Legal

TurfWar is owned and operated by AskBuc Inc. (www.askbuc.com). For privacy inquiries: [email protected].

Account Information. When you sign in via Google or Apple OAuth, we receive your name, email address, and a unique identifier. We do not store your OAuth password.

Precise GPS Location Data. GPS is only active during an explicitly started run session. We collect continuous GPS coordinates for the duration of that run only. GPS tracking is never active in the background.

Run and Activity Data. Run history including start/end time, distance, duration, route path, street segments claimed or stolen, and XP earned.

Territory Data. Street segments you claim are stored with your user ID, a geographic segment key, and a timestamp. This data is visible to other users on the shared map.

Device and Technical Data. Browser type, OS, IP address, and session cookies for authentication and security. No third-party analytics trackers are used.

We use your data to: operate the territory-claiming game mechanics; authenticate your account; calculate leaderboards, XP, levels, and streaks; send push notifications you have opted into; detect and prevent fraud or cheating; comply with legal obligations; and improve the service based on aggregate, anonymised usage patterns. We do not sell your data or use it for advertising profiling.

Our legal bases are: contract performance (providing the game); legitimate interests (fraud prevention, security); consent (GPS collection and push notifications); and legal obligation where required by law. You may withdraw consent for GPS collection at any time via device settings.

GPS is only active during an explicitly started run. Raw GPS coordinates are stored server-side to enable route replay and segment calculation. Your route is visible to you in your run history; a simplified version (claimed street segments) is visible to other users. We do not share your precise GPS coordinates with any third party and do not use GPS data to infer your home address or workplace.

We share data only with: authentication providers (Google, Apple via Manus OAuth); cloud infrastructure providers acting as data processors; and law enforcement when legally required. We do not sell, rent, or trade your personal data.

Account information is retained until you request deletion. Run history and GPS route data is retained indefinitely unless you request deletion. Server logs are retained for up to 90 days. Deleted account data is purged within 30 days.

You may access, correct, delete, or export your personal data. California residents (CCPA/CPRA) have the right to know, delete, and opt out of sale (we do not sell data). EEA/UK residents have full GDPR rights. Email [email protected] to exercise any right.

TurfWar is not directed at children under 13 (or 16 in the EEA). We do not knowingly collect data from children. Contact us at [email protected] if you believe a child has provided data.

All data is transmitted over HTTPS/TLS. Authentication is handled entirely by OAuth providers. Session tokens are cryptographically signed and HTTP-only. In the event of a data breach, we will notify affected users and relevant authorities as required by law.

AskBuc Inc. · www.askbuc.com · [email protected]