COOKIE & MOBILE TRACKING TECHNOLOGIES POLICY

Last updated September 02, 2025

This Cookie & Mobile Tracking Technologies Policy explains how HotBoxed Studios LLC (“Company,” “we,” “us,” and “our”) uses cookies and similar technologies to recognize you when you visit our website athttps://boundlessalchemist.com(the “Website”) and when you use our mobile applicationBoundless Alchemist (the “App”). It explains what these technologies are and why we use them, as well as your rights to control our use of them.

In some cases we may use these technologies to collect personal information, or information that becomes personal if we combine it with other data.

What are cookies and mobile-equivalent technologies?

Cookies are small data files placed on your computer or mobile browser when you visit a website. Cookies set by the website owner (in this case, HotBoxed Studios LLC) are called “first-party cookies.” Cookies set by parties other than the website owner are called “third-party cookies.” Third-party cookies enable third-party features or functionality to be provided on or through the website (e.g., advertising, interactive content, and analytics). The parties that set these cookies can recognize your device both when it visits the website in question and also when it visits certain other websites.

Mobile-equivalent technologies used in the App can include:

• Secure storage session identifiers (stored in the device’s secure storage, such as iOS Keychain / Android Keystore) to remember logins, maintain sessions, and help protect accounts.
• Local storage (e.g., on-device app storage) to save preferences and app state.
• Mobile advertising identifiers (e.g., Apple’s IDFA or Google’s AAID) when you have permitted ad tracking on your device.
• Push notification tokens (device-specific tokens issued by Apple/Google) to deliver notifications you opt into.
• SDKs (software development kits) from analytics, crash reporting, and performance monitoring providers that help us operate and improve the App.

Why do we use these technologies?

We use first- and third-party cookies on the Website, and mobile-equivalent technologies in the App, for several reasons:

• Essential / strictly necessary: Required to operate the Website and App, authenticate users, maintain sessions, prevent fraud/abuse, and ensure security and integrity.
• Performance & analytics: To understand usage, diagnose issues, and improve features (e.g., crash reporting, load times, feature engagement).
• Preferences: To remember your settings and choices.
• Marketing / advertising: To show or measure ads where permitted, and to understand the effectiveness of campaigns.
• Notifications: To deliver push notifications you’ve opted into (you can turn these off at any time in your device settings).

How we use secure storage session IDs in the App

The App uses secure storage session IDs to remember that you are logged in, keep your session active, and help protect your account. These identifiers are stored using the operating system’s secure storage (e.g., iOS Keychain / Android Keystore) and are encrypted by the platform. Deleting the App, signing out, or using the in-app “Log out”/“Reset account” controls will remove or rotate these identifiers.

How can you control cookies and mobile tracking?

Website (browser) controls

You have the right to decide whether to accept or reject cookies. You can exercise your cookie rights by setting your preferences in our Cookie Consent Manager (available in the cookie banner and in the Website footer). Essential cookies cannot be rejected as they are strictly necessary to provide you with services.

You can also set or amend your web browser controls to accept or refuse cookies. The means by which you can refuse cookies vary from browser to browser, so please visit your browser’s help menu for more information. The following pages may help:

• Chrome
• Firefox
• Safari
• Edge
• Opera

In addition, most advertising networks offer you a way to opt out of targeted advertising. For more information, visit:

• Digital Advertising Alliance
• Digital Advertising Alliance of Canada
• European Interactive Digital Advertising Alliance

App (mobile) controls

• Secure storage session IDs: You can log out in-app to clear session tokens. Reinstalling the App may also remove stored identifiers.
• Push notifications: Manage in your device settings (iOS: Settings > Notifications; Android: Settings > Apps & notifications).
• Advertising identifiers: Reset or limit ad tracking in device settings (iOS: Settings > Privacy & Security > Tracking; Android: Settings > Privacy > Ads).
• Permissions: Grant or revoke App permissions in device settings at any time.
• In-app privacy controls: Where available, use the App’s privacy settings to manage analytics and marketing preferences.

What types of technologies do we use?

Website cookies (examples)

App technologies (examples)

What about other tracking technologies, like web beacons?

Cookies are not the only way to recognize or track visitors. We may use similar technologies like web beacons(also called tracking pixels or clear GIFs) on the Website and within emails to, for example, monitor traffic patterns, measure campaign effectiveness, improve performance, or determine whether you have interacted with content or messages. These technologies often rely on cookies or mobile identifiers, so declining cookies or limiting ad tracking may impair their functioning.

Do you use Flash cookies or Local Shared Objects?

Some websites use “Flash Cookies” (Local Shared Objects) for certain operations. If used, you can manage them via Adobe’s Website Storage Settings Panel and Global Storage Settings Panel. Restricting Flash Cookies may reduce functionality of some Flash applications.

Do you serve targeted advertising?

Third parties may set cookies or use mobile identifiers to serve advertising through the Website or App. These companies may use information about your visits or in-app activity to provide relevant advertisements and to measure ad effectiveness. The information collected does not enable us or them to identify you by name or direct contact details unless you choose to provide such information. You can control this via our Website’s Consent Manager, in-app privacy settings (where available), and your device’s ad-tracking settings.

U.S. “Do Not Sell or Share” and “Limit the Use of Sensitive Personal Information”

To the extent our use of cookies or mobile identifiers is considered a “sale” or “sharing” under applicable U.S. state laws, you can exercise your rights via the Website’s “Do Not Sell or Share My Personal Information” link or the in-app privacy settings (where available). If we process any sensitive personal information (we generally do not for cookies/session IDs), you may request to limit its use via the same mechanisms.

How often will you update this Policy?

We may update this Policy from time to time to reflect changes to the technologies we use or for operational, legal, or regulatory reasons. Please revisit this page regularly to stay informed. The date at the top of this Policy indicates when it was last updated.

Where can I get further information?