Privacy Policy
This policy explains what GoBeast collects, why we collect it, who we share it with, and the control you have over it. We have written it in plain language on purpose.
Who we are
GoBeast is developed and operated by [Registered company name], trading as Top Layer Games, registered at [Registered office address] ([Company number]). In this policy, "we", "us" and "our" mean Top Layer Games, and "you" means the person using the GoBeast app or this website.
For the purposes of the EU and UK General Data Protection Regulation, we are the data controller for the personal data described here. Questions about this policy or about your data should go to privacy@toplayer.games.
Data we collect
Account data
When you create a GoBeast account we collect your display name, email address and an encrypted authentication token. If you sign in with Apple or Google we receive the identifier that provider returns, plus the email address you choose to share — including Apple's private relay address if you elect to hide your real one.
Health and fitness data
With your explicit, separate permission, GoBeast reads workout and activity data from Apple Health on iOS and Health Connect on Android. Depending on what you authorise this may include workout type and duration, distance, active energy, step count and heart rate.
This data exists in the app for one purpose: converting your real-world training into in-game progression for your beast.
- We never use health or fitness data for advertising or marketing.
- We never sell health or fitness data, and we never disclose it to data brokers.
- We never share it with third parties except processors acting on our instructions, or where you have given separate consent.
- We never use it for any purpose beyond delivering the features you enabled it for.
- You can revoke access at any time in your device settings, and GoBeast will keep working with manually logged sessions.
Usage and analytics data
We collect in-app event data — screens opened, features used, session length, progression milestones, crash and performance diagnostics — to understand how GoBeast is used and to fix defects. This is tied to a pseudonymous installation identifier rather than your name.
Device and technical data
Device model, operating system version, language, region, app version, network type and a reset-table device identifier.
Advertising identifiers
GoBeast may access your device advertising identifier — the IDFA on iOS or the Android Advertising ID — to measure campaign performance and attribute installs. On iOS we request this through Apple's App Tracking Transparency prompt, and we do not track you across apps or websites owned by other companies unless you allow it there. You can reset or disable the identifier at any time in your device settings, and declining has no effect on gameplay.
Purchase data
Subscriptions are processed by Apple or Google, not by us. We receive a transaction identifier and your subscription status. We never receive or store your card number or full billing details.
Support correspondence
If you contact us through the support form or by email we keep the message, your email address and any details you choose to include, so we can answer and keep a record of the issue.
How we use your data
We use personal data only for the purposes below, and only where a lawful basis applies:
- To provide the game — creating your account, syncing progress across devices, and converting workouts into in-game progression. Basis: performance of a contract; explicit consent for health data.
- To keep it working — diagnosing crashes, monitoring performance and preventing abuse or fraudulent subscriptions. Basis: legitimate interests.
- To improve it — analysing aggregate usage to decide what to build next. Basis: legitimate interests.
- To support you — answering your questions. Basis: performance of a contract and legitimate interests.
- To measure marketing — attributing installs and campaign performance. Basis: consent, where required.
- To meet legal obligations — tax, accounting and responding to lawful requests. Basis: legal obligation.
We do not make decisions about you that produce legal or similarly significant effects using automated processing alone, and we do not build advertising profiles from your health or fitness data.
International transfers
We may process data in countries outside your own, including the United States. Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on an adequacy decision where one exists, and otherwise on the European Commission's Standard Contractual Clauses together with additional safeguards where needed. You can request a copy of the relevant safeguards from us.
How long we keep it
We keep personal data only as long as we need it:
- Account data — for as long as your account is active, then deleted within 30 days of a deletion request.
- Health and workout data — while your account is active, so your beast's progression history stays intact. Deleted with your account.
- Analytics and diagnostics — retained in pseudonymous form for up to 25 months, then aggregated or deleted.
- Support correspondence — up to 24 months after the issue is closed.
- Transaction records — as long as tax and accounting law requires, typically 6 to 7 years.
Your rights and choices
Depending on where you live you have some or all of the following rights. You can exercise any of them free of charge by writing to privacy@toplayer.games, and we will respond within 30 days.
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate data corrected.
- Erasure — have your data deleted.
- Portability — receive your data in a structured, machine-readable format.
- Restriction and objection — limit or object to processing based on our legitimate interests.
- Withdraw consent — at any time, without affecting processing already carried out. Revoking Health permissions is one example.
- Complain — to your local supervisory authority. In the UK this is the Information Commissioner's Office.
Deleting your account
You can delete your GoBeast account and all associated data from inside the app, under Settings → Account → Delete account. Deletion is permanent, removes your progression history, and cannot be undone. You can also request deletion through the support page.
Deleting your account does not automatically cancel a subscription bought through Apple or Google. Cancel that separately in your App Store or Google Play subscription settings.
If you are in California
You may request disclosure of the categories and specific pieces of personal information we collect, request deletion, and not be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA/CPRA.
Children's privacy
GoBeast is not directed at children and is rated for users aged 13 and over (16 in jurisdictions where that is the minimum digital consent age). We do not knowingly collect personal data from children below that age.
If you believe a child has provided us with personal data, contact privacy@toplayer.games and we will delete the account and its data promptly. Parents and guardians can use Screen Time on iOS or Family Link on Android to manage downloads and in-app purchases.
How we protect your data
We use technical and organisational measures appropriate to the risk, including encryption in transit (TLS) and at rest, access controls that limit staff access to what their role requires, audit logging, and regular dependency and infrastructure patching.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform you without undue delay where the law requires it.
Changes to this policy
We may update this policy as the game and the law evolve. The "last updated" date at the top always reflects the current version. If a change materially affects how we handle your data we will tell you in the app or by email before it takes effect, and where the law requires it we will ask for your consent again.
Contact us
For any privacy question, request or complaint:
- Privacy enquiries: privacy@toplayer.games
- General support: the GoBeast support page
- Postal address: [Registered office address]
- Data protection representative (EU/UK), if appointed: [Representative name and address]
We aim to answer privacy enquiries within 30 days.