Privacy Policy

1. Introduction

Welcome to bashbots ("Service", "we", "us", or "our"), operated by Hello Yuna LLC, a Texas limited liability company. We are committed to protecting your privacy and personal information.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service at https://bashbots.io. By using the Service, you agree to the collection and use of information in accordance with this policy. Signing up or signing in, including with Google, through a form that links to this Privacy Policy counts as your acceptance of it.

2. Information We Collect

2.1 Information You Provide

We collect information that you provide directly to us, including:

• Account Information: Username, email address, first and last name, and password when you create an account with an email address. If you create your account by signing in with Google, we receive your email address, name, and Google account identifier from Google in place of a password, and base your username, which you can change in your account settings, on the part of your email address before the @. We also collect any referral code you use to register
• Account Security Information: If you set up two-factor authentication, your authenticator secret (stored encrypted), when you turned it on, and when you last used a code. If you generate backup codes, a secure hash of each code and when it was used
• Bot Information: The names, avatars, and appearances you choose for your bots
• User Content: Bot code, packages, pull requests, readmes, machine learning model configurations, and any other content you create or submit
• Payment Information: Billing details processed through our payment processor (Stripe), including the billing address used to calculate tax, and the details of any Pro membership, such as your plan, billing interval, status, and renewal and end dates. We do not store full payment card numbers on our servers
• Communications: Messages you send to us, including support cases and feedback

2.2 Gameplay Information

Because bashbots is a competitive game, we record information about your play:

• Bash Records: Participants, results, statistics, and full replay recordings of each bash. Replay recordings are kept for 12 months after the bash. The other bash records are not deleted on this schedule
• Competitive Data: Rankings, ratings, tournament and root histories, achievements, daily challenge results, and upgrade and loadout selections
• Execution Data: Logs, errors, and resource usage produced when your bots and models run, the training data your bots record for your models, and the models trained from it. The logs your bots produce in a bash are kept for 30 days after the bash
• Economy Data: Balances and a ledger of AI Balance, Game Credits, and Points transactions

2.3 Information Collected Automatically

When you access or use our Service, we automatically collect certain information:

• Usage Data: Records of the actions you take in the Service, such as the bots you edit, the bashes you run, and your purchases, and when you were last active
• AI Usage Data: Input and output token counts, broken down by the agent that made each call, related metering data for AI calls made by your bots, and the prompts your bots send and the responses they receive
• API Access Data: The name and a short hint of each API key you create, the name and redirect address of each MCP client you connect, when each key or client was created and last used, and when your code was last changed through the API or MCP. The full key is shown to you once, and we store only a secure hash of it and of each token issued to a connected client
• IP Address and Sign-in Records: Your IP address, which we use to enforce rate limits. Each password sign-in, password confirmation, and backup code attempt is recorded with the email address used, whether it succeeded, the time, and your IP address
• Server Logs: Our hosting provider's standard request logs record requests to the Service, including the address requested, the referring page, your IP address, and your browser's user agent. Our application logs record events such as errors and security events, some of which identify your account or include your IP address. These logs are kept for 30 days
• Cookies and Browser Storage: We keep your sign-in session in a secure, HttpOnly cookie, and your interface preferences in your browser's local storage and, while you are signed in, in your account

We use only strictly necessary cookies, described in Section 9, and we do not use any third-party analytics or advertising trackers. Usage data is derived from your interactions with our own API, not from a tracking script.

2.4 Information from Third Parties

If you choose to sign in with Google, we receive your email address, whether Google has verified it, your name, a link to your profile picture, and your Google account identifier, in accordance with Google's privacy policy and your privacy settings. We keep your email address, your first and last name, and your Google account identifier.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Create and manage your account
• Execute your bots, simulations, and model training runs
• Record, store, and play back bashes
• Calculate rankings, ratings, rewards, and competitive outcomes
• Route AI model calls made by your bots and meter the resulting token usage
• Process payments and manage balances, Pro memberships, and billing
• Confirm your email address and send password reset links
• Provide backup codes for account recovery
• Email you about security events on your account
• Respond to your support cases, questions, and feedback
• Analyze usage patterns to improve game balance and user experience
• Detect, investigate, and prevent cheating, multi-accounting, abuse, fraud, and security threats
• Comply with legal obligations and enforce our Terms of Service

Note: We do not send marketing emails. We email only about your account and its security. The email confirmation and password reset links go to the address on your account, and completing a password reset confirms that address. Every other email goes only to a confirmed address: password changes, two-factor authentication being enabled or disabled, backup codes being generated or used, blocked sign-in attempts, and account deletion. Security emails contain no action links, only a link to bashbots.io. Our payment processor, Stripe, may email you receipts and invoices for purchases and Pro membership renewals.

