Privacy Policy

Controller: Dragonrise Technologies Pte. Ltd., a company incorporated in Singapore, UEN 202648606G, registered office: 133 New Bridge Road, #23-09 Chinatown Point, Singapore 059413 ("we", "us" or "our") Products: the BossDrama apps for iOS and Android, and the BossDrama website at www.bossdrama.com (together, "BossDrama") Privacy contact email: [email protected] Customer support email: [email protected] Telephone: +65 9661 2066 Website: https://www.bossdrama.com Last updated / Effective date: November 1, 2026

1. Who Is Responsible for Your Information

Dragonrise Technologies Pte. Ltd. determines the purposes and means of processing personal information in BossDrama and is the data controller where the GDPR applies. Third parties such as Apple, Google, Meta and Cloudflare are independently responsible for their own processing activities; see Section 5.

2. Information We Process

2.1 Account information

• Guest account: a random credential generated when you first open the app (stored on your device; our servers store only its hash), your account ID and the account creation time.
• Third-party sign-in: Sign in with Apple (iOS), Google sign-in (iOS and Android, where available) and Facebook Login (iOS, where available). We receive the user identifier and authentication result returned by the provider, and the name and email address that you allow the provider to share (Apple may provide a private relay address, and you can choose not to share your email address with Facebook). For Facebook Login, the user identifier is specific to BossDrama and is not your Facebook profile ID. We use the name only as your initial nickname, which you can change. Except for the Sign in with Apple refresh token, which we keep only so that we can revoke your authorization when you delete your account, we do not store the access or identity tokens issued by the provider, and we do not receive your Facebook friends list, posts or other Facebook data.
• Preferences: interface language, time zone, Favorite Genres, and notification and auto-unlock settings.
• Country or region, approximate location (state or province and city) and network provider: determined by Cloudflare and IPinfo from your network address. This is not precise location, and we do not use GPS or other device location.

2.2 Viewing and interaction records

• Watch history: titles, episodes, playback progress, viewing time, playback sessions and playback heartbeats.
• Interactions: favorites, likes, actors or creators you follow, reservations, downloads, shares (the title shared and the share channel you chose), and reports, including the reason and any description you write.
• Playback quality data: startup time, time taken at each stage, video resolution and network type (for example Wi-Fi or cellular), used to troubleshoot buffering and errors.

2.3 Purchases and transactions

• Apple App Store and Google Play transaction identifiers, original transaction identifiers, product, amount and currency, transaction time, and refund and renewal status.
• Coins and Reward Coins balances and each change to them, unlocked episodes, VIP membership validity period, first top-up bonus records, and check-in and task rewards.
• The country or region of the purchase, and the country of your App Store or Google Play account as reported by Apple or Google.
• We do not have access to your bank card number or payment password. Payments are processed by Apple or Google.

2.4 Device information and logs

• A device identifier generated by the BossDrama app (it is not the advertising identifier and is not shared with other apps), the platform (iOS or Android), device model, operating system version, app version, interface language and time zone.
• A one-way hash of the device identifier, used only to make sure the first top-up bonus is given once per device.
• If you allow notifications: a push notification token issued by Apple or Google, and a OneSignal subscription identifier linked to your account ID.
• Network (IP) address, request time and request ID, and error information.
• Sign-in records: the time, network address, approximate location and device of each sign-in (at most one record per device, network address and day).
• Security logs: request signature and anti-replay records, rate-limiting records, and ban records.

2.5 Customer support

• The text of in-app customer support conversations, content you provide by email, and records of how your request was handled. Please provide only the information needed to resolve your issue. We will never ask for your password or verification code.

2.6 Information we do not collect

• We do not request access to your camera, microphone, contacts, photos or precise location.
• We do not use the advertising identifier (IDFA on iOS or the advertising ID on Android), do not show ads, and do not track you across apps or websites owned by other companies. For this reason the iOS app does not show an App Tracking Transparency prompt.
• Our apps do not integrate any third-party analytics, crash reporting or advertising SDKs. The only third-party SDKs in our apps are OneSignal, used to send push notifications, and the Google Sign-In and Facebook Login SDKs, used only when you choose to sign in with them (see 4.1). Facebook Login on iOS uses Limited Login, which is designed not to be used for tracking.

2.7 Personalized recommendations

The For You feed and some lists are personalized. We use the app language you choose, how you interact with titles in your recent viewing (for example, whether you finish an episode or skip it within a few seconds), the titles you have already watched (so that we do not recommend them again) and the overall popularity of titles. In some regions we also use your Favorite Genres. We do not use this to build an advertising profile, and we do not use sensitive personal information for recommendations. You can change Favorite Genres at any time, and you can delete your watch history in the app.

