Privacy Policy

1. Who is responsible

ARKADE CLUB PRIVATE LIMITED operates Box Box Club and is responsible for the personal information processed for the purposes described here. Where the GDPR applies, we act as the controller for that processing.

For a privacy question or request, contact us using these details and identify your request as “Box Box privacy”. Do not send passwords, full payment-card details or unnecessary identity documents.

2. Information we collect and its sources

Accounts and sign-in

When you create or use an account, we process your Box Box user ID, sign-in method, sign-in information and account details. With supported Apple or Google sign-in, we receive the identity information authorised through that provider, such as your name and email address. Apple may supply a private relay email address if you choose that option. We do not receive your Apple or Google password. Guest access can still create a service or installation identifier and generate technical records; “guest” does not mean that no personal information is processed.

Profile and preferences

We process the display name, user tag, profile image and personalisation you provide, including favourite drivers, teams and circuits, racing number, interests, widget preferences and notification choices. Account-linked settings and selected profile images are sent to our servers. Some display settings and cached data are also kept on your device.

Community contributions

When you use Debrief, we process race ratings, review text, the viewing or attendance option you select, votes, reports, associated user and review IDs, and creation or modification times. Content can contain personal information about you or others, so avoid including private or sensitive details. We also receive information about content from users who report it and from moderation systems.

Purchases and subscriptions

We process purchase records needed to provide paid access, such as the plan purchased, purchase reference, subscription status, purchase/renewal dates and relevant price information. We receive this information from the purchasing store and subscription infrastructure. For Apple App Store and Google Play billing, payment credentials are handled by the store; Box Box does not receive your full payment-card number through those purchase flows. Our iOS subscription integration also sends a signed-in user’s Box Box ID, display name and email address to RevenueCat.

Technical, usage and measurement information

Our servers and integrated providers process technical information when your device connects, including IP address and request information, app or installation identifiers, device/platform and operating-system details, app version, language, region, timestamps and diagnostic information. Analytics can record app lifecycle events, screen or feature use, subscription interactions, Debrief participation events, and advertisement impressions or clicks. These records may be linked to your account or an app/device identifier and can include information about the content, purchase or advertisement involved.

Marketing measurement can associate an installation or purchase with an advertisement or campaign. The information involved depends on your platform, settings and permissions. An IP address or region setting can indicate an approximate area; this is different from access to a device’s precise GPS location.

Notifications and support

Notification services process delivery tokens, preferences and the information needed to send or update alerts. Supported live updates also use delivery information and related settings. If you contact support, we receive your contact information, message and attachments. In-app support links may prefill the device model, operating-system version, app version, locale and subscription level. Review the message before sending it. If you choose WhatsApp, email or a social platform, that provider also processes information under its own policy; a prefilled support link can pass information to that provider when opened.

Both iOS and Android use our shared service and analytics/subscription providers. Platform-specific permissions and features differ; the relevant sections below explain those differences.

3. How we use information

• Provide the Service: authenticate users, maintain accounts, save preferences, deliver requested race information and notifications, synchronise supported devices, and display community contributions.
• Manage purchases: validate transactions, restore purchases, provide the correct paid features, handle billing questions and detect purchase abuse.
• Maintain reliability and safety: investigate failures, diagnose problems, prevent fraud and misuse, moderate contributions and respond to reports.
• Understand use and improve features: measure feature engagement, app performance and purchase flows.
• Provide and measure advertising: display eligible placements and assess the effectiveness of advertising for Box Box and advertisements shown in the Service, subject to applicable requirements and choices.
• Support and communications: answer requests, communicate service or policy changes and handle privacy requests.
• Meet legal responsibilities: retain necessary records, respond to valid legal requests and establish or defend legal claims.

Information necessary to authenticate an account, validate a purchase or deliver a requested feature is needed for that function to work. Optional profile images, preferences and community contributions are your choice. Where the law requires, refusing optional processing will not remove access to unrelated functions.

4. Public profiles, reviews and moderation

Public Debrief contributions can be shown with your display name, user tag, profile image, membership status and relevant favourite-driver/team details. Review ratings, text, viewing mode, timestamps and vote totals can also be visible. People can copy or share public content, including through sharing features; we cannot remove independent copies simply by deleting a review from Box Box. A membership badge is not a statement that your identity has been independently verified.

Debrief uses automated moderation to help enforce community rules. Some checks run on supported Android devices, while others send submitted content to OpenAI for analysis. Posted reviews are also processed and stored by Box Box to provide the community feature. Local checks do not mean your submitted review remains only on your device. Automated systems can make mistakes. You can contact [email protected] to challenge a moderation result or raise a privacy concern. Any additional safeguards required for a decision with legal or similarly significant effects remain applicable.

Remove or edit your own contributions using the controls available in your app version, or ask us for assistance. Reporting a review may hide it from your feed while the report is considered; it does not necessarily remove the content from everyone’s view.

