Privacy Policy
Last updated 4 November 2026
Bump Arena is an online multiplayer game for iPhone and Android phones. This policy explains what data the game handles, why, and what you can do about it. The game is run by BNVLR Studios ("we"), which is the controller of your personal data. BNVLR Studios is the trade name of Selahattin Erkan Çelen, registered with the Dutch Chamber of Commerce (KVK) under number 42201809, at Elckerlijcstraat 32-1, 1055 AN Amsterdam, the Netherlands. Contact us at contact@bnvlr.com.
In short: the game creates an anonymous account for you, you choose a handle, and you can delete it all from the app at any time. If you're signed in to Game Center on iPhone or Google Play Games on Android, your progress comes back when you reinstall the game or move to a new phone. We don't sell data. The only ads are optional reward videos you choose to watch. On iPhone, your phone asks you whether those ads may use your advertising identifier. In the EEA, the UK and Switzerland the game sends no usage stats unless you agree.
What we handle
| Data | Why | How long |
|---|---|---|
| Account: a random account ID created on first launch. If you're signed in to Game Center on your iPhone, also your Game Center player ID for our games, which Apple confirms to our server. On Android, if you're signed in to Google Play Games, also your Play Games player ID for our games, which Google confirms to our server. If you used Sign in with Apple in an earlier version of the app, the identifier Apple gave us for your Apple ID. We don't ask for your name or email. | To keep your handle, stats and progress, and to give them back to you after a reinstall or on a new phone, without a sign-in screen. | Until you delete your account. |
| Handle and ball look you choose | Your handle is shown to other players and is unique. Your look is shown in matches and kept with your account. | Until you change them or delete your account. |
| Match results: which matches you played, when, in which arena, and your finishing place | To show your stats, your rating and the season leaderboards. | Until you delete your account. |
| Country: a new account starts with your phone's region; you can change it or set it to None in Profile → Country | For the country leaderboard. Your flag is shown to other players on the leaderboards unless you turn off "Show my flag on leaderboards" in Profile; hidden flags don't appear on country boards. | Until you change it or delete your account. |
| Progress and purchases: XP, coins, diamonds, items you own, and for each purchase its store transaction number (Apple's transaction number, or Google Play's order number and purchase token), product, date and whether it was refunded | To keep what you earned and bought, and to make sure each purchase is paid out once (and taken back if refunded). | Progress until you delete your account. Purchase records are kept for our accounts as the law requires, no longer linked to you after deletion. |
| Friends, blocks and reports you make, and the handles involved | To show your friends and their status, let you invite them, and keep the game safe. | Until you remove them or delete your account. |
| Push notification token (only if you allow notifications) | To tell you about friend requests and invites. Nothing promotional. Notifications are delivered by Apple on iPhone and by Firebase Cloud Messaging (Google) on Android. | Until you turn notifications off or delete your account. |
| Reward ads (only when you tap to watch one): your account ID and what the reward is for are passed to Google AdMob, which tells our server the ad was watched. Google also receives your IP address, device model and system, and how you interact with the ad. | To pay the reward, and for Google to show and measure the ad. In the EU, the UK and Switzerland, Google's consent form asks for your choices first; you can change them any time in Settings → Privacy choices for ads. | Reward records until you delete your account. Google keeps ad data under its own policy. |
| Advertising identifier on iPhone (only if you allow it): after your third match, your iPhone asks "Allow to track your activity across other companies' apps and websites?" with our reason, "This lets us show you ads that suit you better." | If you tap Allow, Google AdMob may use your iPhone's advertising identifier to show you reward ads that suit you better. If you tap Ask App Not to Track, it is not shared and the ads are not personalised with it. You can change this any time in your iPhone's Settings → Privacy & Security → Tracking. | Under Google's policy. We don't store it. |
| Advertising ID on Android | Google AdMob may use your phone's advertising ID and app set ID to show and measure the reward ads and to prevent fraud, and to show you ads that suit you better unless you said no in Google's consent form (in the EEA, the UK and Switzerland, ads are only personalised if you agree there). You can delete or reset your advertising ID any time in your phone's settings (on most phones Settings → Privacy → Ads, or Settings → Google → Ads). | Under Google's policy. We don't store it. |
| Nickname (only if accounts are unavailable, or on older app versions) | Shown to the other players in your match. | Only for the match. |
| Joystick input and match events | To run the match on our server and show it to everyone in it. | Not stored after the match. |
| IP address and connection logs | Needed to connect you to the server; logs help us fix problems and stop abuse. | Server logs are kept for up to 30 days. |