3. Purposes and Legal Bases

• Purpose: Creating and maintaining your account, sign-in and cross-device recovery; Information used: 2.1, 2.4; Legal basis (where the GDPR applies): Performance of a contract
• Purpose: Playing content, remembering progress, downloads and providing purchased content; Information used: 2.1, 2.2; Legal basis (where the GDPR applies): Performance of a contract
• Purpose: Personalized recommendations; Information used: 2.1 preferences, 2.2 watch history; Legal basis (where the GDPR applies): Legitimate interests (showing you relevant titles); you can object as described in Section 8
• Purpose: Showing content available under regional licensing; Information used: Country or region; Legal basis (where the GDPR applies): Performance of a contract; legal obligation
• Purpose: Understanding in which countries and regions our users and paying users are, so that we can decide where to promote BossDrama; Information used: country or region and approximate location, 2.3, and the platform and device model in 2.4; Legal basis (where the GDPR applies): Legitimate interests (planning our marketing). We use this information only in aggregate statistics and do not use it to show you personalized ads
• Purpose: Sending push notifications you have allowed, such as reminders about titles you have reserved or follow, new releases and offers; Information used: account ID, push token and OneSignal subscription identifier, platform, app version, interface language and time zone; Legal basis (where the GDPR applies): Consent. You can turn notifications off at any time in Profile › Notification Settings or in your device settings
• Purpose: Delivering Coins, VIP membership and rewards; handling refunds and reconciliation; Information used: 2.3; Legal basis (where the GDPR applies): Performance of a contract; legal obligation (financial records)
• Purpose: Troubleshooting and improving playback quality; Information used: 2.2 playback quality data; 2.4; Legal basis (where the GDPR applies): Legitimate interests
• Purpose: Preventing fraud, reward abuse, replay attacks and misuse; Information used: 2.1, 2.3, 2.4; Legal basis (where the GDPR applies): Legitimate interests
• Purpose: Responding to customer support requests and reports; Information used: 2.5; 2.2 interactions; Legal basis (where the GDPR applies): Performance of a contract; legitimate interests
• Purpose: Complying with legal obligations and handling disputes; Information used: Relevant records; Legal basis (where the GDPR applies): Legal obligation; legitimate interests

We do not use this information for marketing, and we do not sell personal information. Before using information for a new purpose, we will update this Policy and, where required, obtain your consent.

4. Cookies, SDKs and Device Permissions

4.1 Apps. The BossDrama apps do not use cookies. The iOS app uses Apple system frameworks, the OneSignal SDK for push notifications, and the Google Sign-In SDK and Facebook Login SDK for signing in. The Google Sign-In and Facebook Login SDKs exchange information with Google or Meta only when you choose to sign in with them. We have turned off the Facebook SDK's automatic app event logging, advertising identifier collection and SKAdNetwork reporting, and we do not log app events to Meta. The Facebook SDK may still exchange technical information with Meta that it needs to work, such as configuration requests and reports about errors in the SDK. Because the iOS app does not ask for permission to track, iOS blocks the SDK from connecting to the domains that Meta declares for tracking. The Android app uses Google Play Billing for purchases, the OneSignal SDK and Firebase Cloud Messaging for push notifications, and AndroidX and other open-source libraries for playback and interface. The OneSignal SDK processes your account ID, push token, device model, operating system version, app version, interface language, time zone, network (IP) address, and whether notifications were delivered and opened. We have turned off its location sharing and in-app messaging features, and it does not use the advertising identifier. None of these components collect data for us or for third parties beyond what is needed to provide their function.

4.2 Website. The website at www.bossdrama.com provides information about BossDrama, download links and our legal documents. It has no sign-in and does not use cookies. If you choose a language, your browser's local storage remembers it ("bd_lang"). We use Cloudflare Web Analytics to count page visits. It does not use cookies or local storage and does not identify individual visitors; it processes the page visited, the referring page, browser and device type, country and page loading performance, and gives us only aggregate statistics. Legal basis (where the GDPR applies): Legitimate interests (understanding how the website is used and keeping it working well).

4.3 Device permissions. The apps ask for permission to send push notifications only after you choose to be reminded (for example, when you reserve or follow a title) or turn on notifications in Profile › Notification Settings, and never when the app first opens. You can refuse, or turn notifications off at any time in the app or in your device settings; the rest of BossDrama works the same. On Android 13 and later, the Android app may also ask for permission to show notifications so that it can display download progress; you can refuse, and downloads will still work. The apps do not request any other sensitive system permissions.