5. Service providers and other recipients

Personal information is not processed only on your device. We use infrastructure and specialist providers to operate the Service. They receive the information relevant to their functions. Providers processing information on our behalf are subject to appropriate contractual restrictions; some providers also act independently for their own platform, legal or security purposes. Their notices supplement this policy and do not replace our responsibility for our processing.

• Apple and Google: supported sign-in, app distribution, store billing, platform features and notification delivery. They receive the information needed for the services you use. See Apple’s privacy information and Google’s Privacy Policy.
• Google/Firebase: app analytics, crash diagnostics, messaging and remote configuration. Depending on the service, this includes installation/app identifiers, technical and event data, diagnostics and notification routing information. See Firebase privacy information.
• RevenueCat: subscription verification and entitlement management, including store transaction information, app user IDs and the profile attributes described above. See RevenueCat privacy information.
• AppsFlyer: installation/campaign measurement and purchase validation/measurement, including technical and attribution information and purchase identifiers. See AppsFlyer’s Services Privacy Policy.
• TikTok for Business: app-event and marketing measurement through its integrated SDK. The information processed depends on the SDK configuration and relevant choices. See TikTok’s advertiser tools and data terms.
• OpenAI: server-side analysis of content for Debrief moderation. Processing and retention depend on the API and settings used; see OpenAI’s API data-controls information.
• Analytics and notification providers: app usage and technical information to measure feature use and deliver notifications.
• Hosting, storage, delivery and support providers: account records, uploaded content, network requests or correspondence as needed to host the Service, deliver assets and handle enquiries.

We also disclose information when you direct us to share it; when public contributions are displayed; to professional advisers under appropriate confidentiality; when disclosure is necessary and lawful to respond to legal process or protect people and the Service; or in connection with a genuine business sale or reorganisation, with appropriate safeguards and notice where required.

External news, video, podcast, social and advertiser destinations have their own practices. When you open a link or share content with another app, that service can receive connection information and anything you choose to send.

6. Analytics, advertising and website technologies

App and website technologies can use identifiers and storage to measure activity. Some app advertisements are selected using contextual factors, including your device region, platform, the placement and subscription status. Advertising measurement is separate from whether you see ads inside the app; an ad-free purchase does not itself establish that all analytics or attribution stops.

Where law requires prior consent for optional analytics, device storage/access or advertising measurement, we will only carry out that processing with your consent. You can withdraw consent without affecting processing that was lawful before withdrawal. Operating-system permissions, a privacy-policy link and acceptance of our terms do not substitute for any separate consent required by law.

Box Box does not currently provide an opt-out from its app analytics or advertising measurement. You can manage app permissions and applicable advertising/privacy controls in iOS or Android settings. These controls do not necessarily stop every analytics event, erase existing records or send an opt-out request to all providers. You may still contact us to exercise applicable privacy rights. Sending an email request does not itself stop automatic collection on your device.

Necessary local storage supports sessions, cached content and preferences. Our website may use additional analytics or third-party features that process browser and interaction information; where we use them, we provide the applicable disclosures and choices. Blocking storage can affect functionality.

7. Permissions and local storage

• Camera and photos: supported profile tools let you take or select an image. The image you save as your profile is uploaded; this does not require uploading your entire photo library. You can change or remove the profile image through available controls.
• Notifications and live updates: delivery tokens and preferences enable alerts. Disabling visible notifications does not necessarily erase an existing token or stop every platform background message.
• Alarms: supported devices may request permission to schedule race-session alarms. On iOS, alarm records are stored locally and managed through the operating system.
• Widgets and watch: the app shares the preferences and access status needed by supported widgets or companion devices. Content displayed on a lock screen or watch may be visible to other people who can see that screen.
• System integrations: supported search, shortcuts and image-creation tools process information through the operating-system feature you choose. If you save a generated image as a profile picture, the saved image becomes part of your uploaded profile.

Device storage can hold sign-in/session information, cached race content, preferences, images and identifiers. Removing the app can remove local data subject to operating-system backup and restore behaviour, but it does not by itself delete server-side records or cancel a subscription. The permissions shown by your device describe those requested by your particular app version.

8. Retention and security

We delete your user data from our account systems when you delete your account using the in-app Delete Account option. Records held independently by app stores, records held by service providers and backup copies may not be removed immediately; they are handled as described below. While information is held, retention is limited by its purpose and applicable legal requirements:

• Account and preferences: the period needed to provide your account and requested features, followed by necessary closure/deletion handling.
• Public content: while it is published, followed by any limited retention needed for valid reports, disputes, legal obligations or technical backup deletion.
• Purchase records: as needed to honour subscription or lifetime access, restore purchases, resolve billing disputes and meet applicable accounting or legal duties.
• Analytics and diagnostics: the configured period needed for measurement or troubleshooting, followed by deletion or effective anonymisation.
• Support, safety and legal records: the time needed to resolve the matter and any applicable limitation, preservation or statutory period.
• Backups: the documented rotation period, with retained copies restricted from ordinary use and deletion reapplied if a backup is restored.

