Bustbound — Privacy Policy

Last updated: 20 October 2026

Bustbound is a multiplayer card game available through web browsers and Discord Activities.

This Privacy Policy explains what personal information Bustbound collects, why it is needed, how it is stored and when it is deleted.

Bustbound is operated by Bustbound, who is responsible for the personal information described in this policy.

Contact: contact@bustbound.com

1. Information We Collect

We collect only the information needed to operate the game and its multiplayer features.

Discord Activity Players

When playing through Discord, we access:

• Your Discord user ID.
• Your Discord username or display name.
• Discord Activity instance information used to identify your game session.

Bustbound uses Discord's identify permission to authenticate players. Your verified Discord user ID is associated with a stable internal Bustbound profile, so it can be recognised between rooms and Activity sessions.

We do not request access to your messages, friends list, email address or Discord password.

Discord authentication tokens are used to authenticate your session. They are not stored as part of your saved game room data.

Browser Players

When playing through a normal web browser, we collect:

• The display name you choose.
• A stable internal player identifier used across multiplayer rooms.
• A cryptographically random guest credential stored locally in your browser, and a one-way hash of that credential stored on our server.
• Separate temporary session information needed to connect you to a multiplayer room.

A Discord account is not required for browser-based gameplay.

Gameplay Information

While you are playing, Bustbound stores information including:

• Room identifiers and player membership.
• Game scores, cards, turns and actions.
• Game progress and current game state.
• Connection status and relevant session timestamps.

This information allows multiplayer games to function and players to reconnect after temporary disconnections. Bustbound also creates a persistent player profile (internal player ID, display name, and provider identity) to recognise returning players. Completed games are recorded in the persistent database, including match dates, room codes, player display names, finishing positions, scores, winners, round outcomes and lifetime statistics (games, wins, rounds banked/busted and highest scores).

Technical Information

Our hosting provider, Cloudflare, may process technical information such as IP addresses, connection details and request metadata when delivering and protecting the service.

2. How We Use Your Information

We process this information to:

• Authenticate players connecting through Discord.
• Create and maintain multiplayer rooms.
• Display player names, cards, actions and scores.
• Allow players to reconnect to existing sessions.
• Recognise returning players across different rooms through persistent player profiles.
• Detect disconnections and manage inactive players.
• Maintain the security and reliability of the game.

We do not sell personal information, use Discord data for advertising or create advertising profiles.

3. Legal Basis for Processing

Where UK data protection law applies, we rely on:

Performance of a contract: Processing necessary to provide the multiplayer game and its features under our Terms of Service.

Legitimate interests: Processing reasonably necessary to maintain the security, reliability and proper operation of Bustbound, while considering players' rights and interests.

We may also process information where required to comply with applicable legal obligations.

4. How Information Is Stored

We use Cloudflare to host Bustbound, operate temporary multiplayer rooms, and store player profiles and completed-game records.

Temporary room information includes player names, room identifiers, session authentication hashes and game state. Our persistent records include internal player IDs, display names, verified Discord user IDs or hashed browser guest credentials, profile timestamps, completed-match results and lifetime statistics. The original guest credential is not stored on our servers.

Session tokens are randomly generated. The server stores a cryptographic hash of each session token rather than its original value.

Your browser uses sessionStorage to remember room information, player details and a room session token. This enables reconnection when a page is refreshed.

Browser guests also use localStorage to retain a separate random profile credential across browser sessions. Whoever has access to this credential can authenticate as that guest, so keep it private. Clearing this site's local storage or using another browser will normally result in a new guest profile.

Browser session storage normally lasts for the duration of the browser's page session, although behaviour can vary between browsers.

5. How Long We Keep Information

Bustbound uses both temporary multiplayer room sessions and persistent player identities. Room data has a short retention period; the profile used to identify a returning player is retained until the profile is deleted or a valid deletion request is fulfilled.

The following retention rules apply:

Lobby disconnections: Players disconnected while waiting in a lobby are normally removed after approximately 10 seconds.

