Privacy policy

Updated 17 July 2026 · Boss Battle Blog · [email protected]

This page explains what Boss Battle Blog collects when you read the site or subscribe to notifications, why we collect it, and what you can do about it. It is written for the Canadian regime — the Personal Information Protection and Electronic Documents Act (PIPEDA).

Who is responsible

Boss Battle Blog is an independent, two-person editorial project based in Montréal, Québec, Canada. It publishes reviews of free Android games. For any question about your personal information, or to exercise any right described below, write to [email protected]. We answer within 30 days, which is the PIPEDA deadline.

What we collect

Automatically, when you load a page

IP address and approximate region derived from it;
browser user-agent, language and device type;
the page you requested, the time, and the page that referred you;
server log data kept for security and troubleshooting;
cookies and similar identifiers — see the cookies page;
analytics identifiers and advertising identifiers, if you accept those cookie categories.

When you use the subscription form

your email address (required);
your name and phone number, if you choose to type them (both optional);
the fact that you ticked the consent box, and when;
a web-push identifier for your browser, if you allow notifications.

We do not ask for and do not want payment details, government identifiers, or anything about your health. We do not knowingly collect information from children under 13.

Why we collect it, and on what basis

Under PIPEDA our basis is your consent, express or implied depending on the purpose.

Running the site — implied consent. Serving pages, keeping them up, blocking abuse.
Notifications and email — express consent, given by ticking the box on the form. We only send notes about new or changed reviews.
Analytics — express consent through the cookie banner. Aggregate reading patterns, so we know which reviews are worth the time.
Advertising — express consent through the cookie banner. Advertising is how the site pays for itself; see the terms.

Push notifications and email — OneSignal

Web push and subscriber email are handled by OneSignal, Inc., which acts as our processor and stores data on servers in the United States. When you submit the form with the consent box ticked, we pass OneSignal your email address, and your name and phone number if you supplied them, together with a tag identifying this domain and the fact that the record came from the site form. If you then allow notifications in your browser, OneSignal also issues a push identifier tied to that browser.

Because the data is processed outside Canada, it may be accessible to foreign courts and authorities under the law of that country. PIPEDA permits this transfer where you are told about it — this paragraph is that notice. OneSignal's own privacy terms are published at onesignal.com.

You can withdraw at any time: use the unsubscribe link in any email, turn notifications off in your browser's site settings, or write to us and we will delete the record ourselves.

Who else receives data

Hosting and CDN — serves the pages and keeps access logs.
Analytics provider — aggregate readership statistics, only if you accept analytics cookies.
Advertising networks — only if you accept advertising cookies. They may set their own identifiers.
OneSignal, Inc. — email and web push, as described above.

We do not sell your personal information, and we do not trade subscriber lists. Game developers never receive your details — a link out to Google Play is just a link, and what happens on Google's side is governed by Google's own policies.

How long we keep it

Server logs: up to 12 months, then deleted.
Analytics data: up to 26 months in aggregate form.
Subscription data: until you unsubscribe or ask us to delete it, and no longer.
Cookie consent choice: stored in your own browser until you clear it.

Your rights

Under PIPEDA you may ask us to confirm whether we hold information about you, to give you access to it, to correct it if it is wrong, and to explain how it has been used and to whom it has been disclosed. You may withdraw consent at any time, subject to legal or contractual limits — for the subscription list, there are none, and withdrawal is immediate.

Write to [email protected]. If you are not satisfied with our answer, you have the right to complain to the Office of the Privacy Commissioner of Canada (OPC), 30 Victoria Street, Gatineau, Quebec K1A 1H3 — priv.gc.ca. Residents of Québec may also contact the Commission d'accès à l'information du Québec.

Security

The site is served over HTTPS. Access to the subscriber list is limited to the two people who write the site and is protected by two-factor authentication on the OneSignal account. No system is perfect, and we would rather say that than claim otherwise; if a breach ever creates a real risk of significant harm, we will report it as PIPEDA requires and tell the people affected.

Changes

If this policy changes materially we will change the date at the top and, for anything that affects consent, say so in a notification. This version takes effect on 17 July 2026.