploaded images, video streams | EU / Global edge network |
| Transactional email service | Sending verification codes and password resets | Email address, email content | EU / United States |
| App Stores (Apple / Google) | App distribution, billing, and refunds | As per App Store terms (we do not control this data) | United States / Global |
The advertising partners listed in Section 3.8 (Meta, TikTok, Google Ads) receive data only with your consent and act as independent controllers for their own advertising purposes; they are not our processors.
We do not sell, rent, or trade your personal data to any third party. We only share data with processors as described above, and each processor is contractually bound to use it solely for the purposes specified.
Our primary servers are located in the European Union (EU). However, some of our third-party processors operate in the United States or other countries outside the European Economic Area (EEA).
Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, including:
PostHog is a US company but stores our analytics data exclusively in its EU (Frankfurt) region. AppsFlyer stores our attribution data in its European Union data center; AppsFlyer Ltd. is based in Israel, which the European Commission recognises as providing an adequate level of data protection. Transfers to Adapty, Google, Meta and TikTok in the United States rely on the EU–U.S. Data Privacy Framework where the recipient is certified, and otherwise on Standard Contractual Clauses.
You may request information about the specific safeguards applied to any transfer by contacting us.
We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy.
While your account is active, we retain all account data, profile data, and content data necessary to provide the Service.
When you delete your account through the App:
If you have an active subscription at the time of account deletion, we may retain limited subscription-servicing and compliance records for a defined period. These records are kept solely to verify entitlement, handle refunds or chargebacks, or assist you in re-linking a subscription to a new account. They are stored separately, access-restricted, and deleted when no longer necessary.
Pseudonymous analytics data (PostHog) is retained for 24 months and is never linked to your account. Attribution data held by AppsFlyer is retained for 24 months. Data shared with advertising partners is retained according to their own policies. Your consent choice is stored on your device until you change it or reinstall the App. Anonymous crash reports may be retained indefinitely for product improvement purposes.
We may retain certain data beyond the periods stated above where required by law (e.g., tax, accounting, or legal compliance obligations).
We implement appropriate technical and organizational measures to protect your personal data, including:
While we take reasonable precautions, no system is completely secure. We cannot guarantee absolute security of your data, but we are committed to promptly addressing any security incidents.
Under the GDPR and applicable data protection laws, you have the following rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you and information about how it is processed.
You may update your display name, profile image, and other profile information directly in the App at any time. For corrections to other data, contact us.
You can delete your account at any time through the App. This will anonymize or delete your personal data as described in Section 7. You may also contact us to request erasure.
You may request that we restrict the processing of your personal data in certain circumstances, such as while we verify the accuracy of your data or assess an objection you have raised.
You have the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
You have the right to object to processing based on legitimate interest. If you object, we will cease processing unless we demonstrate compelling legitimate grounds that override your interests. You may object to our pseudonymous analytics by contacting us. Because analytics data is not linked to your account, we cannot locate your individual records; deleting and reinstalling the App resets the analytics identifier on your device.
If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Danish Data Protection Agency (Datatilsynet):
Datatilsynet
Carl Jacobsens Vej 35
2500 Valby, Denmark
https://www.datatilsynet.dk
If you reside in another EU/EEA member state, you may also lodge a complaint with your local supervisory authority.
Where we rely on your consent (sharing with advertising partners, Section 3.8), you may withdraw it at any time in Profile > Share Activity, or on iOS in Settings > Privacy & Security > Tracking. Withdrawal does not affect the lawfulness of processing before withdrawal.
To exercise any of the above rights, contact us at support-stratforge@bosphorstudio.com. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.
StratForge is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have inadvertently collected personal data from a child under 13, we will take steps to delete that data as soon as possible.
If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support-stratforge@bosphorstudio.com.
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information.
We do not sell your personal information. If you opt in to Share Activity (Section 3.8), we share your device's advertising identifier and the app events described there with advertising partners for cross-context behavioral advertising, which is "sharing" under the CPRA. You may opt out of this sharing at any time in Profile > Share Activity. We do not knowingly share the personal information of consumers under 16.
As a California resident, you have the right to:
To exercise these rights, contact us at support-stratforge@bosphorstudio.com.
If you opt in to push notifications, we store an encrypted device token on our servers to deliver notifications. This token cannot identify you personally without access to your account data.
You may disable push notifications at any time through your device's system settings. When you disable notifications or delete your account, your device token is removed from our servers.
We periodically remove invalid or expired tokens from our systems to maintain data hygiene.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.
When we make material changes, we will:
We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes are published constitutes acceptance of the updated policy.
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
Bosphor Studio I/S
CVR: 46346335
Istedgade 42B, 3.
1650 København V, Denmark
Email: support-stratforge@bosphorstudio.com
Website: www.bosphorstudio.com