Privacy Policy — Battle of Geniuses

Who we are

Battle of Geniuses is published by FREEDOM LLP, company number OC407608, of 101 King's Cross Road, London WC1X 9LP, United Kingdom. FREEDOM LLP is a limited liability partnership registered in England and Wales.

FREEDOM LLP is the controller of the personal data described in this policy. UK data protection law applies, including the UK GDPR. The studio contact address is [email protected]. To confirm: which mailbox should receive privacy questions and data-rights requests — [email protected], [email protected], or a new address? Is it monitored?

This version takes effect on To confirm: what effective date should the replacement policy carry?. It replaces the policy published at battleofgeniuses.com/privacy/ and also served at /privacypolicy.html. That version is dated 20 June 2026.

• ICO registration number: To confirm: what is FREEDOM LLP's ICO registration number? It does not appear anywhere in the source that was reviewed.
• Data protection officer or EU representative: To confirm: has FREEDOM LLP appointed a data protection officer, or an Article 27 representative for players in the EU?

What this policy covers

This policy covers the mobile game Battle of Geniuses (bundle identifier com.artadian.begenius) on the Apple App Store and on Google Play, together with the studio server at server.battleofgeniuses.com that supports it. The battleofgeniuses.com and freedomgaming.co websites are not covered here. To confirm: confirm those websites keep their own policy, including a cookie settings page at the new location and whether Google Analytics 4, Tag Manager and Google Consent Mode still run there. If they do not have their own policy, this one has to be extended to cover them.

It is built from three sources: the privacy label FREEDOM LLP filed with Apple, the Data safety declaration FREEDOM LLP filed with Google, and a review of the game's own code — the Unity client and the backend that serves it — carried out on 7 September 2026. Where a store filing and the code disagree, this policy describes what the code shows and says so.

The code reviewed was version 4.0.2, while version 4.0.8 is the published build. To confirm: confirm the components, endpoints and consent findings in this policy against the shipping 4.0.8 build before publication. To confirm: which privacy URL is currently linked from the App Store listing and from the Google Play listing, and will both be repointed at this policy before it takes effect?

Data we handle

The game has player accounts, held on FREEDOM LLP's own server at server.battleofgeniuses.com. The list below is what an account and a player record hold, taken from the game's backend code.

The two store filings do not agree with each other. Apple's label declares Purchases, Location, User Content, Identifiers, Usage Data and Diagnostics, and declares none of it linked to you. Google's Data safety declaration records that the app may collect Personal info, Messages and three further types, and may share Personal info with third parties. The records listed below are held against an individual player and include display names taken from Facebook, Game Center and Google Play Games, which are personal data. On that evidence Google's declaration matches the game and Apple's "not linked to you" classification does not. Both filings were made by FREEDOM LLP, and one of them has to be corrected. To confirm: which of the two filings will FREEDOM LLP correct, and by when?

Google's declaration also states that data is not encrypted in transit. The code review found the opposite. The game talks to the studio server at server.battleofgeniuses.com over HTTPS, and the studio's own analytics platform at api.appanalytics.ai over HTTPS. No plaintext endpoint carrying data was found in the client; the only plain http addresses are documentation and sample links inside third-party components. The Play answer appears to be out of date rather than accurate. To confirm: confirm this on the shipping 4.0.8 build, then correct the "not encrypted in transit" answer on the Play Data safety form.

• Linked services: if you link a Facebook, Apple Game Center or Google Play Games account, we store that service's identifier for you and the display name it gives us, plus a dated record of every link and unlink.
• Account details: Firebase push notification tokens, device identifiers, the date you registered, how many sessions you have played, and the date you were last online.
• Player profile: your in-game name and picture, your language, your clan, your friends list, your Facebook friends and your linked social accounts.
• Chat and moderation: chat information on your player record, reports you send, reports other players make about you, mutes and bans. Google's Messages category is consistent with this. To confirm: does Apple's User Content declaration cover the same chat data, or something else — profile text, submitted questions, images, support attachments? To confirm: does the server store the text of chat messages themselves, and if so for how long? The player record carries chat state, reports, mutes and bans; message content was not established.
• Diagnostics: Apple's label declares Diagnostics — crash and performance data — as data the app collects. No diagnostics field appears among the account and player fields that were reviewed, so it is collected by a component in the app rather than held on the studio server. To confirm: which component collects crash and performance data, what does that data contain, and does it carry a device or account identifier?
• Purchases: the game takes in-app purchases through Unity IAP. No purchase or entitlement field appears among the account and player fields that were reviewed.
• Location: Apple's label declares Location, and no location field appears among the account or player fields that were reviewed. To confirm: does the app collect location, at what precision, through which component, and for what purpose in this game — or is the Apple label wrong and to be corrected instead?

