Privacy Policy

Information we handle

Guest play

Guest Mode means playing against the CPU or sharing a keyboard without signing in. We do not ask guests for an email, password, real name, birthday, age, location, or a custom display name. Guest play does not create a permanent player profile. The game uses automatic player labels and does not offer unrestricted guest text chat.

The game sends basic results, such as game mode, blocks cleared, time played, and the winning grid, to maintain community game totals. A random game identifier is used to recognize a result and avoid counting it twice; it is not a guest account. If you are signed in while playing a local game, results can also contribute to your account statistics.

Optional registered accounts

We store your username, an internal account identifier, account creation time, authentication credentials including a securely hashed representation of your password, and an optional recovery email. We do not store plaintext passwords.

We also store account gameplay statistics and activity, including scores, blocks cleared, time played, wins and losses, games played, table activity, and related match records and timestamps. Your username, online presence, table participation, and gameplay are visible to other players. Usernames and selected statistics may appear on public leaderboards.

Technical information and messages

Our infrastructure processes information such as IP addresses, request metadata, browser or device information, session identifiers, security signals, and operational logs. This helps deliver pages, connect games, diagnose errors, and prevent abuse. We do not request your precise location.

If you email us, we receive your email address and the information you choose to include. Please do not send passwords, recovery links, or unnecessary personal details.

How we use information

• Run the game, connect players, restore interrupted online sessions, and maintain scores and community totals.
• Authenticate accounts, provide account recovery, and send account-related messages.
• Prevent abuse, enforce account rules, investigate errors, and protect the service.
• Answer support and privacy requests and meet applicable legal obligations.

We aim to collect only what these purposes need. We do not sell player information or use behavioral advertising trackers. The game code does not include third-party advertising or web-analytics scripts. Our usage measurements consist of gameplay statistics and infrastructure metrics and logs, rather than cross-site browsing profiles.

We obtain information directly from your use of the game, the account details you submit, and the technical and delivery information our service providers process for us. We do not buy personal information from data brokers.

Recovery email

Recovery email is optional. It is used for account recovery and related account messages, including a welcome message when supplied at signup. It is not displayed to other players or used for a marketing mailing list. Our email delivery provider processes the address and message to deliver these emails. Without a recovery email, automated password recovery is unavailable. You can add one through the lobby’s profile settings if your account does not have one.

Cookies and browser storage

Signing in sets an essential session cookie, __Host-bb_session, which normally expires after 24 hours. On the production HTTPS site it uses Secure, HttpOnly, and SameSite protections. Logging out revokes that session. The application stores a hash of the session token on the server.

Local storage remembers settings such as sound and music preferences, a saved username, and player labels. Session storage holds temporary preferences, rematch information, and previous-match scores. Local storage can remain until you clear it; session storage normally ends when the browser tab or session closes. These stored preferences are not advertising cookies.

You can clear site data in your browser. Doing so may sign you out or reset settings, but does not delete a registered account or server-side game records. Cloudflare may also process cookies or other technical identifiers needed for security.

How long information stays

Guests: active local game state lasts for the game or browser session. Browser preferences may last until cleared. Basic game-result records and community totals are retained separately from any guest profile. Guest result records currently have no fixed automatic deletion interval. We aim to retain guest-related operational and security information only as long as reasonably needed for those purposes.

Accounts: account details and associated gameplay records remain while the account exists, or as needed for security, resolving disputes, or legal obligations. Deletion requests are handled as described below. Community totals that no longer identify a player may remain.

Access and recovery: login sessions expire after 24 hours and password-reset links expire after 30 minutes. Expired database records are cleaned up during relevant authentication or recovery activity; expiry does not mean every stored record is erased at that exact moment. Operational logs, backups, and provider records may have separate retention periods.

Service providers and sharing

Cloudflare provides our Pages hosting and network delivery, Workers application services, D1 database, Durable Objects for multiplayer coordination, and security and operational monitoring. Cloudflare Email Routing forwards messages sent to our privacy address. These services process information needed to operate and secure Block Burner. See Cloudflare’s privacy policy.

Resend delivers account and recovery emails and processes the destination address, message content, and delivery information. See Resend’s privacy policy.

Google’s Gmail service receives and stores messages forwarded to our support inbox. See Google’s privacy policy.

Information may also be disclosed when reasonably necessary to comply with applicable law, respond to valid legal requests, or protect players and the service. Our providers may process information in countries other than your own.

Children and account eligibility

Players of any age may use Guest Mode. Permanent registered accounts are intended only for players age 13 or older. If you are under 13, please play against the CPU or on the same keyboard without creating an account.

We do not ask for or store a birthday to apply this account rule. If you believe a child under 13 has created an account or provided account information, a parent or guardian can contact us to request review and deletion. We may request only information reasonably needed to verify and handle that request.

The signup page asks you to confirm that you are at least 13. This confirmation is not stored as a birth date or age profile. Guest play does not require this confirmation. Parents and guardians may contact us about a child’s information without asking the child to create an account.

Your choices, privacy requests, and account deletion

You can play locally without an account, leave recovery email blank, log out, or clear browser storage. Choose a username that does not reveal your real name or other personal details.

To request account deletion, email [email protected] with your username and your request. There is currently no self-service delete-account button. We may need to verify that the account belongs to you before deleting account details and associated records. Never send your password. We will explain if some information must be retained for security or legal reasons.

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your information, or object to or restrict certain processing. Contact us to make a request. Available rights, verification requirements, and exceptions depend on applicable law; you may also be able to contact your local privacy regulator.

Describe the information or account concerned and the action you want us to take. We will handle requests within the time required by applicable law and explain any verification needed, extension, or reason we cannot fully fulfill a request. You do not need to submit government identity documents with your initial request. If we rely on consent for a particular use, you may withdraw that consent; this does not affect processing already lawfully carried out.

Security

We use HTTPS, securely hashed passwords, protected session cookies, and measures to limit unauthorized access and abuse. These reduce risk, but no internet service can guarantee perfect security. Keep your password and recovery mailbox secure.

Policy changes

We may update this policy as the game or its data practices change. Updates will appear on this page with a revised date. For material changes to how we use information, we will provide an appropriate notice, such as a notice on the site, and obtain consent where the law requires it. Posting a revised policy alone does not give us permission for a new use that requires consent.

Contact Block Burner

For privacy questions, account deletion, or a concern about a child’s account, email [email protected].