Gameplay disconnections: Players who disconnect during or after gameplay may remain associated with the room for approximately 10 seconds to allow reconnection.

Leaving a room: When you leave or are removed, your active room membership is removed. Some information relating to your participation, including your name and game results, may remain in the stored game state until the room is deleted or the game state is replaced.

Empty rooms: Once a room has no remaining players, Bustbound retains its stored data for 24 hours before automatically deleting the room's storage.

Persistent player profiles and game history: A player ID, display name, linked Discord identity or hashed guest credential, lifetime statistics and completed-game history remain in our persistent storage between sessions until the profile is deleted or a valid deletion request is fulfilled. Deleting a profile removes its identity links and statistics and anonymises historical display-name snapshots. We may retain anonymised match results without a player identity. Existing temporary room information may remain until the room is cleaned up under the rules described above.

If players rejoin an empty room before it expires, the room may remain available and the expiration period is recalculated when it next becomes empty.

Rooms that continue to have players may retain their gameplay information for longer.

Technical information processed by Cloudflare may be subject to separate security and operational retention arrangements.

6. Sharing Information

Other players in the same game can see gameplay information such as player names, cards, actions and scores.

We use the following external services:

Discord: Provides authentication and Activity integration for players using Bustbound through Discord.

Discord's Privacy Policy: https://discord.com/privacy

Cloudflare: Provides hosting, multiplayer infrastructure, data storage and network security.

Cloudflare's Privacy Policy: https://www.cloudflare.com/privacypolicy/

We do not sell or disclose personal information to advertising networks or data brokers.

7. International Processing

Cloudflare and Discord operate internationally, and personal information may be processed outside the United Kingdom.

Where international transfers are subject to data protection requirements, appropriate legal safeguards must be applied.

8. Cookies and Local Storage

Bustbound uses browser session storage to maintain multiplayer rooms and local storage to recognise returning browser guests. The guest credential is used for authentication rather than tracking activity across unrelated websites.

The current game does not intentionally use advertising or analytics tracking cookies.

Third-party platforms and hosting providers may use their own technologies as described in their respective privacy policies.

9. Data Deletion and Your Rights

Depending on applicable law, you may have rights to:

• Request access to personal information held about you.
• Request correction of inaccurate information.
• Request deletion of your personal information.
• Request restrictions on certain processing.
• Object to processing based on legitimate interests.
• Request data portability where applicable.

You can leave a multiplayer room using the game's controls. Leaving removes your active room membership, but may not immediately erase all associated game data.

Browser guests can delete their saved player profile by opening My Stats and choosing Delete saved guest profile under guest profile management (after leaving any active room). This removes the associated profile record from our persistent database and clears its credential from that browser after confirmation. Other browsers with a copy of the credential will not be cleared automatically.

Discord players can request deletion by contacting the address below. Deletion requires verification of the associated Discord identity. Deletion of a profile does not immediately delete any active room state, which remains subject to the room retention rules above.

To request deletion of your information or exercise another privacy right, contact:

contact@bustbound.com

Please include enough information to help identify the relevant session, such as your Discord user ID or room code. Do not send passwords or session tokens.

We may request additional information to verify your identity and will respond in accordance with applicable data protection requirements.

If you are in the United Kingdom, you also have the right to complain to the Information Commissioner's Office:

https://ico.org.uk

10. Children's Privacy

Bustbound is not intended for children under 13 or below the applicable minimum age in their country.

We do not knowingly collect personal information from children who are not old enough to use the service.

If we discover that information has been collected from an ineligible child, we will take appropriate steps to delete it.

11. Security

We use reasonable technical measures intended to protect player information, including secure connections, authenticated sessions and hashed session credentials.

No system can guarantee complete security, but we aim to minimise the information collected and retained.

12. Changes to This Policy

We may update this Privacy Policy when the game, its infrastructure or relevant legal requirements change.

The latest version will be available on our website with an updated revision date. We will provide additional notice of material changes where required.

13. Contact

For privacy enquiries, data access requests or deletion requests:

Bustbound

contact@bustbound.com