Privacy policy

This notice explains how BrummBrumm.app handles information when you visit the site, play locally or online, or use a racer account. The operator of BrummBrumm.app is the controller for the processing described here.

Guest play does not require an account. Some network information is still processed when the site, fonts, analytics, or online-play services respond to your device.

Browser local storage holds game settings, racer and car choices, sound preferences, local Bomb Run and Roadkill records, the selected setup variant, optional network-debug logs, and any signed-in run waiting to upload. It also remembers that you closed the storage notice. This information stays in that browser unless a signed-in run is sent to Supabase. See the Cookie policy for the storage details.

If you create an account, Supabase processes your email address, user ID, authentication provider, sign-in timestamps, session information, and provider identity data. Apple or Discord supplies identity data when you sign in with it, and Apple can share a private relay address instead of your email address. After an Apple sign-in we also keep a token from Apple, used only to revoke the app's access to your Apple Account when you delete your account. We store your racer name and a server-timestamped record of the versions of the Terms, Privacy policy, and Cookie policy you accepted or acknowledged. Racer names are public.

Signed-in finishes may save a run ID, game mode, local or online context, map, player count, finishing rank, scored distance, verification status, and time. These records produce account statistics and achievements. Public leaderboards show racer names, scores, source, player count, run count, and record time. They do not show email addresses. Guest results are not stored in the account database.

Online play sends the game server your lobby and racer names, lobby code, optional lobby password, selected cars and rules, controller input, and race state. A signed-in player may also send a Supabase access token so the server can verify and save a result. Live lobby details are held in server memory for the session. Public lobby listings can show the lobby name, code, capacity, lock status, and race phase. The server uses your IP address in memory to limit connections and abuse; the application does not add it to race records.

Vercel Web Analytics receives page views and bounded gameplay events. A data point may include a timestamp, page path, filtered query parameters, referrer, approximate location, browser, operating system, device type, and event properties such as map, player count, input category, elapsed-time range, or finish reason. We remove known sensitive query parameters and do not send racer names, lobby codes, passwords, account IDs, or race IDs in custom events.

Vercel creates a short-lived visitor hash from the request and discards the visitor session after 24 hours. The reports are aggregate and are not tied to an account. If anti-bot protection is configured, Cloudflare Turnstile processes browser and device signals on the sign-in page to distinguish people from automated requests.

We rely on the following legal bases where data-protection law requires one:

• contract and steps you request before a contract, for accounts, saved progress, online play, and leaderboards;
• legitimate interests, for service security, abuse prevention, score integrity, reliability, and aggregate product analysis, balanced against the limited data involved and your available choices;
• legal obligations and legal claims, where we must keep or disclose a record; and
• consent, only where the law requires consent for a specific optional use.

Vercel hosts the web app and provides analytics. Supabase provides authentication and the account database. Railway hosts the online game server. Cloudflare provides optional anti-bot checks. Google serves the web fonts, and Apple and Discord handle their own sign-in when you select them. These providers process data under their own service and privacy terms and may process it outside the EEA. Their transfer safeguards may include adequacy decisions and standard contractual clauses. We do not sell personal data or use it for advertising.

Device data remains until you clear site data. Live lobby data and the game server's in-memory IP connection count disappear when the session ends or the server restarts. Vercel discards its visitor session after 24 hours; aggregate analytics remain available for the reporting window of the Vercel plan in use and may be stored longer under Vercel's service terms.

Account, run, achievement, leaderboard, and legal-acceptance records remain while the account exists. Deleting the account removes those application records. Infrastructure providers may retain security, authentication, and request logs under their own retention schedules.

Depending on where you live, you may have rights to access, correct, delete, restrict, port, or object to processing of your personal data. You can change your public racer name or permanently delete your account from the account page. You can clear local data with your browser controls. The controller may need to verify your identity before completing another privacy request.

You may complain to your local data-protection authority. In Sweden, that is the Swedish Authority for Privacy Protection (IMY). There is no automated decision-making that has legal or similarly significant effects on players.

BrummBrumm.app is a general-audience game. Do not create an account unless you can lawfully agree to the Terms where you live, or a parent or guardian has given any permission your local law requires. Guest play remains available without supplying an email address.

We may update this notice when the game or its providers change. The date above identifies the current version. If a change materially affects account holders, we will use a proportionate in-app notice or ask for a new acknowledgement.