5. Who We Share Information With

5.1 Service providers that process information on our behalf

• Cloudflare, Inc.: network protection and acceleration, content delivery of videos and images, storage (R2) and website visit statistics (Cloudflare Web Analytics, see 4.2). Cloudflare processes network addresses and request records and determines your country or region. Its nodes are located around the world.
• Alibaba Cloud (Singapore) Private Limited: server hosting. Account, viewing and transaction data is stored in data centers in Singapore.
• IPinfo, Inc.: IP address geolocation. We send it only network addresses, without any account information, and it returns the approximate country, region, city and network provider. It is located in the United States.
• OneSignal, Inc.: push notification delivery. It processes the information described in 4.1 and is located in the United States. Notifications are delivered to your device through Apple Push Notification service or Google Firebase Cloud Messaging.
• Zoho Corporation: our email service ([email protected] and [email protected]). Zoho processes the emails you send us.

We require our service providers to process personal information only on our instructions and to protect it with a level of security and confidentiality at least equal to that described in this Policy.

5.2 Third parties that process information independently

• Apple Inc.: Sign in with Apple, App Store in-app purchases and subscriptions, and refunds.
• Google LLC: Google sign-in, Google Play purchases and subscriptions, and refunds.
• Meta Platforms, Inc. and Meta Platforms Ireland Limited: Facebook Login.

Apple, Google and Meta process your account and payment information under their own privacy policies. We receive from them the identifiers and transaction information described in 2.1 and 2.3.

5.3 Sharing to other platforms. If you use the share feature, the link you share opens the platform you choose (for example WhatsApp, Facebook, Telegram or X). The shared link points to a public BossDrama page and does not contain your account information. What you post there is governed by that platform's terms and privacy policy.

5.4 Legally required disclosure. After verifying that disclosure is necessary, we will disclose the necessary information to comply with legal obligations, respond to valid legal process, protect personal safety, or handle fraud and disputes in accordance with the law.

5.5 Corporate transactions. If a merger, acquisition or asset transfer involves personal information, we will require the recipient to comply with this Policy and will inform you of the change of controller.

5.6 We do not sell personal information, and we do not "share" personal information for cross-context behavioral or targeted advertising.

6. Retention Periods

• Information: Account information, preferences, and viewing, interaction and download records; Retention period: For as long as your account exists; deleted or irreversibly anonymized when the account deletion cooling-off period ends
• Information: Purchase and transaction records; Retention period: Kept for 5 years after the transaction in accordance with Singapore financial and tax requirements, with restricted access, and then deleted
• Information: Detailed playback session and playback progress reports; Retention period: 90 days; after that, only statistics aggregated by title and by day are kept, and they are no longer linked to individuals
• Information: Records of adding and removing likes and favorites; Retention period: 180 days (your current likes and favorites are kept with your account)
• Information: Playback quality data (such as startup time); Retention period: 30 days
• Information: Device identifier hash used for the first top-up bonus; Retention period: Kept after account deletion, only to prevent the bonus from being claimed again on the same device; it cannot be used to identify you
• Information: Sign-in records (time, network address, approximate location and device); Retention period: 12 months
• Information: Push notification data at OneSignal (push token, subscription and delivery records); Retention period: Unlinked from your account when you sign out; deleted from OneSignal when account deletion is completed
• Information: Duplicate-submission prevention records; Retention period: 7 days
• Information: Server request logs; Retention period: Overwritten on a rolling basis depending on storage capacity, usually within 30 days
• Information: Customer support conversations; Retention period: 2 years after the request has been resolved
• Information: Reports you submit; Retention period: For as long as needed to review the report and keep a record of the decision, and no longer than 2 years
• Information: Database backups; Retention period: Backed up once a day. The server keeps the 10 most recent backups, and off-site backups are kept for 30 days. Deleted information may remain in backups for up to 30 days and is deleted when those backups are deleted

These periods are applied automatically through our data retention and cleanup settings and backup jobs.

7. Security and International Transfers

7.1 All data is encrypted in transit (HTTPS), and requests involving funds are additionally verified by signature. Databases and keys can be accessed only from within our servers, and administrative operations are subject to access controls and audit logs. We cannot guarantee absolute security. If a personal information security incident occurs, we will take remedial measures and notify regulators and affected users within the time limits required by law.

