Your data

Privacy

Updated 25 Sep 2026

The short version

Boomforge keeps what the game needs to work, and nothing else. No ads, no third-party trackers, and we never sell your data.

What we keep

And why, and for how long.

WhatWhyHow long

Your games: display name, moves, table chat, and a recording of each gameTo run games, and to replay and review themFinished tables go after 30 days. Recordings stay for reviews.

Your account: name, email, a hashed password (or your Discord or Google ID and avatar)To sign you inUntil you delete it

Your profile: friends, results (including games you left), stats, coins, items, settingsProfiles, leaderboards and the shopUntil you delete your account

Purchases: what you bought and your membership period. Card details go to the payment processor; we never see them.To unlock what you paid forAs long as tax law requires

Your country (only the two-letter code, never your IP address)Country leaderboardsWith your account

A random visitor ID, your language, and first and last visit datesCounting visitorsWhile useful. No IP address or name.

Feedback you send (anonymous if you choose)Improving the gameWhile useful

IP addresses in server logsSecurity and stopping abuseAbout 2 weeks

An IP address we have blocked for automated play or attacksKeeping the site up and fairUntil the block ends, at most 90 days

Signs of automated play: how often a seat passed and how quickly it moved, and, if your account is restricted, whyKeeping the game fair and the site upA day for the signs; a restriction until it lifts or we clear it

In GDPR terms, running the game and your account is the contract between us (Art. 6(1)(b)). Visitor counts, country leaderboards, security and feedback are our legitimate interest (Art. 6(1)(f)). Turn emails are your consent (Art. 6(1)(a)). Purchase records are a legal obligation (Art. 6(1)(c)).

What others see

And what we send you.

Other players see your display name, avatar, stats and badges, and your karma: how many of your last 10 games with other people you finished. You can hide yourself from the leaderboard and from the online list in your Profile.

Games in progress are listed on the Spectate tab, where anyone can watch the board, never your hand or table chat. Hiding yourself from the online list keeps your games off it too.

We only email you for a password reset you ask for, or for turn emails if you switch them on.

Who else handles it

Only what's needed to run the site.

A few service providers help run Boomforge: our hosting provider (servers in the EU), our payment processor, our email delivery service, and a lookup service that turns an IP address into a country code. Discord and Google are involved only if you sign in with them. Where a provider is outside the EU, the EU's approved safeguards apply.

Cookies

Only the ones the site needs.

bf_session keeps you signed in (until 30 days without a visit).
bf_oauth_state protects Discord and Google sign-in (10 minutes).
bf-country remembers your country code (30 days).

Your browser also stores your guest identity, preferences, game seats and a random visitor ID. Clearing your site data removes all of it.

Your rights

See it, fix it, take it, or delete it.

You can ask to see, correct, export or delete your data, or object to how we use it. Email support@boomforge.cc from your account's address and we'll reply within a month.

Deleting your account removes your profile, coins and items. Past games keep your display name so other players' records stay intact. If you're unhappy with how we handle it, you can complain to the data protection authority where you live.

You need to be at least 14 to create an account.

Who's responsible

Boomforge is an independent project run by one person. Reach us at support@boomforge.cc.