| Usage stats: which screens are opened, when matches start and end and how they went, sessions and their length, coins and diamonds earned and spent, items bought, ads watched, purchases (product and price), app version, system version, device model and country | To see which parts of the game are used, how the game's economy works and where it can improve. Sent to TelemetryDeck and GameAnalytics. TelemetryDeck sees your install only as a one-way hash. GameAnalytics sees a random ID: on iPhone the one iPhone gives each app maker, on Android one created for your install. It never gets your advertising identifier. Neither gets your name, handle or account ID. In the EEA, the UK and Switzerland, the game asks first ("Help us improve Bump Arena?") and sends nothing unless you tap Share. Everywhere, you can turn both off any time in Settings → Share usage stats. | TelemetryDeck: up to 2 years, as aggregate statistics. GameAnalytics: as long as it needs to provide the statistics, under its own policy. |
| Crash reports: what the app was doing when it crashed or failed, device model, system version, app version and a random installation ID. No account ID, handle, screenshots or logs. | To find and fix bugs. Sent to Firebase Crashlytics. In the EEA, the UK and Switzerland, only after you tap Share on "Help us improve Bump Arena?". Everywhere, you can turn them off any time in Settings → Share usage stats. | 90 days. |
Your settings (sounds, haptics, animations, favourite arena) stay on your phone.
Deleting your account
In the app, open your profile and tap Delete account. Your account, handle, look, match results, progress and the link to your Game Center or Google Play Games player are deleted straight away. Backups containing them are overwritten within 30 days. If you used Sign in with Apple in an earlier version, you can also remove the game from your Apple ID in your iPhone's Settings → your name → Sign-In & Security → Sign in with Apple. If you no longer have the game, email contact@bnvlr.com with your handle and ask us to delete your Bump Arena account; we delete it within one month, the same way.
Legal basis
Running matches, your account, handle, stats, progress, purchases and restoring them through Game Center or Google Play Games are necessary to provide the game you asked for. Server logs are based on our legitimate interest in keeping the game working and fair. Usage stats and crash reports are based on your consent in the EEA, the UK and Switzerland, where the game asks before sending any; elsewhere on our legitimate interest in improving the game. You can switch both off in Settings. Personalised ads, the use of your advertising identifier and, where the law requires it, storing or reading information on your device for ads are based on your consent, which you can withdraw at any time.
Who processes data for us
- Fly.io hosts the game server, in Frankfurt, Germany.
- Supabase stores accounts and game data, in Frankfurt, Germany.
- GitHub stores encrypted nightly backups of that database.
- Firebase Crashlytics (Google Ireland Limited, and Google LLC in the United States) receives crash reports. See Firebase's privacy information.
- Sentry receives crash and error reports from earlier versions of the app.
- TelemetryDeck (Germany) receives usage stats.
- GameAnalytics (GameAnalytics ApS, Denmark) receives usage stats. See GameAnalytics' privacy notice.
- Google AdMob (Google Ireland Limited, and Google LLC in the United States) shows the optional reward ads and the consent form. See how Google uses data from apps that use its services.
- Apple distributes the iPhone app, handles payments for diamonds, runs Game Center and delivers notifications on iPhone. Apple's own privacy policy covers these.
- Google distributes the Android app through Google Play, handles payments for diamonds there, runs Google Play Games and delivers notifications on Android (Firebase Cloud Messaging). Google's own privacy policy covers these.
Where a provider is based outside the EU, transfers are covered by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
What we don't do
- No selling of personal data, and no ads you didn't choose to watch.
- No tracking across other companies' apps or websites, except for the reward ads: on iPhone only if you allow it when your phone asks, on Android unless you delete your advertising ID in your phone's settings.
- No name, email, precise location, contacts, photos or microphone.
Age
Bump Arena is for players aged 13 and over and is not made for children. In some countries, including the Netherlands, people under 16 need a parent's permission before agreeing to personalised ads or to sharing play stats; if that applies to you, ask a parent before you agree, or choose not to. If you believe a child under 13 has used the game and data was collected, contact us and we will delete it.
Your rights
Depending on where you live, you have the right to ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it (including processing based on legitimate interest), and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time in the game's Settings, under Privacy choices for ads or Share usage stats; this does not affect what happened before. Write to contact@bnvlr.com. We answer within one month. You can also complain to a data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens; in another EU country, your local authority; in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner.
Changes
When the game gains new features that handle other data, this policy will be updated before they launch, and the date above will change.