We use security measures appropriate to the information and risks involved. The app uses encrypted connections to communicate with our service. No system is completely secure. Keep your device and sign-in credentials secure and tell us promptly if you suspect unauthorised account access. This policy does not limit our duties to secure information or provide legally required breach notifications.

9. International processing

Box Box is operated from India. Our backend is hosted in European and North American regions, and our providers have international operations. Hosting regions do not necessarily determine every location where provider processing, support or access takes place. Your information may be processed outside your country, where privacy laws can differ. For transfers subject to European or other transfer restrictions, we rely on a valid transfer mechanism, such as an applicable adequacy decision or appropriate contractual safeguards, together with any required supplementary protections.

You may contact us to ask where your information is processed and to request information about, or a copy of, applicable safeguards, subject to lawful redactions.

10. Delete your account or request deletion

In the iOS app: go to Settings → Delete Account and confirm. On Android, use the Delete Account option in the app; its location may differ by version. You can also request deletion without the app by emailing [email protected] with the subject “Box Box account deletion”. Include your account email or user tag so we can find the account. This route is also available if you cannot sign in or have already uninstalled the app.

We may need proportionate verification to prevent someone else deleting your account. For guest use or a private relay email, provide the identifiers you have and we will explain what is needed. Never send a password or full payment details.

A verified request covers your account and associated personal information, subject to lawful exceptions described in this policy. If information must be retained, we will explain the reason and applicable period or criteria, restrict its use accordingly and delete it when no longer needed. Our deletion process covers public content, backups and records held by our service providers. Information independently held by a store or another controller is subject to that controller’s responsibilities.

Account deletion does not cancel Apple App Store or Google Play subscriptions. Cancel renewal through the purchasing store separately. You can request removal of a profile image or contribution, or exercise other data rights, without necessarily closing your entire account.

11. Your choices and privacy rights

Depending on the law that applies, you may request access to your personal information, correction, deletion, a portable copy, restriction of processing, or information about its use and recipients. You may also have the right to object to certain processing, withdraw consent, opt out of sale/sharing or targeted advertising, limit certain sensitive-information uses, and challenge certain automated decisions. These rights have conditions and exceptions.

Email [email protected] with your request. We may ask for information reasonably necessary to verify your identity or an authorised agent’s authority. We will respond within the applicable legal deadline, explain a lawful refusal or extension, and tell you about any applicable appeal route. You will not be unlawfully discriminated against for exercising privacy rights.

Where a US state privacy law applies to our processing, the rights it provides remain available, including applicable advertising opt-outs and an appeal of a refused request. Send an appeal to the same contact with the subject “Privacy request appeal”. Where required, we honour recognised browser opt-out signals; a device advertising setting is not automatically equivalent to such a signal.

You may complain to the relevant privacy regulator. Contacting us first can help resolve a problem but is not a prerequisite where the law allows you to go directly to the regulator. Mandatory local protections take priority over anything inconsistent in this policy.

12. Additional European information

For processing subject to the EU/EEA GDPR or UK GDPR, we rely on the following lawful bases. Processing that requires consent does not begin until you have given it.

• Contract: information objectively necessary to provide the account, requested features, public contributions, purchase access and related support.
• Legitimate interests: proportionate service security, abuse prevention, complaint handling and defence of claims, balanced against your rights. This does not override separate consent requirements for device access, tracking or other regulated processing.
• Consent: optional analytics, advertising technologies and marketing where required. You can withdraw it; doing so does not affect earlier lawful processing.
• Legal obligation: records and disclosures required by an applicable EU/Member State or UK legal duty. Duties arising solely under another country’s law require a separately valid basis for GDPR purposes.

You can object to processing based on legitimate interests on grounds relating to your situation, and object to direct marketing at any time. Access, correction, erasure, restriction and portability rights apply as provided by law. We normally respond to GDPR rights requests within one month; if a permitted extension is needed, we will notify you within that month and explain why. You can complain to the supervisory authority in the EU/EEA country where you live or work, or where an alleged infringement occurred, or to the UK Information Commissioner where applicable.

Where Article 22 applies to a solely automated decision with legal or similarly significant effects, the applicable protections include the right to challenge it and obtain required human intervention. Section 4 explains how automated moderation works and how to challenge a moderation result.

13. Changes to this policy

We will update this policy when our practices or legal requirements change and show the effective date at the top. We will provide appropriate notice of material changes, such as in the app or by email, and obtain fresh consent where required before starting a new consent-based use. Posting a revised policy does not retrospectively authorise undisclosed processing.

For privacy questions, contact [email protected]. For rules governing use and purchases, see our Terms of Use.