AllBop Privacy Policy
This policy addresses the notice requirements of Articles 8 and 9 of the Personal Data Protection Act and also takes into account disclosure requirements for Google Play, App Store, and Google advertising services.
Version 2026-11-03 | Effective date 2026-11-03 | Service provider: AllBop Development Team | Website: https://allbop.com | Contact: custom@allbop.com
1. Data collector and scope
This English translation is provided for convenience. If it differs from the Traditional Chinese version, the Traditional Chinese version prevails.
This policy applies to the AllBop website allbop.com, the AllBop mobile App (Android/iOS, com.allbop.app), and related games, events, big screens, and payment services (together, “the Service”).
- Personal data collector: AllBop Development Team
- Website: https://allbop.com
- Privacy contact email: custom@allbop.com
2. Data we collect and its sources
2.1 Host accounts
- Email address, password hash (we do not store passwords in plain text), sign-in method (email, Google, or Apple), and identifiers provided through that sign-in method.
- Display name and data you choose to provide.
- Sign-in sessions, sign-in verification records, and necessary security records.
2.2 Players
- Players do not need to register or provide an email address, phone number, or real name to join an event. We only obtain the nickname you enter, the avatar you select, and an installation identifier randomly generated by the App or browser (the server stores only its hash).
- Join time, answers, scores, standings, prize draws, and prize results.
- Photos you take or upload in Color Scout. After receiving a photo, the server recompresses it into an image for display and a thumbnail, removes metadata such as EXIF and the location where it was taken, and does not retain the original file (see Section 6 for storage).
2.3 Events and content
- Events, questions, images, logos, prize names, and settings created by Hosts.
- Event logs needed for real-time synchronization, reconnection, result verification, and cheating prevention.
2.4 Transactions and Credits
- Order number, items purchased, payment platform, amount, currency, transaction time, and refund or dispute status.
- Records of Credits obtained, reserved, used, returned, and reclaimed.
- We do not obtain or store full credit card numbers or payment verification data. The payment platform handles this data.
2.5 Devices, connections, and security
- Platform used (Android, iOS, or website), App version, and installation identifier, for version compatibility checks and reconnection.
- Connection records: Our server access logs record IP addresses, User-Agent strings sent by browsers or devices (which may include operating system and browser versions), and request times for security, abuse prevention, and debugging. IP addresses are also hashed to limit abnormal requests and are not written to the database.
- Error and performance logs are generated by our own servers; the Service does not use third-party analytics or crash reporting services.
2.6 Ads
Google ads appear on Player screens in free events. Google may process advertising identifiers, cookies, IP addresses, approximate location, and ad interaction data. See the Cookies and Ads policy for details. Because the Android App includes the Google ads SDK, it declares permission to access the advertising ID.
2.7 Data sources
In addition to data you provide directly or generate when using the Service, we obtain data from the following sources (Article 9 of the Personal Data Protection Act):
- The email address and account identifier provided by Google or Apple when you sign in with that platform;
- Transaction, refund, and dispute status provided by payment platforms (NewebPay, Google Play, and App Store).
3. Purposes of collection
| Purpose | Details | Specific purpose under the Personal Data Protection Act |
|---|---|---|
| Provide the Service | Account creation, sign-in, event creation and hosting, Players joining events, real-time games, results, and reports | 069 Contract, contract-like or other legal relation matters; 135 Information (communication) services |
| Transactions and Credits | Complete purchases, add Credits to accounts, process refunds and chargebacks, and handle accounting | 148 Internet shopping and other electronic commerce services; 129 Accounting and related services; 069 |
| Support and disputes | Answer questions, verify event results, and handle reports and disputes | 090 Consumer, customer management and service |
| Security and abuse prevention | Prevent cheating, fraud, unauthorized access, and attacks | 136 Information (communication) and database management |
| Maintenance and improvement | Debugging, performance and reliability analysis (in principle, using de-identified statistics) | 157 Investigation, statistics and research analysis |
| Ads | Show ads on Player screens in free events and measure performance | 040 Marketing |
4. Period, regions, recipients, and method of data use
4.1 Period
See Section 6.
4.2 Regions
- Database, file storage, and application hosting: Singapore.
- Website content delivery and domain providers may process connection data at nodes worldwide.
- Email delivery providers, Google, Apple, and payment platforms may process data in the countries where they are located, including the United States.
4.3 Recipients
We do not sell your personal data.
