Privacy policy

What we collect #

We collect what the game needs to run, stay fair and handle payments:

• Store suggestions: identifiers of the suggestions and displays, what appeared, whether it was viewed, dismissed or led you to the Store, and the play time used to space suggestions.
• Discord community mission: if you choose to connect Discord, we store your stable Discord user ID, Discord username, membership verification time and reward status to verify eligibility and prevent duplicate rewards. We use provider access tokens only during verification and do not retain them.
• Crystal withdrawals: to withdraw Crystal you verify Discord, and we keep your stable Discord user ID and the verification time; this flow does not check server membership or keep Discord access tokens. Each withdrawal request keeps the amount, your VIP status and rate at that moment, the USDC amount, the linked Base wallet it pays, its dates and its status. To apply the per-person daily limit, we connect the accounts known to be one person's through that Discord ID, protected identifiers of verified Pix payments and reviewed account links. Discord is not needed to earn or hold Crystal.
• Crystal bought with Pix: the CPF you enter must be the payer's. It goes to Woovi with the charge, and we keep it only in protected form (a hash with a secret key) to check that the payment came from it, apply the daily limit per CPF and handle MED cases.
• Crystal participation: we keep your one-beneficiary declaration, policy version, enrollment time, selected account, and review records linked to an internal evidence case. Existing verified Pix identity hashes may connect known accounts, and that connection is retained if a login identity later changes. The new records do not contain a raw CPF. Discord, a wallet or a shared IP alone is not proof of one person.
• Google sign-in: a stable Google account identifier. We use it to find your game account; we do not store your email address or Google name, and we get no access to your Gmail, Drive, contacts or other Google content.
• Your account: nickname, progress, heroes, weapons, resources, gems, talents, missions, achievements and preferences.
• Gameplay: your runs with the inputs the server replays to check them, scores, play time per day, progress events, and fair-play signals such as session counts and timing patterns. Attempts from the retired ranked mode, including their inputs, scores and periods, are kept as historical records and are no longer used by the game.
• Chat messages, reports and feedback you send.
• Device and network: a random device identifier the game stores in your browser, your IP address (used for rate limits and abuse checks) and your country (used for payment and Market rules).
• How you arrived: the utm parameters, ref and invite codes of the link you first opened, saved when your account is created.
• Votes: when TopIdle reports a vote with your player code (or the identifier TopIdle sends), we record it to give the daily reward.
• Gem store orders: pack, amount, country, Pix charge and transaction identifiers from Woovi, and for USDC your linked wallet address and transaction IDs. We do not send your name or CPF to Woovi for store purchases, and we remove payer details from the payment notices we keep.
• Pix sellers: your full name, your Pix key, and your CPF in a protected form (a keyed hash and the masked form Woovi returns), checked with the Pix registry through Woovi. If your Pix key is your CPF, phone or email, that key is stored as you entered it.
• Wallets: the address of the wallet you link, and the wallet addresses on your Market listings, orders, offers and signed quotes.

Why we use it #

To sign you in and keep your progress, run the game and its markets, process and verify payments and send sellers their share, check runs and prevent cheating, multiple accounts and fraud, moderate chat, answer support requests, and understand how players find and use the game so we can improve it.

We use Store suggestion records to choose when to show an in-game purchase suggestion and measure whether it led to a purchase.

We do not sell your information, use it for advertising outside the game or share it with advertisers.

What other players see #

Your nickname, VIP badge and campaign progress can appear in chat, leaderboards and the public summary on this site. Chat messages are visible to other players. Market listings show the item and its price.

Transactions on Base are public: anyone can see wallet addresses, amounts and transaction IDs on the blockchain.

Services that process data for us #

We share only what each service needs to do its part:

• Discord authenticates the account you choose to link for Crystal withdrawals. Only the separate community mission checks whether that account is in our server.
• Cloudflare hosts the site, the game and its database, protects them from abuse, and measures page visits with Cloudflare Web Analytics.
• Google handles sign-in.
• Woovi processes Pix payments, checks Pix keys and sends payouts to sellers.
• Base is a public blockchain where USDC payments and sales are recorded; we read it through a Base network provider.
• Reown (WalletConnect) connects your crypto wallet, only when you choose to link one.
• TopIdle sends us votes cast with your player code.
• YouTube shows the trailer on this site only if you click play; the video then loads from youtube-nocookie.com.

Browser storage and cookies #

The game also keeps pending confirmations of Store suggestions in a local browser outbox containing only identifiers.

Discord authorization temporarily stores a state marker in this tab’s session storage. It is valid for 10 minutes and is removed when the matching authorization returns or when this tab’s session storage is cleared. No Discord access token is stored in browser storage.

The game keeps your session, preferences (such as language and sound), a device identifier and the link you arrived from in your browser storage. Sign-in uses a short cookie that lasts 5 minutes, and this site keeps your language choice in a cookie. A session lasts up to 30 days. Clearing your browser data signs you out on that device; your account stays on the server. If you connect a wallet, Reown (WalletConnect) keeps connection data in your browser storage.

How long we keep it #

Store suggestion records and the play time used to space them are kept while your account exists. We do not prune these records during Season 1.

Chat keeps only the last 7 days of messages. Reports and moderation records are kept. Account, gameplay, device and payment records are kept while your account exists, and payment, Market and fair-play records may be kept after that for accounting, fraud prevention and disputes. Information written to the Base blockchain cannot be deleted by anyone.

Your choices and requests #

You can ask for a copy of your data, a correction, or the deletion of your account. Email bumperfighters@gmail.com with your nickname and the email of the Google account you sign in with; we may ask for more details to confirm the account is yours. Deleting an account removes its progress and items for good. We may keep the records we need for payments, fraud prevention or legal obligations, and we will tell you what we keep and why.

Players in Brazil have the rights given by the LGPD (Lei Geral de Proteção de Dados); write to the same address to use them.

Changes #

We may update this policy as the game changes. The current version is always on this page with its date.