Privacy policy
BG Bully is a browser game. You can play without an account. If you create one, we keep only what the game needs: to sign you in, show your progress and stats, deliver what you buy, and keep matches fair. We don’t sell personal data, show ads, or use tracking or advertising cookies, and there are no third-party trackers on the site.
Who we are
BG Bully is run by Michael Luis Yerena, trading as Dirtysock Studios, of Queen City, Texas, USA, the “controller” of your data. Contact: support@bgbully.com.
What we store, and why
| Data | Why | Kept |
|---|---|---|
| Display name and account creation date | To show your name in matches and on the leaderboard. | Until you delete your account |
| That you are 13 or older, and whether you are under 18 (two yes/no answers) | Accounts are for players 13+, and under-18s get stronger privacy defaults. We ask your birth year once and keep only these answers, never the date. | Until you delete your account |
| Username and a salted password hash (password accounts only) | To sign you in. We never store your password itself. | Until you delete your account |
| Which sign-in provider you used (Google, Discord or Facebook) and that provider’s account ID for you | To sign you in with that provider. We don’t store your email, profile, contacts or access tokens. | Until you unlink it or delete your account |
| Sign-in sessions (hashed) | To keep you signed in. | Up to 30 days |
| Game progress: your Box Tops balance and what you earned and spent them on, the heroes and items you’ve unlocked, match stats (kills, damage, wins and similar), quests, achievements, titles and recolors | To unlock rewards and run the leaderboard. Only matches our servers ran count. | Until you delete your account |
| Friends: your friend code, your friends, friend requests and blocks, and whether you are in the lobby or in a match | To let you add friends and join their matches. Only your friends see whether you’re online. | Until you remove the friend or delete your account; online status reads as offline after 90 seconds |
| Purchases: what you bought, price, currency, country for tax, date, and Stripe’s payment and customer IDs | To deliver your items, handle refunds and keep the tax records the law requires. | 7 years after the sale (what tax law requires), even if you delete your account (then without your account link) |
| Player reports: the reason, the match, and the reporting and reported account (if any) and name | To review cheating and abuse. | Up to 12 months; account links are removed if either account is deleted |
| Short-lived, rotating hashes of connection details | To limit sign-in and match abuse. We don’t keep raw IP addresses. | Up to 30 minutes |
Your card details go straight to Stripe. We never see or store them.
Our legal reasons (for UK and EU players)
- Contract: running your account, your progress and the items you buy.
- Legitimate interests: keeping matches fair and the service secure (abuse limits, reports, anti-cheat).
- Legal obligation: keeping sales and tax records.
Google, Discord and Facebook sign-in
If you choose “Continue with Google”, “Continue with Discord” or “Continue with Facebook”, the provider tells us a stable ID for your account. We also receive your first name (Google, Facebook) or display name (Discord), which we use once as a suggested BG Bully display name. We ask only for basic profile access (Google: openid profile; Discord: identify; Facebook: public_profile). We never receive your password for those services and never post anything on your behalf.
Information on your device
Your game settings, saved builds, cosmetic choices and solo victories are stored in your browser on this device, not on our servers. Clearing your browser data removes them.
To see how the game is doing (for example how many players start a match or come back the next day), your browser keeps a random ID and sends us simple counts like “a match started” to our own servers; we don’t use third-party analytics, don’t store your IP address with them, and delete the raw events after 7 days.
Cookies
We use only the cookies needed to run sign-in: a session cookie that keeps you signed in, and a temporary cookie used during Google, Discord or Facebook sign-in, which expires within ten minutes. There are no advertising or analytics cookies, so we don’t need a cookie banner.
Online matches
When you play online, the match server processes your moves and the names, classes and cosmetics players choose, so everyone in the match can see them. Match state is kept briefly so you can reconnect, then discarded. Offensive names are replaced with “Player”.
Players under 18
- Accounts are for players 13 and older. If someone says they are under 13, we don’t create an account and store nothing about them. If we learn an account belongs to someone under 13, we delete it.
- BG Bully has no chat, no private messages, no public profiles and no location features, and shows no ads. Players can add each other as friends with a friend code or name; friends can see when you’re online and join your match, and you can block anyone. Other players in a match see only your display name, hero, cosmetics and match stats.
- Players under 18 don’t appear on the public leaderboard unless they turn it on in the account panel. Adults appear by default and can turn it off there.
- Buying items needs a parent or guardian’s permission for players under 18.
Service providers
BG Bully runs on Cloudflare (hosting, database, backups and protection from abuse). Stripe processes payments and calculates tax. Google, Discord and Facebook (Meta) process your sign-in if you choose them. Each follows its own privacy policy. Some of them are in the United States. When your data goes there, they protect it with the safeguards UK and EU law requires, such as standard contractual clauses or the UK/EU–US Data Privacy Framework.
We keep encrypted backups of our database for 30 days. Deleted accounts disappear from backups when those backups expire.
Your rights and deleting your data
- Delete: open the account panel in the game, choose Delete account and confirm. This permanently deletes your account, sign-in methods, sessions, progress, stats, achievements and the items on your account. Purchase records we must keep for tax stay, without your account link.
- Unlink a sign-in: unlinking Google, Discord or Facebook removes the stored provider ID. You can also remove BG Bully’s access in that provider’s settings.
- Access, correction, a copy of your data, or objecting: email support@bgbully.com. We reply within a month.
- Complaints: you can complain to your local data protection authority (in the UK, the Information Commissioner’s Office at ico.org.uk).
Changes
If this policy changes, we will update the date at the top of this page. For important changes, we will tell signed-in players in the game.
← Back to BG Bully