Privacy Policy
Effective date: October 2026
Bomb It is built to be played, not to collect data. No accounts or game database — when your room closes, the game is gone. This page explains, in plain English, the little data we do touch and why.
Who we are
Bomb It is operated by the Bomb It team, an Estonian private limited company (the "we" in this policy). We are the data controller for the processing described here. You can reach us any time via the contact page.
What we process
Game data (in memory only)
- Player name — whatever you type. It is never verified and does not have to be your real name. "CaptainBoom" works great.
- Your chosen emoji and the 6-letter room code you join with.
- Transient game state — bomb positions, hearts, turns, and the session scoreboard live in server memory only while the room exists and are deleted when the room closes. There is no game database and no history of past matches on our side.
Data stored on your device (localStorage)
Your browser keeps your name and emoji (so you don't retype them), a session token (so you can reconnect to a live room), and device-local stats. The Android app also saves whether you are an adult or a minor after asking for your date of birth; it does not retain the date. This stays on your device; you can wipe it any time by clearing app or browser data.
Server logs
Like almost every website, our servers briefly log IP addresses for abuse prevention and rate limiting. Logs are kept for a short period and then deleted.
Analytics
We use Google Analytics 4 and Microsoft Clarity to understand aggregate usage — which pages people visit, where games get confusing — so we can improve the game. In the EEA, the UK, and Switzerland these run only after you consent through the privacy prompt described below; decline, and no analytics cookies or identifiers are set.
Advertising
The website loads Adsterra banner ads on desktop home and results screens, and below mobile browser results. Adsterra and its advertising partners may use cookies and process your IP address, browser or device information, and ad interactions to deliver and measure advertising. Read Adsterra's privacy policy. Native apps do not load these web banners.
Bomb It is free because it shows ads. The website may use Google AdSense; the Android app may show Google AdMob ads between rounds. The Android app asks for a date of birth before starting ads and saves only an adult or minor age group on the device. For minors, AdMob requests are tagged as child-directed and under the age of consent, with ad content limited to general audiences; personalized ads and the Android advertising ID are not used for these requests. Adults may receive ads according to their consent choices. Google's ad SDK may process IP address (which can indicate approximate location), device information, ad interactions, and app diagnostics or performance data for ads, measurement, and fraud prevention. You can read how Google uses data from partner sites at policies.google.com/technologies/partner-sites.
Consent
For adults visiting from the EEA, the UK, or Switzerland, Google's privacy prompt asks for consent before advertising in the Android app. Adults can change or withdraw their choice with the app's Ad privacy choices control. Minors are not asked to consent to personalized ads. The website's Google analytics and advertising tags use a Google-certified consent management platform (CMP) when available; Adsterra banners load independently of that prompt. Essential bits — like the session token that keeps you in your game — work without tracking.
Your rights (GDPR)
Under the GDPR you have the right to access, correct, and erase your personal data, to object to or restrict processing, to data portability, and to lodge a complaint with a supervisory authority (in Estonia, the Data Protection Inspectorate). To exercise any of these, use the contact page.
Honestly though: most of your data self-destructs with the room. We usually have nothing left to erase — which is exactly how we like it.
Children
The Android game is for players aged 13 and older. It blocks younger players before gameplay, network connections, or ads. For players aged 13–17, the app uses a generated player name and masks other players' names. The date of birth is used only to choose an age group and is not sent to our server. Multiplayer gameplay still sends a generated name, chosen bomb icon, room activity, and network information to our server; AdMob may process the advertising data described above under its child protections. If you have a question about a minor's data or want it removed, contact us.
Changes to this policy
If we change how we handle data — say, we add a feature that needs something new — we will update this page and its effective date. Meaningful changes will be flagged on the site itself.
Questions?
Ask us anything via the contact page. Then go hide some bombs.