Advertising and tracking

The app carries advertising and attribution components. Its code contains Google AdMob and AppLovin MAX for advertising and ad mediation, the Meta SDK, and AppsFlyer for install attribution. Apple's label declares Usage Data as data used to track you. In Apple's own definition that means what you do in this game is linked with data collected in other companies' apps and websites, or shared with a data broker, for advertising and measurement. That involves profiling.

Apple's label also declares Identifiers as data the app collects. Tracking of this kind runs on the device advertising identifier and on the per-device identifiers that advertising, attribution and analytics components keep, and it is those identifiers that make the cross-app tracking declared on the App Store possible. Analytics in the app run through Amplitude, Firebase and FreedomAnalytics, FREEDOM LLP's own platform at api.appanalytics.ai. To confirm: which identifiers does each advertising, attribution and analytics component read from or write to the device?

No consent flow of the studio's own was found. A search of the game's own scripts for tracking-permission and consent calls — App Tracking Transparency, Google's consent APIs, and the AdMob and AppLovin consent flags — returned hits only inside vendor code, never in code written for this game. AppLovin's consent platform can be switched on from its dashboard without a code change, so this is strong evidence rather than proof. To confirm: is a consent management platform switched on for this app in the AppLovin or AdMob dashboard? If it is not, the cross-app tracking declared to Apple is running with no lawful basis under the UK GDPR and PECR. Either consent is collected before any tracking starts, or the tracking stops and the label is corrected.

• Apple and Google offer tracking and advertising settings on your device, and those apply to this app as to any other. They are platform controls, not ours, and they are not consent that FREEDOM LLP has collected. To withdraw consent or to object, see "Your rights".

In-app purchases

The app offers in-app purchases. The game includes Unity IAP, which wraps the App Store's and Google Play's own billing. Apple's label declares Purchases as data the app collects. The lawful basis for supplying what you buy is performance of our contract with you.

To confirm: does FREEDOM LLP's server receive or store receipts, transaction identifiers or entitlement records — for example to restore a purchase — and is any of it tied to a player account? No purchase or entitlement field appears in the account and player records that were reviewed.

Data stored on your device

The code review did not cover what the game writes to your device. To confirm: what does the app keep on the device — game progress, settings, identifiers cached by the advertising, attribution and analytics components, any permission choice — and does any of it survive uninstall? Storing or reading information on your device needs your consent under PECR, apart from what is strictly necessary to provide the game, and no consent flow of the studio's own was found in the game's code.

Neither Google Tag Manager nor a standalone Google Analytics 4 integration appears in the app's SDK folders. The components that are there are Amplitude, Firebase and FreedomAnalytics for analytics, and AppsFlyer for install attribution. To confirm: do Google Analytics 4, Tag Manager or Google Consent Mode run inside the app — including through Firebase reporting into a GA4 property — or on the website only?

Why we may process data

The purposes below are taken from the store filings and from the game's own code.

Our lawful bases are performance of our contract with you — running your account and supplying the in-app purchases you buy — our legitimate interests in running, securing and moderating the game, your consent where the law requires it, which includes advertising and cross-app tracking, and our legal obligations. Consent can be withdrawn at any time, and withdrawing it does not affect anything done beforehand; "Your rights" says how to withdraw it. To confirm: confirm the lawful basis for the profile, chat and moderation data.

• To run player accounts, and to link them to Facebook, Game Center and Google Play Games where you choose that.
• To run the game's social features — profile, friends, clans and chat.
• To moderate chat and act on player reports, including mutes and bans.
• To send push notifications.
• To provide the in-app purchases you buy.
• To measure and improve how the game is used, through Amplitude, Firebase and FreedomAnalytics.
• To find and fix crashes and problems with how the game runs, which is what Apple's Diagnostics category describes.
• For advertising, for install attribution through AppsFlyer, and for measurement, as described under "Advertising and tracking".
• Location: no purpose can be stated. To confirm: what purpose does the app collect Location for, and what is the lawful basis?

Sharing

Data from the app reaches the companies whose components are built into it. Google's Data safety declaration also records that personal information may be shared with third parties. The recipients are listed below.

The earlier policy said data goes only to providers acting on our instructions, and is never sold. That is not repeated here, because it does not fit the tracking declared on the App Store: partners in a cross-app tracking chain normally use data for their own purposes. To confirm: for each company named below, is it acting only on our instructions or as a controller in its own right?

The companies listed below are established outside the United Kingdom, so personal data from the app is transferred outside the UK. To confirm: which countries is data sent to, and which safeguard is relied on for each recipient — UK adequacy regulations, the IDTA, or the UK Addendum to the EU standard contractual clauses — and where can a copy be obtained?

