Privacy Policy
Effective date: July 2026
Bomb It is built to be played, not to collect data. No accounts, no downloads, and no game database — when your room closes, the game is gone. This page explains, in plain English, the little data we do touch and why.
Who we are
Bomb It is operated by the Bomb It team, an Estonian private limited company (the "we" in this policy). We are the data controller for the processing described here. You can reach us any time via the contact page.
What we process
Game data (in memory only)
- Player name — whatever you type. It is never verified and does not have to be your real name. "CaptainBoom" works great.
- Your chosen emoji and the 6-letter room code you join with.
- Transient game state — bomb positions, hearts, turns, and the session scoreboard live in server memory only while the room exists and are deleted when the room closes. There is no game database and no history of past matches on our side.
Data stored on your device (localStorage)
Your browser keeps your name and emoji (so you don't retype them), a session token (so you can reconnect to a live room), and device-local stats. This stays on your device; you can wipe it any time by clearing your browser's site data.
Server logs
Like almost every website, our servers briefly log IP addresses for abuse prevention and rate limiting. Logs are kept for a short period and then deleted.
Analytics
We use Google Analytics 4 and Microsoft Clarity to understand aggregate usage — which pages people visit, where games get confusing — so we can improve the game. In the EEA, the UK, and Switzerland these run only after you consent through the privacy prompt described below; decline, and no analytics cookies or identifiers are set.
Advertising
Bomb It is free because it shows ads. Google AdSense may serve ads and use cookies or similar identifiers, subject to your consent choices. You can read how Google uses data from partner sites at policies.google.com/technologies/partner-sites.
Consent
If you visit from the EEA, the UK, or Switzerland, a Google-certified consent management platform (CMP) asks for your consent before any non-essential cookies or identifiers (analytics and advertising) are set. You can change or withdraw your choice at any time by reopening that privacy prompt. Essential bits — like the session token that keeps you in your game — work without tracking.
Your rights (GDPR)
Under the GDPR you have the right to access, correct, and erase your personal data, to object to or restrict processing, to data portability, and to lodge a complaint with a supervisory authority (in Estonia, the Data Protection Inspectorate). To exercise any of these, use the contact page.
Honestly though: most of your data self-destructs with the room. We usually have nothing left to erase — which is exactly how we like it.
Children
Bomb It is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
If we change how we handle data — say, we add a feature that needs something new — we will update this page and its effective date. Meaningful changes will be flagged on the site itself.
Questions?
Ask us anything via the contact page. Then go hide some bombs.