7.2 International transfers. Our servers are located in Singapore, Cloudflare processes network requests and caches video content at nodes around the world, IPinfo processes network addresses in the United States, and OneSignal processes push notification data in the United States. If you use BossDrama in another country or region, your information will be transferred to Singapore for processing. When we transfer personal information of users in the European Economic Area or the United Kingdom to Singapore, we use standard contractual clauses approved by the European Commission or other legally recognized safeguards.

8. Your Rights

8.1 Subject to applicable law, you may request access to, correction of or deletion of your personal information, obtain a copy of it, restrict or object to certain processing (including personalized recommendations), withdraw your consent, and lodge a complaint with a regulator.

8.2 How to exercise your rights: in the app, you can change your preferences, delete favorites and watch history, and delete your account. For other requests, email [email protected] with the subject "Privacy Request". To help us find your account, send the request from the email address linked to your Apple, Google or Facebook sign-in, or start a conversation at Profile › Contact Us in the app. We will verify only the information necessary to handle your request and will never ask for your password.

8.3 We will respond within 30 days of receiving your request (or within one month where the GDPR applies; where necessary, we may extend this period as permitted by law and will tell you why). If we cannot fully meet your request, we will explain why and tell you what remedies are available. Requests are usually free of charge.

8.4 Deleting information that is necessary to perform a contract or comply with a legal obligation will mean that the related service can no longer be provided. We will tell you this in advance.

9. Deleting Your Account

You can request account deletion in the app at Profile › Settings › Delete Account, by following the instructions at www.bossdrama.com/delete-account, or by emailing [email protected] from the email address linked to your account. After you submit the request, there is a 7-day cooling-off period; signing in again during this period automatically cancels the deletion. When the cooling-off period ends, your account information, sign-in links, preferences, watch history, favorites, likes, follows, reservations and download records are deleted or irreversibly anonymized. Transaction records, customer support conversations and reports are kept only for the periods in Section 6 and are no longer linked to an active account. If you signed in with Apple, we also revoke your Sign in with Apple authorization. If you signed in with Facebook, the link to your Facebook account is deleted with your account; you can also remove BossDrama at any time in your Facebook settings under Apps and Websites. When deletion is complete, the account can no longer be signed in to; if you made the request by email, we will confirm by email. Deleting your account does not cancel an App Store or Google Play subscription; please cancel it first in your Apple or Google account settings.

10. Children

BossDrama is intended for users aged 13 and over. It is not designed for children under 13, and we do not knowingly collect their personal information. Users aged 13 to 17 should use BossDrama with the consent and guidance of a parent or guardian. BossDrama does not verify age. If we find that a user under 13 is using BossDrama, we will close their account and delete the related information. Parents and guardians can contact us at [email protected].

11. Changes to This Policy

We will show the last updated and effective dates. Before material changes take effect, including changes involving new purposes, new categories of data, new third parties or new international transfer arrangements, we will notify you through a prominent notice in the app. Where the law requires your renewed consent, we will not treat your continued use as consent.

12. Contact Us

Controller: Dragonrise Technologies Pte. Ltd. Registered address: 133 New Bridge Road, #23-09 Chinatown Point, Singapore 059413 (UEN 202648606G) Telephone: +65 9661 2066 Privacy and data protection requests: [email protected] Customer support: [email protected], or Profile › Contact Us in the app EEA / UK representative: where required by applicable law, we will appoint one and publish the details here.

13. Regional Supplements

This Section applies only where the relevant law applies, and mandatory local provisions take precedence.

13.1 European Economic Area and United Kingdom. The legal basis for each processing activity is set out in Section 3. You have the right to access, correct, delete, restrict, object, port your data and withdraw consent, and to lodge a complaint with the supervisory authority where you habitually reside or work or where the alleged infringement took place. For the international transfer mechanism, see 7.2.

13.2 US state privacy laws. Where the applicable thresholds are met, you have the right to know, access, correct, delete and port your personal information. We do not sell personal information, do not share personal information for targeted advertising, and do not use sensitive personal information to infer characteristics about you. Because we do not sell or share personal information, we treat a browser Global Privacy Control signal on our website as an opt-out request without any further action being needed. You can submit an appeal to [email protected], and we will explain the outcome and how to make a further complaint.

13.3 Singapore. Where Singapore's Personal Data Protection Act applies, we handle notification, consent, access, correction, protection, retention and cross-border transfer in accordance with its requirements. Our data protection contact is [email protected]. You can lodge a complaint with Singapore's Personal Data Protection Commission (PDPC).

If BossDrama is distributed in other countries or regions, we will add the relevant information in accordance with local law.