Privacy policy

Who we are and scope

Browser Boxing is an independently operated browser game available at browserboxing.com. In this Policy, “Browser Boxing,” “we,” “us,” and “our” mean the operator of the Browser Boxing website, game, account services, matchmaking, realtime fights, spectator features, and related services (collectively, the “Service”). Browser Boxing is the controller of personal information described in this Policy.

This Policy applies when you visit or use the Service as a guest, account holder, player, or spectator. It does not apply to a third-party service governed by its own privacy terms.

Information we collect

• Account information: public handle, email address, boxer name, password hash, email-verification state, account status, account creation and update times, and requests to change or recover an account. We do not store your password in readable form. If you choose Google sign-in, we receive your Google account identifier, email address, and email-verification information. We store that identifier to recognize your account. You still choose your public handle and boxer name; we do not use your Google name or photo for your public profile.
• Guest and boxer information: guest and session identifiers, boxer name, appearance, build and stats, Career XP and level, fight record, rating, placement status, and belt history. A guest appearance is also saved in your browser's local storage so it remains available in that browser.
• Gameplay information: matchmaking and queue activity, accepted fight inputs, timing and connection events, participants, replays, results, round statistics, scorecards, progression and rating changes, and spectator activity needed to provide a live fight. For eligible completed fights, we may generate a written summary, matchup cover, and fight highlight reel.
• Lobby chat information: the masked public message, sending user and boxer ownership, the boxer name and optional account handle shown with the message, a client message identifier used to prevent duplicates, and the time the message was sent.
• Direct messages and messaging controls: message text, sender and recipient accounts, send times and duplicate-prevention identifiers, read and cleared-history positions, block and mute state, and notification preferences. Abuse reports contain the selected message as evidence, the reporting and sending accounts, report reason, report time, and staff decisions, including the reviewing staff account and time.
• Device notifications: if you enable them, we store the browser's push subscription address and encryption keys, its association with your account and login session, and delivery receipts, retry counts, and expiration times.
• Device, session, and security information: the Browser Boxing session cookie, browser user-agent, session creation, last-use, expiration and revocation times, protected token hashes, and protected network-address or request identifiers used for security and rate limiting. When a guest session or account first provides a supported approximate country from network location, we store that country with the player identity. Account holders can replace it with a country they select in account settings. Infrastructure providers may process IP addresses, request headers, and diagnostic or access logs when delivering and protecting the Service.
• Communications and issue reports: the destination email address and transactional message details needed to send verification, password-recovery, and account security messages, plus information you send when contacting us. If you use the in-game report form, we collect the category, description, expected behavior, current page, app version, browser details, public handle when available, and any optional screenshot you choose to attach.

We collect information directly from you, automatically from your browser and use of the Service, from other players' interactions with you, and from the infrastructure and email providers that help operate the Service.

How and why we use information

• Provide guest play, accounts, boxer customization, matchmaking, fights, spectators, public records, the leaderboard, direct messaging, notifications, and account communications.
• Authenticate sessions, recover accounts, maintain fight continuity, verify official results, and resolve gameplay or account disputes.
• Detect cheating, fraud, abuse, security incidents, service failures, and violations of the Terms.
• Debug, maintain, secure, and improve the Service and understand aggregate Service performance.
• Enforce our agreements, protect players and the Service, comply with law, and establish or defend legal claims.

Where applicable law requires a legal basis, we process information to perform our agreement with you; for our legitimate interests in operating, securing, improving, and protecting the Service; to comply with legal obligations; with consent when we specifically request it; and to protect vital interests in an emergency. Automated matchmaking, scoring, rating, and moderation-support systems affect only access to and records within the game; they do not make decisions with legal or similarly significant effects.

Information visible to others

The Service is multiplayer and maintains public game records. An eligible account profile may display your handle, boxer name and appearance, permanent build, Career facts, placed rating, record, belt state, and published fight history. Published fight pages may display participant snapshots, results, replays or event timelines, scorecards, statistics, and progression, rating, or belt effects. Other players and spectators can also see information needed to present a live matchup. A country flag based on the stored approximate country or an account holder's selection appears with the boxer in the lobby, live fights, and fight records. Each fight record retains the country shown for a participant when that fight began, even if the account holder later changes their selection. Unknown countries display a neutral question-mark placeholder, while NPCs have assigned country flags. Generated fight summaries, matchup covers, and highlight reels are public when available.

Choose a handle and boxer name you are comfortable making public. Do not use your legal name or other identifying information unless you want it associated with your public game activity. Email addresses, password hashes, session credentials, verification credentials, recovery credentials, and protected network identifiers are not public. Active non-test, non-staff account handles, profiles, and eligible fights, Ranked ratings, leaderboard positions, and belt competition are public even before email verification. Test, staff, disabled, and otherwise ineligible accounts are excluded from public profile search. Automated opponents may be used for matchmaking and showcase fights without being identified as automated in a particular matchup.

