Privacy and your data
What is collected, why, and how to get rid of it. Short version: you can play the whole game without giving us anything at all, and if you do make an account it holds an email address, a name you chose, and counters.
Playing without an account
The campaign, the level editor and your own bomber need no account and no connection. In that mode nothing leaves your computer. Your settings, progress, bomber and levels sit in a folder on your own machine, listed in the how-to, and deleting that folder deletes all of it.
The game does not contain analytics, advertising, tracking or crash reporting. It makes no network request at all until you sign in.
What an account stores
An account exists so you can play online, hold a name nobody else can take, and carry your bomber between machines. It holds:
| Email address | To sign in, to confirm the address is real, and to reset a forgotten password. It is never shown to other players. |
|---|---|
| Username | The name above your bomber. Chosen by you and public by design - other players see it in a match and in the lobby browser. |
| Password | Stored only as a salted hash. Nobody, us included, can read it back. |
| Your bomber | The colours and gear you picked, and a small picture of it used as your avatar. Public, for the same reason the name is. |
| Counters | Matches played, won and lost, kills, deaths, time played, and campaign numbers: sectors cleared, blocks destroyed, best score. |
That is the whole list. No real name, no address, no payment details - the game is free and has no purchases. No IP address is stored as part of your profile, and there is no advertising or profiling of any kind.
While you are in a match
A match server has to know your address to send you packets, the same as any game. That is used for the connection and nothing else, and it is not written down anywhere after the match ends. A public match appears in the lobby browser as a name, a map size and a player count - the players in it are not listed.
If you host a match
Hosting means running a server other people connect to, so the people you invite necessarily learn the address they are connecting to. A join key gives them a short code instead of an IP address to pass around, and we store that code, the address it points at, and when it expires - for at most six hours, and only until the match ends.
Be clear about what that is: it keeps your address out of a group chat and lets you revoke it. It is not a way to hide where you are from the people you invited, because their game has to connect to you.
When a match on a key finishes, the host may record what it was - the mode, how many played, who won and how long it took. That is kept as a record of the match and is marked as reported by the host, because a server we do not run can say whatever it likes. It never counts towards anyone's statistics.
Why, and on what basis
Under the GDPR, the lawful basis for all of it is performance of a contract (Article 6(1)(b)): you asked for an account so you could play online, and an account is the minimum that makes that work. There is no processing here based on legitimate interest or consent, because there is no processing beyond running the thing you asked for.
Nothing is used for automated decision-making or profiling.
Who else sees it
Your username and your bomber are visible to other players - that is what they are for. Your email address, your password hash and your statistics are not shown to anyone else.
The site and the account system run on our own infrastructure in the European Union. Nothing is sold, and nothing is shared with advertisers or analytics companies, because there are none.
Downloads are hosted by itch.io, who are a separate company with their own privacy policy. Downloading the game from them is between you and them; they do not tell us who you are, and you do not need an itch.io account to download it.
How long
For as long as the account exists. Delete the account and the email address, the username, the bomber, the avatar and the counters go with it.
Lobby rows, which carry no player data, are closed automatically within a minute of a match server going quiet and cleared out afterwards.
Your rights
If you are in the EU or UK, the GDPR gives you all of the following, and you can use any of them at no cost:
| Access | A copy of what is held about you. Most of it is on your account page already. |
|---|---|
| Rectification | Correcting anything wrong. |
| Erasure | Deleting your account and everything with it. See below. |
| Portability | Your data in a machine-readable form, as JSON. |
| Restriction and objection | Asking us to stop processing, which in practice means closing the account. |
| Complaint | To your national data protection authority. In Hungary that is the NAIH. |
Write to privacy@fsociety.hu from the address on the account. We will answer within 30 days, which is what the regulation requires.
Deleting your account
Email privacy@fsociety.hu from the address the account uses and ask for it to be deleted. It is removed along with the username, the bomber, the avatar and every counter.
Deleting the account does not touch the game on your computer: your campaign progress, your levels and your settings are local files and stay exactly where they are. You can carry on playing offline.
Cookies
This site sets no cookies and runs no analytics. If you sign in on the account page, your session token is kept in your browser's local storage so you are not asked again on every page. It never leaves your browser except to talk to this site, and signing out erases it.
The game stores the same kind of token in a file in its own folder, for the same reason.
Changes
If this page changes in a way that affects you, the change will be described here rather than silently applied. Last updated 19 September 2026.