Service providers we engage to process data (they may process it only on our instructions and as needed to provide the Service):
| Recipient | Purpose |
|---|---|
| Cloud database and file storage providers | Database and file storage (logos and question images) |
| Cloud hosting providers | Application hosting |
| Email delivery providers | Send sign-in links |
| Website content delivery and domain providers | Public website pages, domains, and connection security |
Third parties that process data under their own privacy policies:
| Recipient | Purpose |
|---|---|
| Google LLC | Google sign-in, Google Play payments, AdMob/AdSense ads; the App uses Google ML Kit to scan QR codes; images are processed on the device, and Google may obtain usage statistics |
| Apple Inc. | Apple sign-in, App Store payments |
| NewebPay (藍新科技股份有限公司) | Website payments (we provide only the order number, items, and amount; NewebPay handles the data you enter on its payment page) |
Other participants in the same event can see your nickname, avatar, answer results, Color Scout photos, standings, and prize results, and this information is also shown on the big screen. Hosts can see event reports, and Hosts on paid plans can export reports. Hosts are responsible for keeping exported files. We may also provide necessary data to competent authorities or courts when required by law or to protect the life, physical safety, or property of users and third parties.
4.4 Method
Data is processed automatically by electronic means and accessed by authorized personnel within reasonable limits.
5. Effect of not providing data
You are free to choose whether to provide data. If you do not provide data needed to create an account, sign in, pay, or join an event, we cannot provide the corresponding features. Refusing personalized ads does not affect game features.
6. Retention periods
| Data | Retention period |
|---|---|
| Host accounts | For the life of the account; after a deletion request (termination of the contract), there is a 7-day withdrawal period, after which the account is deleted (see the Data Deletion policy) |
| Free event data (including Player nicknames, answers, and event records) | 1 day after the event closes |
| Paid event data | 7 days after the event closes |
| Logos and question images in events | Deleted with event data and cleared from storage by a background process; images a Host keeps in an event template are retained until the template is deleted |
| Color Scout photos | Stored only in a temporary server memory buffer, not written to the database or backups; deleted when the next round starts, the room closes, or within 1 hour after that round’s results are announced, whichever comes first |
| Sign-in sessions | Up to 30 days |
| Sign-in verification records | 1 day after use or expiration |
| Apple account notification receipt records | 90 days |
| Transaction, Credit ledger, and payment records (including Credit settlement and participant counts for each event) | 5 years after annual settlement; 10 years for accounting books (Article 38 of the Business Entity Accounting Act) |
| Server access logs and information security audit logs | 180 days |
| Backups | Overwritten according to the rotation cycle, up to 30 days |
When the period expires or the purpose no longer exists, we delete or de-identify the data. We restrict the use of and access to the minimum data required by law to be retained.
7. Security measures
We use reasonable technical and administrative measures to protect your data, including:
- Encryption in transit (HTTPS);
- Hashed storage of passwords, session tokens, and installation identifiers;
- Permission controls and access logs;
- Protection of keys and passwords;
- No logging of sensitive information such as sign-in tokens;
- Signature verification for payment notifications;
- Backup controls and vulnerability patching.
No system can guarantee absolute security. If personal data is stolen, leaked, altered, or otherwise compromised, we will investigate and then notify you appropriately, and report to the competent authority as required by law.
8. Your rights
Under Article 3 of the Personal Data Protection Act, you may:
1. Inquire about or request access to your data;
2. Request a copy;
3. Request additions or corrections;
4. Request that we stop collecting, processing, or using it;
5. Request deletion.
These rights cannot be waived in advance or limited by special agreement. Email custom@allbop.com from your registered account email address and explain your request; Players should include their room code and nickname. To prevent impersonation, we will verify your identity first and respond within the statutory period: 15 days for inquiries, access, or copies, and 30 days for other requests. When necessary, we may extend the period and notify you of the reason in writing. We may charge necessary costs for providing copies. If we may refuse under the law, we will explain why.
You may also complain to the competent personal data protection authority or the competent authority for the Service’s industry.
9. Account deletion
You can request account deletion in the App or on the website, or by email. See the Data Deletion policy (allbop.com/data-deletion).
10. Minors
The Service is not primarily intended for children. Hosts must be at least 18 years old; anyone under 18 must have a legal representative’s consent to use the Service and buy Credits. Players under 13 must be accompanied by a parent (legal representative) and have that parent’s consent to join an event. Players do not need to provide real names to join an event. Do not include identifiable information about children in nicknames or photos. If we discover that we have collected a child’s personal data without a legal representative’s consent, we will delete it as soon as possible.
11. Users overseas
- European Economic Area, United Kingdom, and Switzerland: Our legal bases for processing data are providing the Service and transactions (performance of a contract), accounting and tax (legal obligations), security, abuse prevention, and service improvement (legitimate interests), and personalized ads (your consent). In addition to the rights in Section 8, you may request data portability and object to processing based on legitimate interests. You may also withdraw consent at any time; withdrawal does not affect the lawfulness of processing before withdrawal. You may complain to the data protection authority where you live. Cross-border transfers rely on standard contractual clauses provided by service providers or equivalent safeguards.
- Other regions: We handle your rights requests under applicable local law. You can limit personalized ads at any time through Google’s ad settings or the App’s privacy options.
12. Policy changes
We may update this policy for service, legal, or security needs and publish the new version and effective date on this page. If a change materially affects you, we will notify you by email or in the App.
13. Contact us
- Privacy questions or rights requests: custom@allbop.com
- Personal data collector: AllBop Development Team