Privacy

Bonfiro is a small, fan-made camp for daily puzzle games. It is run by one person, not a company. This page explains what we keep about you, who can see it, and what you can ask us to do with it. Questions go to contact@bonfiro.com.

What we keep

• Your account. Your email address and password (stored by our sign-in provider, never in plain text). If you sign in with Discord or Google, we get your name and email address from that account.
• Your profile. Username, display name, bio, avatar, cabin, language and notification settings. Avatars are re-saved as plain images, which removes hidden details such as location.
• Your play. Your results in each game: guesses, score, time, moves and hints, plus streaks, levels, medals, namecards and rewards. If you play without an account, your results are kept under a random ID stored in your browser, and move to your account when you sign in.
• What you post. Comments, guestbook notes, images and GIFs you attach, doodles, wishes, votes, reactions and reports.
• Bug reports. What you tell us, the page you were on, your browser type and language, and a screenshot if you add one.
• Visit statistics. If analytics is on for you (see below), Google Analytics counts which pages are visited.

We do not ask for your birthday, gender, real name or location. We do not save your IP address with your account; it is used briefly to stop floods of requests, and our hosting keeps short-lived request logs.

What other campers can see

Your profile page is public: username, display name, avatar, cabin, level, namecard, medals, join date, streak, the days you played, your best results and your recent doodles. You can hide your bio. Your results appear on public leaderboards with your username and avatar. Comments, guestbook notes, doodles and wishes are public.

Only you and the team can see your bug reports, your coins and rewards, and your notifications. Ratings are only shown as totals.

The team can see the email address of people who comment, so we can reach you about a post if we need to.

How we use it

To run your account and the games, to show leaderboards and profiles, to send you the emails you ask for (sign-up, password reset) and the notifications you switched on, to keep the camp safe (limits, reports, mutes), and to understand which games people play so we can improve them. We never sell your data and never use it for ads.

Services that help us

These services handle data for us, only to run Bonfiro:

• Supabase — accounts, sign-in and the database.
• Vercel — hosting the site, and the gateway we use to reach AI models.
• Cloudflare R2 — storing avatars, images, doodles and bug-report screenshots.
• Upstash — short-lived counters for limits.
• Resend — sending our emails.
• Google — Analytics (where allowed), Google sign-in if you use it, and the Gemini model, which checks each doodle for inappropriate content and for answers written into the drawing.
• OpenAI — the GPT model, which translates wishes, comments and guestbook notes so campers in other languages can read them, reached through our AI gateway (Vercel).
• Anthropic — the Claude model, a backup translator for wishes, comments and guestbook notes, reached through our AI gateway (Vercel).
• KLIPY — GIF search. When you pick a GIF, your browser loads it straight from KLIPY. Searches we pass on use a scrambled ID, never your account.
• Discord — sign-in, if you use it.

Some of these services are based outside your country, including in the United States.

Cookies and browser storage

We use cookies to keep you signed in and to remember your language. Your browser also keeps a random ID for playing without an account, your in-progress games and a few display choices.

Google Analytics sets its own cookies. In the EU, the EEA, the UK and Switzerland we ask first, and nothing is set until you choose Accept. You can change your answer any time from Cookie settings at the bottom of every page.

Shared with our other site

Bonfiro shares its accounts with an older puzzle site run by the same team. The same email and password work on both, and your profile, avatar and posts live in the same storage.

How long we keep it

We keep your account and what you post until you delete them or ask us to. You can delete your own comments at any time. Counters for limits expire within minutes. Analytics data is kept for 14 months.

Your choices

You can change your profile, hide your bio and delete your comments yourself. For anything else — a copy of your data, a correction, or deleting your account and everything tied to it — email contact@bonfiro.com from your account's address. We reply within 30 days. If you are in the EU or UK you may also complain to your local data protection authority.

Children

You must be 13 or older to make an account. If you are under 18, a parent or guardian should know you use Bonfiro. If you think a child under 13 has an account, tell us and we will delete it.

Changes

If we change this page in a way that matters, we will say so on the camp board before it takes effect.