Privacy
Last updated 21 September 2026
These games ask for as little as they can get away with, and this page says exactly what that is. Alin Pribeagu decides what happens to it. Come and say so on Discord.
What is kept, and why
| What | Why | How long |
|---|---|---|
| Account email, player name and password hash | Sign-in, verification and password recovery. Passwords are hashed; the original password is not stored. | Until account deletion is requested and completed |
| Session and email-link token hashes | Keep you signed in and securely confirm or reset your account. | Sessions: 30 days; verification: 24 hours; reset: 1 hour |
| Stripe customer and subscription references and subscription status | Manage Premium and decide whether to show advertisements. | While needed to provide the service or meet applicable recordkeeping obligations |
| Your IP address | Limit abusive connections and, when visit tracking is enabled, count arrivals and play activity. BoomWick does not sell these records or send its visit database to advertising providers. Hosting providers process requests to deliver the site. | Visit records: 90 days |
| Roughly where you are | A country and usually a town, estimated from your IP address using a database on this server. This lookup does not send your address to an external geolocation service. The town estimate can be inaccurate. | 90 days |
| Which browser you used | The name your browser gives itself: browser, operating system, and whether it is a phone, a tablet or a computer. Used to know what the game has to work on. | 90 days |
| Which page sent you here | The address of the link you followed, when you followed one. It says which post or search brought people, not who you are. | 90 days |
| How busy the server is | How many people were playing, in how many arenas. Numbers only — nothing about who. | 90 days |
Competitive scores
For ranked Road Fury races, we keep your best score, its date, and the account it belongs to. Your account name and best score are public on the leaderboard. We also keep your latest race ticket and seed to verify submissions. Your steering recording is sent when you submit a ranked score and processed for verification; the recording is not stored on the server. Leaderboard records are removed when your account is deleted. Practice races and browser bests stay in your browser.
What is not kept
- The guest name you play under in multiplayer rooms. It is shown to whoever is in the room with you, and forgotten the moment the match is.
- Your card-game deals, puzzle progress, daily results, and undo history. These are saved only in your browser so you can resume playing; they are not sent to our server.
- Your keyboard, sound and table display preferences are saved in this browser. Multiplayer appearance choices, such as player colours, can be shared with the room so other players can see them. Clearing site storage removes local preferences.
- Browsing history from other websites. BoomWick does not collect that history; advertising providers, when enabled, process information under their own policies as explained below.
- Full card numbers or card security codes. Stripe collects payment details on its hosted pages.
Cookies
When you sign in, BoomWick sets a necessary, HttpOnly session cookie named boomwick_session for up to 30 days. Signing out removes it. It is used for authentication, including remembering Premium, and not for advertising.
Google advertising and your choices
Advertising is currently disabled on BoomWick. No advertising cookies are set by BoomWick while it is disabled. The following explains how advertising would work if enabled.
When enabled, Google AdSense and participating third-party advertising providers may use cookies, local storage or similar identifiers to serve, measure and limit repeated ads and help prevent fraud. Ad requests can include your IP address, browser/device information and the page carrying the ad. Google and its partners may use information from visits to this and other websites to personalize ads, subject to your choices and applicable consent requirements.
Non-personalized ads use context rather than your past behaviour to choose ads, but may still use cookies or identifiers for measurement, frequency limits and fraud prevention. Choosing non-personalized ads is not the same as disabling all storage.
Before advertising is offered where consent is required, including the EEA, UK and Switzerland, a Google-certified consent platform must be configured to explain purposes and participating providers, collect the required choices and allow consent to be withdrawn. You can refuse optional advertising consent and still play the games. When a consent message is offered, use its privacy choices control to revisit your selection; each listed provider’s policy explains its own processing.
You can also manage Google ad personalization in My Ad Center, read Google’s advertising information, or find participating third-party opt-outs through YourAdChoices. Browser settings can block or clear cookies and site storage. Clearing BoomWick site storage also removes local saved games and settings; it does not delete an account or server records.
Visits are counted on the server instead, from the address the request arrives on. That means there is no way to opt out by clearing anything: if you would rather not appear in that count at all, ask on Discord below and it will be removed.
Who else sees it
Our hosting and database providers process the information needed to run the site. Resend delivers verification and password-reset emails when configured. Stripe processes payments and receives your account email and billing details when you use Premium checkout. Its handling of data is described in Stripe’s privacy notice. Full card details are not sent to BoomWick. Premium pages do not load advertising scripts.
When advertising is enabled, Google and participating ad providers receive information through ad requests as described above. BoomWick does not send its private visit database, account email addresses or saved puzzle/card positions to the advertising service. This does not prevent an ad provider from receiving the page URL or request information. See how Google uses information from partner sites.
There is no third-party analytics service, and no third-party script runs on this privacy page. Signed-in Premium accounts are served pages without Google advertising scripts or units.
Where you are is worked out on this server, from a database kept here. Your address is not sent anywhere to look it up. That data is by DB-IP, used under CC BY 4.0.
What you can ask for
- A copy of what is held about you.
- A correction, if something is wrong.
- Removal of your address from the visit count, or deletion of your account. Contact us using the link below; we may need to verify ownership. Some billing records may need to be retained as required by law.
Why any of it is allowed
The visit count rests on a legitimate interest: whoever runs a game is entitled to know how many people found it and whether they stayed. It is kept to the least that answers that question — ninety days — and if you would rather not be in it, say so and you will not be.
Come and say so on Discord. It will be done. If you are in the EU or UK and are not satisfied, you may complain to your data protection authority.
Account and subscription data is used to provide the service you request; billing records may also be retained to comply with legal obligations. Consent is requested for advertising where required.
Children
Games can be played as guests without registering. A parent or guardian should supervise account creation and purchases where required. Contact us if an account contains a child’s information that should be removed.