Privacy

Last updated 12 August 2026

Boomlet is a game, not a business built on knowing about you. It asks Discord for your name and picture and nothing else, it has no analytics and no advertising, and it shares your information with nobody. This page says exactly what is kept and where.

Boomlet is at boomlet.net and is run by Akshit Kumar (akshit.me, github.com/akshit-wtf). For anything on this page, write to [email protected].

What is stored

If you sign in with Discord

Signing in requests one permission from Discord, identify, which returns your Discord user ID, display name and avatar. Boomlet stores those three things and the dates your Boomlet account was created and last updated. It does not receive your email address, your servers, your friends or your messages, because it never asks for them.

The access token Discord issues during sign-in is used once, to read that profile, and is not written down.

If you play as a guest

A random identifier is generated and kept in your browser so a room can give you your seat back if you disconnect. No account is created and nothing about you is kept on the server between visits.

Games you play

When a game finishes, its result is stored:

who was in each seat: an account, a guest, or one of the bots
the display name each player was using at the time
where everyone finished
the mode, the season, and when it was played
a compact record of the moves, so the game can be replayed and a result can be checked

Games involving signed-in players are linked to their accounts. Guests' games are not.

Ratings

For each mode you play rated games in, and each season, Boomlet stores your rating, how settled that rating is, and how many games you have played and won.

Chat

Messages exist only inside the room they were sent in, in memory, for as long as that room does. They are never written to the database and are gone when the room closes. Boomlet cannot show you your old messages because it does not have them.

Technical

Your IP address is used while a request is being handled, to limit how fast anybody can create rooms or guess a room password. It is held in memory, discarded shortly afterwards, and not written to the database. Errors may be recorded in the server's log.

Cookies and what your browser keeps

Boomlet sets two cookies, both strictly for signing you in:

A session cookie, once you have signed in. It contains your Boomlet player ID and an expiry date, signed so it cannot be altered, and nothing else. It is HttpOnly, so scripts on the page cannot read it, and it lasts 30 days.
A short-lived cookie during sign-in, which exists only to check that the sign-in you complete is the one you started.

Your browser also keeps some settings on your own device, which never leave it: your chosen theme and board skin, the display name you last used, your guest identifier, your last local-game setup, and the code of the last room you were in, so you can be offered a way back into it.

There are no analytics cookies, no advertising, and no third-party trackers of any kind.

Discord

Signing in happens on Discord, and what Discord does with that is covered by Discord's privacy policy. Avatars are loaded from Discord's own servers, so Discord sees a request when one is shown. When Boomlet is played as an Activity inside Discord, Discord tells it which channel session you are in so that everybody there lands at the same table.

Who else sees this

Nobody. Your information is not sold, rented or shared, and there is no third party processing it on Boomlet's behalf.

Some of it is public inside the game, by design:

your display name and avatar, to people in a room with you
your display name, avatar, rating and record on the leaderboard, once you have played enough rated games to be listed

How long it is kept

Your account: until you ask for it to be deleted.
Finished games: indefinitely. They are the history the ratings are calculated from.
Rooms and their chat: until the room closes, which is at most half an hour after the last person leaves.

Deleting your account

Write to [email protected] from an address you can be reached at, or ask through Discord, and say which account to remove.

Deleting an account removes the account itself and every rating attached to it. Games you played remain, because they are also other people's games, but they keep only the display name you were using at the time and are no longer linked to any account.

You can also simply play as a guest, in which case there is nothing to delete.

Children

Signing in requires a Discord account, and Discord requires you to be at least 13, or older where local law says so. Boomlet is not intended for children below that age.

Changes

If this page changes, the date at the top changes with it. Anything significant will be announced in the game rather than quietly edited here.