• Advertising and ad mediation: Google AdMob, AppLovin MAX, Meta.
• Install attribution: AppsFlyer.
• Analytics: Amplitude, Firebase, and FreedomAnalytics, which is FREEDOM LLP's own platform.
• Crash and performance diagnostics: no recipient is confirmed. To confirm: which company receives the crash and performance data that Apple's Diagnostics category declares? Firebase is in the build, but the collecting component was not identified.
• Platform services: Apple, for App Store billing and Game Center; Google, for Play billing and Google Play Games; Meta, for Facebook account linking and the Facebook friends list. To confirm: does Unity receive any data through Unity IAP, or does that integration only wrap the App Store's and Google Play's own billing? If Unity receives data, in what role?
• Public authorities, where the law requires it.

Retention

No retention or deletion rule was found anywhere in the game's code, and no retention period is published here. None will be stated that has not been verified.

To confirm: is there a written retention or deletion rule at all, and what is the retention period, or the criteria, for each category — account and profile records, linked social identities, chat and moderation records, device identifiers and push tokens, usage and diagnostic data, purchase records, and support correspondence — at FREEDOM LLP and at each company listed under "Sharing"?

Your rights

Under UK data protection law you have the rights listed below over your personal data. We answer a request within one month. If a request is complex, or if you make several, that can be extended by up to two further months, and we will tell you if it is. To confirm: who owns the rights mailbox, and what internal process will meet that deadline?

You can object at any time to processing for direct marketing, including the profiling that goes with cross-app advertising. That right stands on its own: there is no balancing test, and if you object, that processing stops. To object, or to withdraw consent to advertising and cross-app tracking, write to the mailbox confirmed in "Who we are". To confirm: will an in-app control be added to withdraw advertising consent and turn off personalised advertising, so that withdrawing is as easy as giving consent, as Article 7(3) requires? No such control exists in the code that was reviewed.

Every account and player record on the studio server is held against an account identifier, and accounts link to Facebook, Game Center and Google Play Games identities, so a request can be matched to you through the game or through one of those linked accounts. Google Play's declaration records that you can ask us to delete your data. Google Play also requires a deletion-request page anyone can reach without installing or signing into the app, and an in-app route where the app has accounts — and this app has accounts. To confirm: what is the public deletion-request URL, and what is the in-app deletion path? Both need to exist, be tested, and be linked from the Play Data safety form before this policy is published. To confirm: is [email protected] still monitored, and will requests sent there be honoured during and after the move? If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office in the UK, or to the data protection authority where you live.

• Access to the data we hold about you.
• Correction of data that is wrong.
• Deletion of your data.
• Restriction of how we process it.
• Objection to processing, including for advertising and tracking.
• Portability of data you gave us.
• Withdrawal of any consent you gave.

Children

The app is rated 16+ on the App Store. The policy this replaces used an under-13 threshold. Those two positions do not line up. To confirm: what is the minimum age for this app, what is its Google Play content rating, and is it enrolled in the Play Families programme?

The ICO's Age Appropriate Design Code applies to any service likely to be accessed by anyone under 18, and expects profiling and behavioural advertising to be off by default for them. In the code that was reviewed, no child-directed or age-restricted flag is set for AdMob or AppLovin, and no consent flow of the studio's own was found. Apple's label declares that this app tracks users for advertising, so this affects 16- and 17-year-old players as well as younger ones. To confirm: does the app present an age screen or any other age assurance at first run? The code search covered consent and tracking-permission calls only, and would not have found one. To confirm: will profiling and personalised advertising be switched off by default for under-18s, and will the advertising components be configured for age-restricted treatment on both platforms?

If you believe a child has given us personal data, write to the mailbox confirmed in "Who we are" so that it can be deleted. To confirm: confirm that the mailbox is monitored and that a deletion route exists before this sentence is published — the evidence establishes only that erasure is technically feasible, since every record hangs off an account identifier.

Changes

We may update this policy. The current version always sits at To confirm: what is the canonical URL for the replacement policy? The earlier policy was published at battleofgeniuses.com/privacy/ and also served at /privacypolicy.html., with its effective date at the top.

We may also update the App Store privacy label and the Google Play Data safety declaration. The two filings currently contradict each other, and the Play answer on transport encryption does not match the code. To confirm: what internal process keeps this policy and the two store declarations in step when the app changes?

To confirm: publication steps — update the privacy policy URL in App Store Connect and in the Play Console, including the URL field on the Data safety form, and keep permanent redirects from battleofgeniuses.com/privacy/ and /privacypolicy.html to the new address, so existing store and in-app links do not break.

Contact

FREEDOM LLP, 101 King's Cross Road, London WC1X 9LP, United Kingdom. Company number OC407608.

The studio contact address is [email protected]. Privacy questions, requests to use a right, requests to withdraw consent to advertising, and requests to delete your data should go to the mailbox confirmed in "Who we are". To confirm: confirm which mailbox receives privacy and deletion requests, and confirm that it is monitored.