Courtesy translation. The binding version is the Portuguese original (Política de Privacidade); if the two differ, the Portuguese version prevails.
This policy explains what data Boardrift uses, why, and how you control each item. It applies to the game, on PC and mobile, to the boardrift.com.br website, including its English version, and to the news sign-up on the Maffra Entertainment website. We follow Brazil’s General Data Protection Law (LGPD, Law 13,709/2018), the Brazilian Internet Civil Framework (Marco Civil da Internet, Law 12,965/2014) and the Digital Statute of Children and Adolescents (Law 15,211/2025).
1. Who is responsible
MAFFRA ENTERTAINMENT LTDA (CNPJ 69.676.776/0001-22), headquartered in Goiânia, Goiás, Brazil, is the data controller. The data protection officer (DPO) is José Borges Guimarães Maffra, reachable at [email protected].
2. What data we use
Boardrift is online and requires an account. We process:
- Account: email, password (stored only as a cryptographic hash; we cannot see it), account identifier, the age range you provided (13 to 15 or 16 and older), and the date and version of the Terms and of this Policy you accepted.
- Profile and progress: nickname, level, XP, coins, gems, carrots, items, pets, records, missions, leaderboard, leagues, seasons, the clan you belong to and, for holders of the Legend Founder Pack, the name chosen for the credits.
- Purchases: product, amount, date, store and payment code, and the coin and gem history. On PC and on the website, you enter your email and payment details on the RevenueCat page; we only receive the confirmation, never the card details.
- Invites: your invite code, who invited whom, and a device code of whoever used the invite. This code is a cryptographic digest (SHA-256 hash) of the device identifier, never the identifier itself, and is used only to pay the invite reward once per device.
- Ads, on mobile only and only when you choose to watch one: the device’s advertising ID, technical device data, the IP address and interactions with ads, processed by Google AdMob. Boardrift’s ads are never personalized, for anyone. You can reset or limit the advertising ID in the device settings. There are no ads on PC.
- Session and device: session access tokens, game version and the technical device data needed for the game to work.
- Security and access: records of each run sent to the server (distance, time, coins, tricks), runs flagged as suspicious for review, and access logs (IP address, date and time), also used to limit attempts and block abuse.
- Chat: the preset phrases sent, reactions, reports, blocks and moderation actions. Since the chat only has preset phrases, it does not receive text written by the player.
- Websites: your choices in the cookie notice and, only if you allow it, visit statistics.
- Email news, if you sign up on the Maffra Entertainment website: only the email, the language, the record of your consent and the sign-up date.
We do not ask for your name, phone number, address, photos or location, and we do not sell anyone’s data. The RevenueCat payment page may ask for the details the payment requires.
3. What we use it for
- To create and maintain the account and save progress on the server.
- To send account emails, such as sign-up confirmation and password reset, from [email protected].
- To process and restore purchases, keep the coin and gem history and meet tax obligations.
- To pay invite rewards once per device.
- To show on mobile the ads you choose to watch and deliver their reward.
- To keep the game fair: check runs, detect cheating and review suspicious accounts.
- To protect the service against abuse and attacks (attempt limits per IP) and keep the access logs required by law.
- To moderate the chat, the leaderboard, nicknames, clan names and credit names.
- To handle support and privacy requests.
- To send news to those who signed up and, if you allow it, measure visits to the websites.
4. Legal bases
Performance of the contract with you (account, account emails, progress, purchases, invites, leaderboard), legitimate interest (security, fraud prevention, moderation and the ads on mobile, which are never personalized), compliance with a legal obligation (access logs, under the Marco Civil da Internet, and tax records of purchases) and consent (email news and website visit statistics), under arts. 7 and 14 of the LGPD. You can withdraw consent at any time.
5. Who we share it with
| Service | Purpose |
|---|---|
| Supabase (servers in São Paulo, Brazil) | account, database, progress, purchases, invites, leaderboard, clans and chat |
| Google Workspace (Google, United States) | sending account emails from [email protected] |
| RevenueCat (United States) | payments on PC and on the website (Founder Packs, Premium, Season Pass, Weekly Pack, Starter Pack and Sack of Gems) and verification of receipts for purchases made on phones |
| Google AdMob (Google, United States) | ads on mobile, only when you choose to watch; there are no ads on PC |
| Cloudflare | the boardrift.com.br and Maffra Entertainment websites, game and update downloads, protection against attacks, email news list and, only if you allow it, visit statistics (Cloudflare Web Analytics) |
| Apple / Google | purchases in the mobile versions |
These providers process data only to deliver the service, under contractual safeguards. For ads, Google also follows its own privacy policy. When data is processed outside Brazil, the transfer follows art. 33 of the LGPD.
6. Children and teenagers
Boardrift’s age rating is 13 and older, and we do not create accounts for anyone younger: when you create the account, in the game or on the website, you confirm that you are 13 or older. The age range provided on the account (13 to 15 or 16 and older) is used to apply protections:
- Players under 16 do not announce achievements in the chat.
- No player receives personalized ads.
- Purchases by players under 18 depend on the authorization of their parents or guardians.
Everyone’s chat uses only preset phrases, with no private messages. Parents or guardians can request access to the data or its deletion at [email protected]. If we learn that an account belongs to someone under 13, it will be deleted.
7. How long we keep it
| Data | Period |
|---|---|
| Account and progress (email, nickname, balances, items, pets, runs, invites and chat) | while the account exists; on a deletion request, the account is closed immediately and the data is erased within 30 days |
| Server backups | erased within 90 days |
| Access logs (IP address, date and time) | 6 months, as required by the Marco Civil da Internet (art. 15) |
| Purchase records (product, amount, date and payment code) | 5 years, not linked to your profile, for tax and consumer protection obligations |
| Email news | until you leave the list |
| Leaderboard, statistics and moderation records | after deletion, only in anonymous form |
IP attempt-limit records are erased within a few days.
8. Security
Connections are encrypted (HTTPS), each player can only read their own data on the server, balances are only changed by the server and passwords are not stored in plain text. If an incident occurs that may cause relevant risk, we will notify those affected and the ANPD.
9. Your rights
- Access and download your data: at boardrift.com.br/conta → Account and privacy → Download my data.
- Delete the account: in the game (Settings → Account → Delete account) or at boardrift.com.br/conta. The account is closed immediately, and the data is erased within 30 days (within 90 days in backups), except the records the law requires us to keep longer, for the periods in section 7.
- Correct your nickname and password at any time.
- Leave the news list: every news email will have a link to leave the list, and you can also ask to leave at any time by writing to [email protected].
- Request confirmation of processing, correction, portability, anonymization, blocking, information about sharing, withdrawal of consent and objection to processing based on legitimate interest (LGPD, art. 18), and review of a decision made solely by automated means, such as a run rejected by the server (LGPD, art. 20), through [email protected]. We reply within 15 days.
- File a complaint with Brazil’s National Data Protection Authority (ANPD), at gov.br/anpd.
10. Cookies on the websites
The boardrift.com.br website, including its English version, and the Maffra Entertainment website only use essential storage (such as the account session and your choices). Visit statistics (Cloudflare Web Analytics, which uses no cookies and builds no profile of you) are only turned on if you allow them in the cookie notice. You can change your choice at any time in the footer of each website.
11. Changes to this policy
Important changes will be announced in the game and on the website before they take effect, and the game will ask for a new acceptance.
Contact
Questions, requests about your data or reports: