Privacy Policy

Effective October 16, 2026

This policy explains what information Bomb Blitz ("we", "us") collects when you use the Bomb Blitz game and website at bombblitz.com (the "Service"), how we use it, and the choices you have. We collect only what we need to run the game, keep it fair and safe, and process purchases.

1. Information we collect

You give us

• Account details: username, email address and password (stored only as a secure hash — we can't read it). If you sign in with Discord, we receive your Discord ID, username and avatar. If you sign in with Apple, we receive an Apple user ID, the name you choose to share and your email address (or a private relay address if you choose to hide it).
• Messages: global chat, match chat and private messages you send to friends, and friend requests.
• Reports: when you report a player, the reason, any details you add and a copy of the reported message. The reported player isn't told who reported them.
• Support requests: what you send us when you contact [email protected].

Collected automatically

• Gameplay data: stats, rating, level, XP, items and currency balances, matches played, play time, settings and in-game activity.
• Technical data: IP address, browser and device type, and timestamps, used for security, anti-cheat, rate limiting and fraud prevention.
• Cookies and local storage: an essential session cookie keeps you signed in; your browser's local storage remembers settings like volume and map position. These are needed for the game to work.

Purchases

• Payments are processed by Tebex Limited, our reseller and merchant of record. Tebex collects your payment details directly — we never receive or store card numbers.
• From Tebex we receive the transaction ID, the item and amount, currency, the email you used at checkout, your country and IP address, and the payment method type. We keep these to deliver your purchase, send receipts, handle refunds and chargebacks, prevent fraud and meet tax and legal obligations.
• In the iPhone, iPad and Android apps, purchases are processed by Apple (App Store) or Google (Google Play). We don't receive your payment details; we receive the transaction ID, the item, the price and currency, and your store country, and keep them for the same reasons.

2. How we use information

• to run the game: accounts, matchmaking, chat, friends, progress and purchases;
• to send service emails such as purchase receipts and important account notices;
• to keep the game safe and fair: moderation, anti-cheat, abuse and fraud prevention;
• to fix bugs, measure performance and improve the game;
• to comply with the law and enforce our Terms of Service.

We don't sell your personal information.

3. Who we share it with

• Tebex — to process purchases.
• Cloudflare — hosting security, DDoS protection and privacy-friendly web analytics.
• Google AdSense — the Service may show ads. Google and its partners may use cookies or similar technologies to show and measure ads, including personalized ads where allowed. Learn more and manage choices at Google's ad policy page and Ad Settings. Where required, we ask for your consent first.
• Discord and Apple — only if you choose to sign in with them or link your account.
• Apple and Google — to process purchases made in our mobile apps.
• Our email provider — to deliver receipts and service emails.
• Authorities — if required by law, or to protect players, the Service or others from harm or fraud.

Other players can see your username, avatar, level, rating, equipped cosmetics and online status, and anything you post in chat.

4. How long we keep it

• Account and gameplay data: for as long as your account exists. You can delete your account at any time in Settings → Account; it's deleted or anonymized straight away. Requests by email are handled within 30 days.
• Chat messages: kept only as long as needed for the game and moderation.
• Purchase, refund and chargeback records: kept for up to 7 years, even after account deletion, because tax and anti-fraud rules require it.
• Security logs: kept for a limited time, typically up to 12 months.

5. Security

We use encryption in transit (HTTPS), hashed passwords, access controls and monitoring to protect your information. No system is perfectly secure, so please use a strong, unique password.

6. Children

The Service is not intended for children under 13, and we don't knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we will delete it. Players under 18 should only make purchases with a parent or guardian's permission.

7. Your rights and choices

Depending on where you live (for example under GDPR in the EU/UK or CCPA/CPRA in California), you may have the right to access, correct, download or delete your personal information, to object to or restrict some processing, and to withdraw consent. You can delete your account yourself in the game (how to delete your account). For other requests, email [email protected] from the address on your account. We'll respond within the time the law requires and won't treat you differently for using your rights. You can also complain to your local data protection authority.

Where GDPR applies, we rely on performing our contract with you (running the game), our legitimate interests (security, fraud prevention and improving the game), legal obligations (tax records), and your consent (for example, personalized ads).

8. International transfers

We and our providers may process information in the United States and other countries. Where required, we use appropriate safeguards for these transfers.

9. Changes

We may update this policy. If the changes are significant, we'll tell you in the game or by email before they take effect.

10. Contact

Questions or privacy requests: [email protected].