Lobby chat messages are public and appear with the sending boxer name, optional account handle, and local display time. Messages are automatically masked before storage and public delivery when recognized profanity, disguised profanity, or hateful language is detected. Automated masking may not identify every harmful or identifying statement, so do not include personal or private information in chat.

Private messages and moderation

Active registered players can send plain-text messages and fight links to one another. Direct messages are visible to their sender and recipient, not posted to public profiles or lobby chat. We store and process this content to deliver conversations and notifications and enforce message limits and blocks. Messages are not end-to-end encrypted. The other player can copy or share what you send. Email notifications are not enabled for direct messages. Blocking stops new messages and challenges; muting suppresses message unread alerts and device notifications from that player.

If you enable device notifications and grant browser permission, we send alerts for incoming direct messages and fight challenges, including when the site or installed web app is closed. Alerts use generic text without message contents or the sender's name. A notification includes a link to the relevant conversation or challenge, which may contain a public player handle or challenge identifier. Your saved notification categories also apply to device alerts.

If a recipient reports a message, staff can review that selected message, its report reason, and the reporting and sending accounts. The moderation screen does not provide arbitrary private-conversation browsing. Staff may dismiss reports or restrict messaging access and record their decision. Contact us at contact@browserboxing.com to appeal a restriction. Private message bodies and report evidence are not included in public fight-summary or release-note generation requests, analytics, or application diagnostic logs.

When we disclose information

We may disclose the categories described above:

• To hosting, content-delivery, security, database, realtime coordination, and transactional-email providers that process information to provide services to us, including Cloudflare and Amazon Web Services, to GitHub for private issue tracking, and to OpenAI to generate bounded fight summaries and public release-note rewrites. Fight-summary requests include public boxer names and canonical fight evidence. Release-note requests include reviewed public changelog headings and entries. Neither request includes emails, account identifiers, replay frames, credentials, or connection data.
• When you enable device notifications, your browser's push provider, such as Apple, Google, Mozilla, or Microsoft, processes subscription routing information, connection information, and encrypted notification payloads to deliver alerts. Your browser or operating system displays the alert according to your device settings.
• Google provides the sign-in button on account creation and sign-in pages and processes browser connection information to deliver it. When you choose Google sign-in, Google authenticates your identity and shares account information with us.
• To other players, spectators, and the public as described under “Information visible to others.”
• When reasonably necessary to comply with law or legal process, protect rights or safety, investigate abuse or fraud, or enforce our Terms.
• As part of a merger, financing, reorganization, sale, transfer, insolvency, or similar change involving the Service, subject to applicable legal protections.
• At your direction or with your consent.

We do not sell personal information, share it for cross-context behavioral advertising, or use third-party advertising cookies. We do not knowingly sell or share the personal information of anyone under 16.

Cookies, local storage, and tracking choices

Browser Boxing uses a necessary first-party session cookie named __Host-bb_session. It contains a random session token and is HTTP-only, SameSite=Lax, restricted to this site, and HTTPS-only in production. The server stores a protected hash of the token. The cookie and session can remain valid for up to 30 days unless revoked or replaced. Blocking it prevents guest, account, and online-play features from working.

Google sign-in also uses necessary first-party, HTTP-only cookies named __Host-bb_google_challenge and __Host-bb_google_registration for up to ten minutes. They protect the sign-in request and retain verified account information while you finish setup. They are restricted to this site and HTTPS-only in production, and are cleared when you sign out.

Completing the tutorial also sets a first-party cookie named browser-boxing-tutorial-complete to true for up to one year from the latest completion. It remembers completed practice in this browser. Guests also save the same completion flag in local storage until site data is cleared. Registered players save completion and its date to their account in our database. Tutorial completion is required before matchmaking and does not affect your fight record. The browser flag contains no player identifier and is not used for tracking. If both cookies and local storage are blocked, guests may need to repeat the tutorial after reloading the page.

Device notifications use a service worker and a push subscription stored by your browser. The notification worker does not cache pages or private messages. You can remove this browser data through its site-data controls; notification permission is managed separately in browser or device settings.

For guests, local storage keeps the boxer appearance selected in that browser. You can remove it by clearing site data in your browser. Browser Boxing does not use advertising or cross-site analytics technologies in this release, and other parties do not collect information through the Service to track your activity over time and across unrelated websites. Because we do not perform that tracking, Global Privacy Control and “Do Not Track” signals do not change how this release operates.

International processing

Browser Boxing is operated from Illinois in the United States. If you use the Service elsewhere, your information will be transferred to and processed in the United States and may be processed where our service providers operate. Those locations may have privacy laws different from the laws where you live. Where required, we and our providers use legally recognized transfer safeguards. Contact us to request more information about safeguards applicable to your information.

