Privacy Policy
Last updated: 12 October 2026
Data controller and contact
The BomBom Arena team is responsible for your data. For data requests: support@bombomarena.com
Information stored by the site
We store username, character name, email, optional invitation code, accepted terms version and registration date. If you sign up with an invitation code, its owner sees your character name, join date and level. Your password is not kept in this site's database: the game server checks it and stores it as a salted hash. Only hashes of session tokens are stored in the database.
Information stored by the game server
The game keeps your account, character, items, in-game currency, progress and in-game mail. For security and cheat prevention it also stores the IP address you sign in from, the device ID (HWID) generated by the launcher, your network card (MAC) address and sign-in records.
Payment information
For cryptocurrency payments we record the amount, currency, transaction ID (hash) and time. No card or bank details are collected. Keep in mind that blockchain transactions are public.
Purposes and legal grounds
Your data is collected electronically through the site, the launcher and the game client. Account, game and payment data are processed to provide the service (performance of a contract), payment records to meet legal obligations, and IP addresses, device IDs and MAC addresses for security and cheat prevention (legitimate interest).
Security and cookies
Essential cookies support sessions and CSRF protection. On a first visit the language follows your browser language and the country you connect from; the country is not stored. If you change the language yourself, that choice is kept in a cookie in this browser. No advertising or tracking cookies are used. For abuse prevention, IP addresses are transformed using keyed HMAC and used in short-lived request counters. Cloudflare Turnstile is used when bot verification is enabled.
Sharing
Your data is not sold or shared for advertising. The site, domain, email and bot verification run on Cloudflare's infrastructure; because Cloudflare's servers are located abroad, this data is also processed outside Türkiye. Data may be shared with competent authorities when the law requires it.
Retention
Account data is kept until you ask us to delete it. Payment records are kept for the period required by law. Sessions expire within 7 days; expired security records are removed during cleanup.
Your rights
Under KVKK and the GDPR you can ask whether your data is processed, request a copy, ask for correction or deletion, and object to processing. Send your request to support@bombomarena.com from the email address registered to your account; it is answered within 30 days. When your account is deleted, your site and game account data are deleted; payment records that must be kept by law remain until that period ends. If your request is refused or not answered, you can complain to Türkiye's Personal Data Protection Board or to the data protection authority in your country.
Children
Children under 13 may not create an account. If we find such an account, it is deleted.
Changes
This policy may be updated. The current version is published on this page with its last updated date.