FullBoosts
Legal

Privacy Policy

Last updated October 2026

Fullboosts LLC ("FullBoosts", "we", "us") is the controller of the personal data described here. This Policy explains what we collect, why, with whom we share it and what rights you have when you use fullboosts.com and the FullBoosts app for iOS and Android (the "Platform"). Privacy questions: admin@fullboosts.com.

1. Information we collect

  1. 1.1.What you give us
    1. Account: email address, username, password (stored only as a hash), avatar, country and language, and whether you enabled two-factor authentication. With Google, Discord or Apple sign-in we receive the name and email the provider shares.
    2. Orders: the game, options and price you chose, character and region details, and for piloted services your game login, entered only through the encrypted credentials form (see Section 5).
    3. Payments: billing name and email, the last four digits and brand of your card, and the payment status. Card numbers are entered on Stripe's page and never reach us.
    4. Communications: order chat messages, support tickets, reviews, reports you file about a message, and emails you send us.
    5. Wallet, coupons and referrals: wallet transactions, coupons you redeem, cashback and referral rewards.
    6. Booster applications: if you apply to become a Booster we collect the information in the application, your payout details and, where required by our fraud or tax obligations, identity documents and tax identification.
  2. 1.2.What we collect automatically
    1. Device and log data: IP address, browser or app version, operating system, device model, request identifiers, timestamps and the pages or screens you used, recorded for security, fraud prevention and debugging.
    2. Install identifier (app): a random identifier created on first launch to tell your devices apart for sessions and push notifications. It is not an advertising identifier.
    3. Push token (app, only if you allow notifications): a device token issued by Apple or Google through the Expo push service.
    4. Usage analytics: on the website, only if you allow analytics cookies: pages viewed, searches, offers viewed and added to cart, checkout steps and completed purchases (Google Analytics 4), and masked recordings of how pages are used - clicks, scrolling and page layout, with typed text and account details hidden (Microsoft Clarity). In the app, usage events are sent to PostHog only after you turn on "Share usage analytics" in Settings.
    5. Crash reports: if the app or site crashes, Sentry receives the technical details (device, OS, app version, code path, your user ID) without request bodies, cookies or credentials.
    6. Cookies: see the Cookie Policy. We use essential cookies, and analytics cookies only with your consent; there are no advertising cookies.
  3. 1.3.What we receive from others
    1. Stripe: payment confirmation, risk signals and dispute information.
    2. Sign-in providers (Google, Discord, Apple): name, email and provider ID.
    3. Booster payout and verification providers, where used.

2. How we use it

  1. To run your account, process orders, match you with a Booster and let you communicate.
  2. To collect payment, apply coupons and cashback, run the wallet and pay Boosters.
  3. To keep the Platform secure and prevent fraud, chargeback abuse, duplicate accounts and ban evasion, including automated risk scoring of orders and IP analysis.
  4. To handle disputes, reports and support requests.
  5. To send transactional emails and push notifications about your orders, messages, security events and account, and, only with your consent, marketing or news.
  6. To understand how the Platform is used and improve it (website and app analytics, only with your consent).
  7. To comply with tax, accounting and legal obligations and to enforce our Terms.

3. Legal bases (EEA and UK users)

  1. Contract (account, orders, payments, chat), legitimate interests (security, fraud prevention, dispute handling, service improvement), consent (website analytics cookies, app analytics, marketing emails, push notifications), and legal obligation (tax and accounting records, responding to lawful requests). You can withdraw consent at any time in Settings, through "Cookie settings" at the bottom of every page, or by contacting us.

4. Who we share it with

  1. We share personal data only with providers who process it for us under contract, and only for the purpose stated:
  2. Stripe — payment processing and fraud prevention.
  3. Vercel — hosting of the website and API.
  4. Railway — hosting of the database, cache and background workers.
  5. Amazon Web Services (S3, CloudFront) — storage and delivery of uploaded images and attachments.
  6. Resend — transactional email.
  7. Expo push service, Apple Push Notification service, Google Firebase Cloud Messaging — delivery of push notifications.
  8. PostHog — app usage analytics, only for users who opt in.
  9. Google (Google Analytics 4) — website usage analytics, only with your analytics consent. Advertising features and Google signals are switched off; we send no name, email or other contact details.
  10. Microsoft (Clarity) — website usage analytics and masked session recordings, only with your analytics consent.
  11. Sentry — error and crash monitoring.
  12. Google, Discord, Apple — sign-in, under their own terms.
  13. 4.12.We also share:
    1. With your Booster: the order details needed to perform the Service, your username and, for piloted orders, the encrypted credentials while the order is in progress. Boosters never see your email, payment details or wallet.
    2. With sellers on the website marketplaces: the character, server and delivery details for a currency or account purchase.
    3. When required by law or to protect the rights, property or safety of FullBoosts, our users or the public.
    4. In a business transfer: if FullBoosts is sold or merged, data transfers to the successor under this Policy, and we notify you.
  14. 4.13.We do not sell personal data and we do not share it with advertising networks.

