Privacy Policy

Last updated: October 12, 2026

This policy describes how Bopfun (Tiny Arcade) at bopfun.com handles information when you play, use player features, or choose to sign in. For privacy questions or data requests, contact nsstream.lab@gmail.com.

Player information and game records

When player services are available, the site creates a guest account with a generated player identifier and display name. If you sign in with Google, GitHub, or Facebook, we receive your provider identifier, name, and, when available, email address, email verification information, and profile image URL. We use this information to identify your account and make your game history available across devices. You can use My Account to explicitly link additional provider accounts to the same player profile and history. A matching email address alone does not merge separate provider identities.

Google sign-in requests basic profile and identity information using the openid, email, and profile permissions. It does not request access to your Gmail messages. GitHub and Facebook sign-in request the basic profile and email information needed for their respective sign-in flows. Provider access tokens are used during sign-in and are not stored in the application's database or sent to our browser client.

We store game identifiers and settings, scores, active play time, progress or recovery checkpoints where supported, results, and timestamps to provide game history, supported recovery, and leaderboards. Public leaderboards display your player name and game results, including scores and play time; they do not display your email address or provider identifier.

Cookies and browser storage

We use first-party cookies to identify your current player session and protect provider sign-in. Session cookies expire after 30 days; sign-in flow cookies expire after 10 minutes. On HTTPS these cookies are Secure and HttpOnly. The server stores hashed session tokens and checks their expiry.

Browser local storage keeps preferences such as appearance and sound, favorites, local best scores, supported game saves, and references to active cloud game records. Local storage has no common automatic expiry and can be cleared through your browser's site-data settings. Clearing site data or signing out does not delete records stored on the server. Losing a guest session can prevent access to that guest's history and any purchases.

Hosting and other services

The application is hosted on Railway and uses MySQL to store player records. Hosting services process the network requests needed to operate the site and may maintain their own technical logs. The application uses request network information for rate limiting.

The arcade loads fonts from Google Fonts. If your account has a provider profile image, your browser requests that image directly from its image host. These services receive the corresponding network requests, including technical information such as your IP address. Profile image requests are configured without a referrer header.

If paid game recovery is offered, checkout takes place on Stripe's hosted checkout page. The application stores order details, amounts, currency, status, and Stripe payment identifiers, and sends related order and game identifiers to Stripe. It does not receive or store your card number or card security code. Sign-in and payment providers also handle information under their own policies.

Retention and your choices

Account and game-history records have no automatic expiry and remain stored until removed. Expired authentication sessions and sign-in flows are rejected and periodically cleaned up. Payment-related records, hosting logs, and backups may require separate handling when data is removed; clearing cookies does not remove those records.

You can edit your display name in the player profile and choose whether to use provider sign-in. To request access, correction, or deletion of your account information, email nsstream.lab@gmail.com. The site operator handles requests manually and may need to verify that the account belongs to you. See the data deletion instructions for details. Any applicable limits on deletion or retained records will need to be addressed when your request is reviewed.

We will update this page when the site's information handling changes. The date above identifies the latest update.