Retention

We keep information for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining the integrity of public game records, securing accounts, resolving disputes, enforcing agreements, and meeting legal obligations. The current release applies these criteria:

• Realtime tickets, matchmaking state, presence, reconnect data, and security rate-limit records expire automatically, generally within seconds, minutes, or hours.
• Sessions stop authorizing access after 30 days or earlier revocation. Email-verification links stop working after 24 hours and password-reset links after one hour.
• Public lobby chat messages are retained for up to 30 days of recent history. Messages older than 30 days are excluded from subsequent public reads and deleted afterward.
• Direct messages are readable for 90 days from sending. Expired messages become unreadable and are deleted by periodic maintenance. Reported message evidence and staff decisions are retained for up to 180 days from reporting, independently of message deletion. A maintenance outage can delay physical deletion; expired content remains unavailable through the messaging and moderation screens.
• Block and mute settings, read positions, and notification preferences remain until changed or the account is deleted. Challenge notices expire with the relevant event and are then removed by maintenance.
• The tutorial completion cookie expires one year after the latest tutorial completion, or earlier if you clear this site’s cookies.
• Guest appearance data in local storage remains until it is replaced, cleared after account adoption, or removed through browser controls.
• A stored country remains with an active guest or account identity. Registering copies the guest country to the account and clears it from the adopted guest identity; account deletion clears the current user country.
• Guest identities, accounts, boxer progression, ratings, belt history, completed-fight records, participant country snapshots, and their generated summaries and highlight reels are durable game records and may be kept for the life of the Service unless deletion or de-identification is required by law.
• Security, diagnostic, support, and provider records are kept according to operational need and provider retention settings, then deleted or de-identified when no longer reasonably necessary.
• Player issue reports and private screenshots are kept while reasonably needed to investigate, resolve, and audit the reported problem, then deleted or de-identified when no longer needed.

A deletion request does not necessarily require deletion of information that must be retained for security, fraud prevention, legal compliance, exercise or defense of claims, or the integrity of completed public fights. Where appropriate, we may de-identify account information while retaining non-identifying fight records. Residual copies may remain temporarily in restricted backups until those backups are overwritten.

Push delivery receipts expire within one day, or sooner when the associated challenge expires, and are removed by routine cleanup. Device subscriptions remain until disabled, replaced, or retired after the login expires or is revoked, the account becomes inactive, or the push provider reports the subscription invalid.

Your rights and choices

Account controls allow you to change your country, email, or password, revoke individual or all browser sessions, and permanently delete your account after confirming the action with your current password. Account deletion erases private identity, credentials, and mutable boxer data, the current user country, and lobby chat messages attributed to the account or its adopted guest identity. It also erases direct messages involving the account, messaging settings and blocks, notifications, and reports filed by or about the account. A deleted staff account is detached from decisions about other players without automatically lifting their restrictions. Immutable public fight records retain the participant and country snapshots needed to preserve official results. Depending on where you live, you may also have rights to request access, correction, deletion, restriction, objection, or a portable copy; withdraw consent where processing relies on consent; and appeal our refusal of a request. You may also have the right to complain to your local privacy or data-protection authority.

You can delete a sent direct message for both participants or clear the conversation history visible to you. Clearing does not remove the other player's copy, and deleting a message does not remove evidence already submitted in an abuse report. A content-free message receipt remains until normal expiry to prevent duplicate sends and preserve rate limits. You can manage blocks, muting, and notification categories in Messages. You can also disable device notifications there or revoke permission in your browser or device settings. Signing out stops new notification dispatch for that login; an alert already accepted by the push provider may still arrive. Enable device notifications again if you want them after signing in again.

Submit a request to contact@browserboxing.com. Describe the request and the account email or public handle involved. To protect players, we may need to verify your control of the account or email before acting. An authorized agent may submit a request where applicable, but we may require proof of authority and direct identity verification. We will respond within the period required by applicable law. We will not discriminate against you for exercising a privacy right.

Because Browser Boxing does not sell personal information or share it for cross-context behavioral advertising, there is no sale or targeted-advertising opt-out needed for the practices described in this Policy.

Children's privacy

The Service is intended for people age 13 and older and is not directed to children under 13. Do not use the Service or provide information to us if you are under 13. We do not knowingly collect personal information from children under 13. A parent or guardian who believes a child under 13 has used the Service should contact us so we can investigate and delete or de-identify the information as required. Users who are not old enough to agree to the Terms where they live may use the Service only with a parent or legal guardian's permission.

Security

We use administrative, technical, and organizational measures designed to protect information, including password hashing, protected or opaque credentials, access and origin controls, rate limits, restricted account responses, and encrypted production transport. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. We will provide legally required notice if a qualifying data breach occurs.

Changes to this Policy

We may update this Policy to reflect changes to the Service, our practices, or the law. We will post the revised Policy here and change its effective date. If a change is material, we will provide additional notice reasonably suited to the change, such as a prominent notice in the Service or an account email. We will request consent before applying a materially different practice to previously collected information when law requires it.

Contact

Questions, privacy requests, and concerns may be sent to the operator of Browser Boxing at contact@browserboxing.com. Browser Boxing is operated from Illinois, United States.