Last updated 15 August 2026
This game asks for as little as it can get away with, and this page says exactly what that is. Alin Pribeagu decides what happens to it, and can be reached at alinpribeagu@gmail.com.
| What | Why | How long |
|---|---|---|
| Your email address | To sign you in, to confirm the address, and to let you reset a forgotten password. It is never used to advertise anything. | Until you delete your account |
| The name you play under | It is shown to everyone in a room with you. | Until you delete your account |
| Your password | Never stored. What is stored is a scrypt hash of it, from which the password cannot be worked back out. | Until you delete your account |
| Your settings | Colour, keys, sound, table preferences, so they follow you between computers. | Until you delete your account |
| Sign-in sessions | To keep you signed in. Stored as a hash, so a copy of the database is not a way into anybody's account. | 30 days, or until you sign out |
| Your IP address | Held in memory only, to stop one machine opening endless connections or grinding through passwords. It is never written to the database. | Not stored |
| How busy the server is | How many people were playing, in how many arenas. Numbers only — nothing about who. | 90 days |
One, and only if you sign in:
| Name | What it does | How long |
|---|---|---|
bomberman_session | Says which signed-in account this browser belongs to. It cannot be read by javascript and it is not sent to other sites. | 30 days |
It is strictly necessary: without it, signing in would not survive a page reload. There is nothing to consent to because there is nothing here that tracks you, and no third party receives anything. If that ever changes, you will be asked first.
Three other things are remembered by the browser itself rather than in a cookie: your settings, whether you muted the sound, and the fact that you have already read the notice about this. None of them is sent anywhere unless you are signed in, and none of them says anything about you beyond how you like to play.
Nobody. There is no analytics service, no advertising, no third-party script of any kind — the page is not even allowed to load one. If an email provider is configured, your address is passed to it for the sole purpose of delivering the confirmation or password-reset message you asked for.
Write to alinpribeagu@gmail.com and it will be done. If you are in the EU or UK and are not satisfied, you may complain to your data protection authority.
Anyone may play. Playing takes no account and no details of any kind, so a guest hands over nothing that would need protecting in the first place.
An account is different, because it means keeping an email address. European rules treat a child's data with extra care: below a certain age — sixteen across most of the EU, and as low as thirteen in some countries — holding it needs a parent's say-so. So if you are under sixteen, ask a parent before making one. Until then you lose nothing by playing as a guest: the game is the same.