4. Information That Is Public

bashbots is a multiplayer game, and some information is public by design. The following may be visible to other users and to visitors without an account:

• Your username, bot names, avatars, and appearances, and the upgrades equipped on your bots' published versions
• Your rankings, ratings, statistics, achievements, and tournament and root participation, including public tournaments you create
• Bash results and full replay recordings showing the behavior of your bots during a bash, other than your simulations
• The shape of your bots' published code, with every character except whitespace masked, and, only where you choose to make a bot's kernel public, its kernel source in every version of that bot you have published
• Packages you publish, their source (where you make it visible), readmes, and versions
• Pull requests you open against other users' public packages, and comments you post on pull requests to public packages
• Custom boards and bot lists you publish

Do not include personal information, credentials, or anything you wish to keep private in usernames, bot names, package content, or code you publish.

5. How We Share Your Information

We will never sell your personal data or information to anyone. Ever. This is our commitment to you.

We may share your information in the following circumstances:

5.1 Infrastructure and Cloud Providers

We use third-party cloud infrastructure to host the Service, execute your code, and store data including bash recordings. These providers process data on our behalf under their own security and privacy commitments.

Our staff may also use AI assistants, such as Anthropic's Claude, connected to the Service to review information needed to operate it and to answer support cases, including support case messages, your name and username, the code of your bots and packages, and bash and simulation records and logs. The providers of these assistants receive that information under their own terms, and we do not allow them to use it to train their models.

5.2 AI Model Provider

When your bots call AI models during play, the content they send, including any prompt text and game state your bot code chooses to include, is transmitted to Google Cloud's Gemini Enterprise Agent Platform (formerly Vertex AI) to generate a response. Every model offered through the Service is served through that platform.

We do not train AI models on your data, other than the models you choose to train through the Service, and we do not authorize our provider to use that content to train their models. According to Google's current policies, content submitted through their API is not used to train their models. Google's handling of that content is governed by their own terms, including their Cloud Data Processing Addendum at https://cloud.google.com/terms/data-processing-addendum and their Service Specific Terms at https://cloud.google.com/terms/service-terms.

5.3 Payment Processors

We use Stripe to process payments, including recurring Pro membership payments, tax calculation, and the billing portal where you update your payment method and view invoices. When you create an account, we create a customer record for you at Stripe, which receives your email address, name, and account ID. Your payment information is transmitted directly to Stripe and is not stored on our servers. Stripe's privacy policy is available at https://stripe.com/privacy.

5.4 Authentication Providers

If you sign in with Google, Google receives the fact that you authenticated with us, and we receive basic profile information from Google. You can learn more about Google's privacy practices at https://policies.google.com/privacy.

5.5 Email Delivery

We use Mailjet to deliver the account and security emails described in Section 3. Mailjet receives your email address and the content of those emails in order to deliver them. Opening one of our emails loads its fonts from Google Fonts and its images from bashbots.io, which reveals your IP address to those servers. Mailjet's privacy notice is available at https://www.mailjet.com/legal/privacy-policy/.

5.6 Other Users

Information described in Section 4 is shared with other users, and with visitors without an account, as an inherent part of multiplayer competition.

5.7 Legal Compliance

We may disclose your information if required to do so by law or in response to valid requests by public authorities (for example, court orders, subpoenas, or government agencies).

5.8 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

5.9 With Your Consent

We may share your information with third parties when you give us explicit consent to do so.

6. Data Storage and Security

6.1 Data Storage

A small amount of data is held in your own browser so that you can stay signed in and keep your interface preferences. The rest of the data we store, including your account information, User Content, gameplay records, and economy ledgers, is stored on infrastructure we control, hosted in the United States. The providers described in Section 5 hold the information we share with them on their own infrastructure, and Mailjet stores it in the European Union. AI model requests made by your bots may be processed in other regions, as described in Section 11, and public bash recordings may be cached by our hosting provider's content delivery network in other regions.

6.2 Security Measures

We implement reasonable technical and organizational security measures to protect your information from unauthorized access, disclosure, alteration, or destruction. These include encryption of data in transit, industry-standard credential handling, isolated execution of user-submitted code, internal access controls, and ongoing maintenance of our systems. We do not publish the specifics of our security architecture.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Data Retention and Deletion

7.1 Active Accounts

We retain your information for as long as your account is active and as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

Some gameplay data is deleted on a schedule while your account is active: bash replay recordings 12 months after the bash, and the logs your bots produce in a bash 30 days after the bash. Results, rankings, ratings, statistics, and achievements are not deleted on this schedule. Section 7.2 describes what is kept when an account is deleted.

