Cookie policy

This policy covers cookies, browser local storage, and similar technology used by BrummBrumm.app. We do not use advertising cookies or cross-site advertising trackers. The storage notice is informational; its "Got it" button closes the notice and does not switch optional tracking on.

The game may store the following data in your browser:

• race setup, player names, car choices, game rules, setup variant, and graphics settings;
• sound and crowd preferences;
• local Bomb Run and Roadkill records and their dates;
• up to 100 signed-in local runs waiting to upload after a network error;
• optional online debug logs when you enable them, plus developer-only network graph settings; and
• the fact that you closed the storage notice.

This data remains until the game replaces it or you clear the site's browser data.

Supabase uses first-party cookies to complete passwordless, Apple, or Discord sign-in, keep the session active, and refresh it. These cookies are necessary for an account; guest play does not create an account session. Signing out removes the local session, and expiry is controlled by the authentication service.

After you tick the legal checkbox, BrummBrumm.app sets a short-lived, HttpOnly cookie containing only the current policy version and the sign-in method you chose. It is limited to the authentication callback, expires after 30 minutes, and is removed when the callback finishes. It links the checkbox action to the account acceptance record.

Vercel Web Analytics records page views and bounded game events without third-party analytics cookies. Vercel identifies a visitor with a hash made from the incoming request and discards that visitor session after 24 hours. A data point may include a timestamp, page path, filtered query parameters, referrer, approximate location, device type, operating system, and browser. See the Privacy policy for the custom game-event categories.

Google Fonts receives a normal network request when the browser downloads the game's fonts. If Cloudflare Turnstile is configured, its script and frame run on the sign-in page and use browser or device signals to detect automation. The default Turnstile flow returns a one-time token; Cloudflare can also set a clearance cookie if pre-clearance is enabled in the Cloudflare configuration. Choosing Apple or Discord sign-in takes you to that provider, where its own cookies and policies apply.

You can inspect, block, or clear site data in your browser. Blocking local storage means preferences and local records may not survive a reload. Blocking account cookies prevents sign-in, but guest play remains available. Because the app does not use advertising cookies, there is no advertising-cookie preference to manage inside the game.

We update this page when stored keys, authentication, analytics, or third-party services change. The date above identifies the version acknowledged during the current account flow.