Privacy policy
Last updated: 20 October 2026
b00m ("we", "us") runs the browser game at b00m.online. This policy explains what we collect when you play, why, how long we keep it and what you can ask us to do with it. The operator responsible for your data is que9.co, based in Ontario, Canada. Contact: [email protected].
What we collect
| Data | When | Why |
|---|---|---|
| Player name, email address, password (stored only as a salted scrypt hash), user ID, account creation and last-seen times | When you create an account | To run your account, confirm it's yours, and let you recover it |
| Rating, kills/deaths, battle results, clan tag and tank paint, cosmetic unlocks, Supporter status | While you play | The game itself: ranks, leaderboards, history |
| Chat messages (with the room and time) | When you chat | Delivering them, and moderation: reports, mutes, bans |
| IP addresses and when they were used, for accounts and guests | Whenever you connect | Security and abuse prevention: one player per connection, rate limits, bans, spotting ban evasion and fake accounts |
| Settings, saved paint and a sign-in token, kept in your browser's local storage | On your device | Remembering your settings and keeping you signed in. These never leave your browser except the sign-in token, which is sent back to us to sign you in |
We don't use advertising or analytics trackers, and we don't sell or rent your data.
Services we use
- Cloudflare: network delivery, protection against attacks, and Turnstile (a privacy-friendly bot check on sign-up and guest play). Cloudflare processes your IP address and may set short-lived security cookies (e.g.
__cf_bm,cf_clearance) that are strictly necessary. - Resend (our email provider): sends account confirmation and password reset emails to your address.
- Our server host (OVHcloud, Canada): stores the game's data.
- Google Fonts: the site's fonts load from Google's servers, which receive your IP address.
- If paid Supporter status is added, a payment provider (e.g. Stripe) will process payments. We'll never see or store your card details, only a customer reference. This policy will be updated before that happens.
How long we keep it
- Account data is kept while the account exists, and deleted within 30 days of a deletion request.
- Chat logs and IP history are deleted automatically after 12 months.
- Battle records are kept for the leaderboards and history. On deletion your name is removed from them.
- Ban and moderation records may be kept as long as needed to enforce a ban.
- Backups are kept for a limited time and replaced on a rolling basis, so deleted data disappears from them as they rotate.
Canadian players
We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). We collect only what's needed for the purposes above and use it only for them, with your consent, which you give by creating an account or playing. If you're not satisfied with our answer to a privacy concern, you can complain to the Office of the Privacy Commissioner of Canada.
Where your data is stored
The game's data is stored in Canada. Some of the services above (such as Cloudflare and Resend) may process it in other countries, including the United States, where it's subject to those countries' laws.
Legal basis (EEA/UK players)
We process account and game data to provide the service you asked for (performance of a contract). We process IP addresses, chat logs and moderation data for our legitimate interest in keeping the game safe and fair, and email for account security and recovery.
Your rights
You can ask us to see, correct, export or delete your data, and you can object to processing. Email [email protected] from the address on your account. We'll reply within 30 days. You may also complain to your data protection authority.
Children
b00m isn't directed at children under 13, and you must be at least 13 (or the age of digital consent in your country, up to 16 in parts of the EU) to create an account. If you believe a child has given us personal data, contact us and we'll delete it.
Security
Passwords are hashed with scrypt and never stored in plain text. Connections use HTTPS. Logins are rate-limited, and staff tools are restricted. No system is perfectly secure: use a password you don't use elsewhere.
Changes
If we change this policy, we'll update the date above and, for significant changes, tell players in the game or by email.