7.2 Account Deletion

When you delete your account through your account settings:

• Immediate Closure: Your account is closed, your active sessions are revoked, and you lose access to your account and everything in it
• Removal of Personal Information: Within 90 days, we remove the personal information held on your account, including your email address, your name, your credentials, and your stored interface settings
• Username: Your username is retained permanently and is not reissued, so that competitive records remain attributable. It is a pseudonym rather than anonymous data, so if your username identifies you, that association persists
• Other Records and Content: Apart from the personal information described above, we may retain anything else associated with your account, including your bots and their code, your competitive records, and content you created, published, or submitted. Anything that was visible to others, such as your bots, which remain listed and ranked, may remain visible. Closing your account does not withdraw any of it
• New Accounts: If you create a new account with the same email address, it will be a completely new account with no access to your old data
• Legal Retention: Some limited information may be retained as required by law or for legitimate business purposes, such as payment records for tax compliance, fraud prevention, or resolving disputes

8. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information:

8.1 Access and Portability

You have the right to request a copy of your personal information. Open a support case from within the Service, or email support@bashbots.io, to request a data export in a commonly used, machine-readable format.

8.2 Correction

You can update your username, your name, and, if you sign in with a password, your password at any time through your account settings. Your email address cannot be changed through your account settings.

8.3 Deletion

You can delete your account at any time through your account settings. You may also open a support case to request deletion of specific information. Note that your username is retained, and other records and content may be retained, as described in Section 7.2, even after your account is closed.

8.4 Browser Storage

You can clear your browser's cookies and local storage at any time through your browser settings. Clearing cookies signs you out. While you are signed in, your interface preferences are also saved to your account, so clearing local storage does not reset them.

8.5 GDPR Rights (European Users)

If you are in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time

8.6 CCPA Rights (California Users)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including:

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt out of the sale of personal information
• Right to deletion of personal information
• Right to non-discrimination for exercising your rights

Note: We do not sell your personal information to third parties.

9. Cookies and Tracking Technologies

We use only strictly necessary cookies.

We do not use tracking pixels, advertising networks, or third-party analytics scripts, and we do not track you across other websites. The Service has no cross-site tracking to opt out of.

Every page loads its fonts from Google Fonts, which receives your IP address. The Google sign-in button loads Google's sign-in script, and payment forms load Stripe's payment script, which may set its own cookies to process payments and prevent fraud. Each is governed by that provider's privacy policy, described in Section 5.

9.1 Essential Browser Storage

The only data we keep in your browser is your sign-in session, held in a secure, HttpOnly cookie; a short-lived cookie that ties an MCP client authorization to the browser that started it; and your interface preferences and cached Service data, held in local and session storage. All are required for sign-in and basic Service functionality, and none is transmitted to any third party.

9.2 If This Changes

If we later introduce analytics or any other tracking technology, we will update this Privacy Policy with a new "Last Updated" date before doing so, and will obtain consent where the law requires it.

10. Children's Privacy

The Service is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us at support@bashbots.io, and we will close the associated account and remove its personal information as described in Section 7.2.

Users between 13 and 18 should use the Service only with the involvement of a parent or guardian, and should not make purchases without their permission.

We do not ask for your date of birth and we do not otherwise collect age information. We rely on the age requirement stated here and in our Terms of Service rather than collecting additional personal data from users who may be minors.

11. International Data Transfers

Your information may be transferred to and maintained on servers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ from those in your jurisdiction.

If you are located outside the United States and choose to provide information to us, please note that we transfer data, including personal data, to the United States and process it there. By using the Service, you consent to this transfer and processing.

Separately, AI model requests made by your bots are routed to our provider's infrastructure, which may serve them from data centers in regions other than the United States. We do not control which region serves a given request.

12. Third-Party Links and Services

Our Service may contain links to third-party websites or services that are not owned or controlled by us, and may allow you to install packages published by other users. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party service you access through our Service.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. If we make material changes, we will notify you by:

• Posting the updated Privacy Policy with a new "Last Updated" date
• Displaying a prominent in-app notification within the Service

Note: We do not announce changes to this Privacy Policy by email. It is your responsibility to review this Privacy Policy periodically for changes.

Your continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, and you have an account, the fastest way to reach us is to open a support case from within the Service. You can also contact us directly: