Your data, and what we do with it.
Last updated 14 October 2026
No trackers, no ad networks, no data sales. This policy explains what Bounce collects, why, who handles it, how long it is kept and how to use your rights.
Your account’s data can be downloaded or deleted at any time from your profile.
01Who is responsible
Bounce is run by the operator of Bounce, the controller of the personal data described here under the EU and UK General Data Protection Regulation (GDPR). You can reach us about anything in this policy through the Report a bug form at the bottom of every page, starting the title with “Privacy request”.
This policy covers the website, the game and everything attached to your Bounce account. It does not cover the sites of the sign-in providers or wallets you use with it, which have their own.
02What we collect
We collect as little as running a competitive game needs. We never receive your password, and we do not ask for your email address, your real name, your date of birth or your phone number.
| Category | What it is |
|---|---|
| Account | A stable account ID from your sign-in method: github:12345, google:…, discord:…, or solana:<your wallet address>. The display name your provider sends is kept in your session cookie only. |
| Beta verification | If you verify Discord: a fingerprint of its account ID, its creation date and the verification date. We check membership of the Bounce server and assign its Beta Tester role. We do not store Discord access tokens, usernames, email or messages for this feature. |
| Profile | The player name and picture you choose, your theme, your rank, your referral code and who referred you. |
| Games | Every board you play: its seed, each shot's angle and timing, how you aimed before each shot (replayed to spectators), scores, results, tournaments entered and quests and rewards claimed. |
| Money | Your gem and SOL ledgers, entries, payouts, tips, your Bounce deposit address, the wallet addresses you deposit from or withdraw to, and the blockchain signatures of those transfers. |
| Security | Your encrypted authenticator secret and hashed recovery codes if you turn on two-factor authentication, failed code attempts, sign-out-everywhere events, security holds, and alerts sent to you. |
| Fair play | Signals from the anti-cheat: aim timing and movement, whether input came from a real device, whether the browser reports being automated, and how each real-money shot compares with every other possible angle. |
| Social | Friends, friend requests, messages between friends, blocks and reports you make or that concern you. |
| Support | Bug reports you send: title, description, the page you were on, links, and any screenshot or video you attach. |
| Notifications | Notices about your matches and account and, if you allow them, a push subscription for this browser (an address at your browser's push service). |
| Technical | Your IP address, used only for a few minutes to limit abuse (requests per minute), and the days you were active, used for aggregate retention figures. Our host also keeps short-lived server logs. |
03Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Running your account, matches, tournaments, rewards and leaderboards | Performance of our contract with you (the Terms of Use) |
| Holding, moving and accounting for gems and SOL, deposits and withdrawals | Performance of the contract; legal obligations on accounting and, where they apply, on anti-money-laundering checks |
| Keeping accounts and money safe: two-factor codes, rate limits, security alerts, holds | Our legitimate interest, and yours, in preventing fraud and account theft |
| Detecting cheating, bots, collusion and multiple accounts | Our legitimate interest, and other players', in fair games for money |
| Friends, messages, reports and blocks | Performance of the contract |
| Answering bug reports | Our legitimate interest in fixing the service |
| Push notifications | Your consent, given in your browser, which you can withdraw at any time |
| Aggregate statistics (active players, retention) | Our legitimate interest in understanding how the service is used; no individual profile is built for marketing |
04Automated decisions
To keep games for money fair, the anti-cheat can suspend an account automatically when there is technical proof of automated play (for example a browser driven by a script, or shots arriving faster than a person can aim), and can open a review when a player’s shots are statistically far beyond anyone else’s. A suspension holds the account’s money; it does not take it.
You have the right to a human review: a suspended player can appeal once from the notice they see, and an administrator decides. Only an administrator, after review, can close an account for cheating. You can also contest a decision through the Report a bug form at the bottom of every page, starting the title with “Privacy request”.
05What other people can see
Your player name, picture, rank, public statistics, finished results and the boards you play (shot by shot, once others may watch them) are public. Your balances, wallet addresses, transfers, tips, messages, notifications and security settings are only ever sent to your own session. Account IDs never leave our servers, except that a wallet account’s ID is its public address.
Blockchain transfers are public by nature. A deposit or withdrawal is recorded on the Solana network, where anyone can see the addresses and amounts involved, permanently. Neither we nor anyone else can erase it.
06Who we share it with
We do not sell personal data, and we do not share it with advertisers. It is handled for us by these providers, under contracts that bind them to our instructions:
| Provider | Role |
|---|---|
| Vercel Inc. (USA) | Hosting, server logs and storage of bug report attachments |
| Turso (ChiselStrike Inc., USA) | Database |
| GitHub, Google, Discord | Sign-in, only if you choose that method; they learn that you signed in to Bounce. Discord also processes beta verification and the Beta Tester server role if you choose to verify. |
| Your browser's push service (Google, Mozilla, Apple, Microsoft) | Delivering push notifications, encrypted end to end, only if you turn them on |
| Solana network | Recording deposits and withdrawals, publicly |
We may also disclose data when the law requires it, or to establish or defend legal claims.
07Transfers outside Europe
Some providers above are based in the United States. Transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses, with the additional safeguards they require. You can ask us for a copy of the safeguards that apply through the Report a bug form at the bottom of every page, starting the title with “Privacy request”.
08How long we keep it
| Data | Kept for |
|---|---|
| Profile, friends, messages, notifications, push subscriptions, authenticator | Until you close your account, then deleted |
| Finished games, ledgers and transfers | As long as accounting and anti-fraud obligations require (up to 10 years); after you close your account they are kept without your name or picture, because removing one side of a settled match would falsify the other player's records |
| Anti-cheat signals and sanctions | While the account exists, so a decision can be reviewed; afterwards only as part of the records above |
| Bug reports and attachments | Until the report is dealt with and no longer useful, and in any case removed when you close your account; unsent uploads are removed within 24 hours |
| IP addresses for rate limiting | A few minutes |
| Sign-in challenges for wallets | Five minutes, or until used |
| Discord verification challenges | Ten minutes, or until used |
| Beta verification fingerprints and reward receipts | For beta administration and reward processing. A pseudonymous record is retained after account closure to prevent repeat claims; contact us to request a review. |
| Hosting logs | As set by our host, typically a few days |
09Your rights
Under the GDPR you have the right to:
- access your data and take it with you: the Download my data button on your profile gives you every row we hold about your account, as a file;
- correct it: your name and picture can be changed on your profile at any time;
- erase it: your profile can delete your account, with the limits explained under “How long we keep it”;
- object to processing based on our legitimate interest, and restrict processing while a request is examined;
- withdraw consent to push notifications from the notification menu or your browser settings;
- not be subject to a decision based solely on automated processing without a human review (see “Automated decisions”).
For anything the profile cannot do, write to us through the Report a bug form at the bottom of every page, starting the title with “Privacy request”. We answer within one month. You can also complain to the data protection authority of the country where you live or work, or where you think the problem occurred.
11How we protect it
Data travels over HTTPS only. Wallet keys and authenticator secrets are encrypted at rest; recovery codes are stored as keyed hashes. Withdrawals, larger tips and administrator changes require a code from an authenticator app, and sensitive changes require you to sign in again. Every request is rate limited, and any sign of a breach that puts your rights at risk will be reported to the supervisory authority within 72 hours and, where required, to you.
12Age
Bounce is for adults only. You must be at least 18 years old to create an account. If we learn that an account belongs to someone younger, we close it.
13Changes to this policy
When this policy changes, the date at the top changes with it. If the change is significant, we will tell signed-in players with a notice on the site before it takes effect.