5. Game credentials, chat and attachments

  1. Game credentials are encrypted with a key held by FullBoosts and can be decrypted only by you and the assigned Booster while the order is open. Support and admin staff have no way to view them. You can replace them until the order closes. They are erased automatically the moment the order completes, is cancelled, is refunded or a dispute is opened; disputes are handled on chat history, progress records and screenshots, never on credentials. If a dispute is resolved and the Service resumes, you enter fresh credentials.
  2. Order chat is encrypted at rest and readable only by the order participants and by support staff reviewing a report or a dispute.
  3. Screenshots and attachments are visible only to the order participants and support.

6. Security

  1. TLS for every connection; password hashing; encryption at rest for chat and credentials; row-level access controls in our database; session revocation and optional two-factor authentication; rate limiting and audit logging of sensitive actions; PCI-compliant payment processing by Stripe. No system is perfectly secure; if a breach is likely to put your rights at risk we will notify you and, where required, the supervisory authority without undue delay.

7. How long we keep data

  1. Account and profile: while the account is active. On deletion the profile is anonymized at once and the remaining record is purged after 30 days.
  2. Orders, payments, wallet and payout records: 7 years, for accounting, tax and fraud-prevention obligations; the records are kept in anonymized form after account deletion.
  3. Order chat and attachments: 12 months after the order closes, for disputes and chargebacks.
  4. Game credentials: until the order completes, is cancelled, is refunded or a dispute is opened; erased at once at that point and never kept for dispute handling.
  5. Support tickets, reports and disputes: 3 years after closure.
  6. Security and server logs: up to 90 days.
  7. Push tokens and sessions: until logout, deletion or expiry.
  8. App analytics and crash data: up to 12 months at PostHog and Sentry.
  9. Website analytics: up to 14 months in Google Analytics; up to 13 months in Microsoft Clarity, with session recordings kept 30 days.

8. Your rights

  1. 8.1.Everyone. Access, correction, deletion, portability and marketing opt-out. You can edit your profile in Settings, delete your account from Security settings (website) or Account settings (app) and unsubscribe from any marketing email. Other requests: admin@fullboosts.com. We answer within 30 days and may need to verify your identity.
  2. 8.2.EEA and UK residents (GDPR). You may also restrict or object to processing based on legitimate interests, withdraw consent, and complain to your supervisory authority. Data is processed in the United States; transfers from the EEA and UK rely on the European Commission's Standard Contractual Clauses or another lawful mechanism.
  3. 8.3.California residents (CCPA/CPRA). You have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising, so there is no "Do Not Sell or Share" option to exercise. Requests: admin@fullboosts.com.

9. International transfers

  1. FullBoosts is based in the United States and our providers operate there and in other countries. By using the Platform you understand that your data is transferred to and processed in the United States, with the safeguards described in Section 8.2.

10. Children

  1. The Platform is for adults only. We do not knowingly collect data from anyone under 18. If you believe a minor has given us data, write to admin@fullboosts.com and we will delete it.

11. Do Not Track

  1. We do not respond to browser Do Not Track signals. Analytics cookies are only set after you allow them, and you can withdraw that choice at any time through "Cookie settings".

12. Account deletion

  1. You can delete your account in the app (Profile → Account settings → Delete account) or on the website (Dashboard → Security). Deletion signs out every device, removes push tokens, anonymizes the profile immediately and purges the remainder after 30 days. Deletion cannot be undone from inside the account; to cancel within the 30 days, contact admin@fullboosts.com from the email address that was on the account. Order and payment records we must keep by law are retained in anonymized form. Public page: <a href="https://fullboosts.com/account-deletion">fullboosts.com/account-deletion</a>.

13. Relationship with game publishers

  1. FullBoosts is not affiliated with, endorsed by, or sponsored by any game publisher. Game names are used for identification purposes only. We do not share your data with game publishers.

14. Changes

  1. We may update this Policy. Material changes are announced by email or a notice on the Platform before they take effect, and the "Last updated" date changes.

15. Contact

  1. Fullboosts LLC, 1111B South Governors Avenue, #50042, Dover, DE 19904, United States. Privacy and support: admin@fullboosts.com.