Privacy notice

This notice explains how BossTally handles personal information collected through the website at bosstally.com. It is written to sit with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

1. Who is responsible

BossTally is an independent editorial project publishing a register of mobile games for Android. The editor is responsible for the site and for decisions about the personal information described here. Questions and requests go to editor@bosstally.com.

2. What is collected

• Server and log data. Your IP address, the user-agent string sent by your browser, the page requested, the date and time, and the referring address. These are written by the hosting infrastructure for every visit.
• Cookies and local storage. A record of your choice in the cookie notice, and the entries described in the cookie notice.
• Subscription form data. The name you type (optional) and the e-mail address you type (required), together with the fact and time of your consent.
• Push notification identifiers. If you allow browser notifications, your browser and the push service generate a subscription identifier. It is held by OneSignal on our behalf, along with basic technical attributes such as browser type, language and country-level location derived from the connection.
• Aggregate measurement. Counts of page views and of clicks on outbound links, used in aggregate form to see which entries readers open.

No phone number is requested anywhere on this site, and there is no field for one in the subscription form.

3. Why it is collected, and on what basis

• To run and secure the site. Log data is necessary for the functions of publishing the register, keeping the site available and investigating abuse.
• To send the register update. Your e-mail address and push identifier are used only to tell you that a new edition has been published. The basis is your consent, given by ticking the consent box or by allowing the browser notification prompt.
• To measure advertising placements. Aggregate click and view counts let advertising partners confirm that a placement was shown. This does not require your name or address.

4. How long it is kept

• Server logs: up to 12 months, then deleted or aggregated.
• Form data (name, e-mail, consent record): until you cancel your consent or ask for removal, and in any case no longer than 24 months after the last edition you were sent.
• Push identifiers: until you unsubscribe in the browser, block notifications, or ask for removal.
• Consent choice for cookies: stored in your own browser until you clear it.

5. Who else handles it

Personal information is not handed to anyone in exchange for anything. It is disclosed only to the service providers needed to run the site:

• Hosting provider. Stores the site files and writes the server logs described above.
• OneSignal. Acts as our processor for browser push notifications and for the e-mail addresses submitted through the subscription form. OneSignal stores the subscription record and delivers the messages we send.
• Advertising partners. Receive aggregate counts relating to placements. Where a partner sets its own cookie, that is described in the cookie notice.

6. Disclosure outside Australia

OneSignal and the hosting infrastructure operate servers outside Australia, including in the United States and the European Union. By subscribing you accept that your e-mail address and push identifier will be handled on those servers. We take reasonable steps to use providers that apply comparable protections, but overseas recipients may be subject to laws that differ from Australian law.

7. Cookies

The categories in use, their purposes and their lifetimes are listed in the cookie notice, together with the ways to refuse or clear them.

8. Your rights

Under the Australian Privacy Principles you may:

• ask what personal information about you is held, and obtain access to it (APP 12);
• ask for it to be corrected if it is inaccurate, out of date or incomplete (APP 13);
• cancel your consent for the register update at any time — through the unsubscribe link, through your browser's notification settings, or by writing to us;
• ask for your e-mail address and push record to be deleted;
• deal with us anonymously or under a pseudonym where that is practicable, which for reading the register it always is.

Write to editor@bosstally.com and we will answer within 30 days. If you are not satisfied with the answer, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. Security

The site is served over HTTPS. Access to the subscription list is limited to the editor and protected by two-factor authentication at the provider. No method of transmission or storage is perfectly secure, so we keep the collected set as small as the service allows — which is why the form asks for two fields and nothing more.

10. Children

The register is written for adults. The subscription form is not directed at children, and we do not knowingly collect personal information from a person under 16. If you believe a child has subscribed, write to us and the record will be removed.

11. Changes to this notice

If the way personal information is handled changes, this page is updated and the date at the top changes with it. Material changes affecting subscribers are announced in the register update itself.

12. Contact

Editorial and privacy enquiries: editor@bosstally.com.