---
title: "Privacy · OpenBoss"
description: "Exactly what OpenBoss stores, why, for how long and who else sees it. No email, no cookies until you buy, one cookieless page-view counter — and a display name that is public and, on a grave, permanent."
source_url: "https://openboss.lol/privacy"
markdown_url: "https://openboss.lol/privacy.md"
site: "OpenBoss"
mcp_endpoint: "https://api.openboss.lol/mcp"
---
# Privacy

> There are no accounts here, so there is not much to tell — but what there is,
> is written out in full. This describes what the site actually does, checked
> against the code that does it.

Last updated 22 August 2026.

## 01 — The short version

- **We never ask for your email**, and we never read the one Stripe collects to
  send your receipt.
- Page views are counted with **Vercel Web Analytics**, which sets no cookies
  and stores nothing on your device. It records which page was opened, roughly
  where in the world from, and what kind of browser — never your IP address, and
  never anything that could be tied back to you. There is still **no tag
  manager, no advertising pixel, no heatmap and no session recorder**. That is
  also why there is no cookie banner: consent is required for storing things on
  your device, and nothing here stores anything.
- The one thing you give us is a **display name**, and you give it to us in order
  to have it published. On a grave it is permanent.
- Your IP address is used to stop abuse and for nothing else. It sits in a
  counter that deletes itself — within a minute for most limits, within an hour
  for the one that bounds free smacks — and it is never stored beside a purchase.
- Because we cannot identify you, we **cannot get your smacks back** if you clear
  your browser. That is clause 08, and it is the real price of everything above
  it.

## 02 — Everything this site collects

Four things, and these are all of them.

### Your display name

- **What.** Whatever you type into the "Your name or @handle" box on Stripe's
  checkout page. It passes through a profanity and Unicode filter before it is
  stored, which can change or reject it.
- **Why.** It *is* the product. It appears in the live feed as you hit, on the
  damage leaderboard while the boss stands, and — if you land the killing blow —
  on that boss's grave. See clause 04.
- **Lawful basis.** Performance of a contract: we cannot deliver what you bought
  without publishing it. Keeping it on a grave afterwards rests on legitimate
  interests — a graveyard that forgets is not a record of anything.
- **Kept for.** In your wallet, 180 days from your last purchase or last paid
  smack. In the live feed, until 100 newer hits push it off that boss's list. On
  a leaderboard, for the life of that boss, then frozen with its grave. **On a
  grave, permanently.**

### Your IP address

- **What.** The address your request arrives from. We do not ask for it; every
  request on the internet has one.
- **Why.** Rate limiting, and nothing else. It is what stops one machine minting
  endless free smacks or hammering our payment endpoint. It is never attached to
  a purchase, a wallet, a display name or a hit.
- **Lawful basis.** Legitimate interests: keeping a small site standing up, and
  bounding what free play costs us.
- **Kept for.** The length of its own window and no longer — one minute for most
  limits, one hour for the free-smack limit. The counter holds timestamps and
  nothing else, and the database deletes it on its own. An IP also appears in a
  log line when a request is actually refused, and in the ordinary access log of
  the web server in front of the API; both are capped at three files of ten
  megabytes and roll over.

### A visitor id

- **What.** A random id your browser generates on its first visit and keeps in
  `localStorage`. It is not derived from anything about you, your device or
  your browser. It is not a fingerprint.
- **Why.** Two things, both of them mechanics you can see on the page. It counts
  your three free smacks, so that the fourth one asks you to pay. And for 60
  seconds after you hit, it is what makes you *one* of the players in momentum —
  the multiplier counts distinct hitters, so it has to be able to tell two people
  apart from one person hitting twice. A paid hit uses your wallet handle for
  that instead.
- **Lawful basis.** Legitimate interests, and strictly necessary for a feature
  you asked for by pressing the button. It is not used to build a profile, and it
  is not read outside those two counters — but it is fair to call it what it is:
  for a minute at a time, it is what distinguishes you from the next player.
- **Kept for.** 30 days on our side for the free-smack counter, then it expires.
  The momentum window holds it for 60 seconds and drops it. In your browser,
  until you clear your site data.

### Your wallet

- **What.** A signed handle stored in your browser that *is* your smacks.
  Against it we hold: how many smacks are left, your display name, which of our
  two sites it belongs to, when it was created, and the id of the Stripe session
  that funded it. No email, no card, no name but the one you chose.
- **Why.** There are no accounts and no passwords, so this handle is the only
  thing that knows which browser's smacks are which. It also stands in for you in
  the momentum window when you hit with a paid smack, the same way the visitor id
  does for a free one, and for the same 60 seconds.
- **Lawful basis.** Performance of a contract. The Stripe session id is
  additionally kept as the record of a sale.
- **Kept for.** 180 days from your last purchase or last paid smack — spending
  keeps it alive. The session id outlives it, at 720 days: it is the guard that
  stops one payment ever being credited twice when somebody reopens an old
  receipt.

## 03 — What we do not collect

This list carries as much weight as the one above it, so it was checked in the
code rather than assumed.

- **No email address.** Stripe collects one on its own checkout page, to send
  your receipt and to run its own fraud checks. We never ask for it, and our code
  deliberately never reads it back — a Stripe session id travels in browser
  history and in screenshots, and nobody holding that string should be able to
  turn it into somebody's email.
- **No card details, ever.** You are on a page hosted by Stripe when you type
  them. They never touch our servers.
- **One analytics tool, and it is cookieless.** Vercel Web Analytics counts page
  views. It sets no cookies, writes nothing to your device, and identifies a
  visit by a hash of the incoming request that is thrown away after 24 hours — so
  it cannot follow you here tomorrow, and cannot follow you off this site at all.
  It stores the page, an approximate location, and your browser and device type.
  It does not store your IP address. One thing worth saying plainly, because it
  is the part that could have gone wrong: the receipt page you land on after
  paying carries your Stripe session id in its address. We strip that out before
  the page view is sent, so your purchase id is never handed to an analytics
  provider. Still nothing else: no Google Analytics, no tag manager, no
  advertising pixel, no heatmap, no session recorder, no A/B tool.
- **No third-party assets.** The display typeface is downloaded when the site is
  built and served from our own domain, so your browser never calls Google for
  it. Loading a page here fetches from this site, our own API, and Vercel's
  analytics endpoint — and from nowhere else. Links you choose to press are the
  obvious exception: the share buttons hand you to whichever site you picked, and
  that site sees you arrive, the same as any link anywhere.
- No real name, address, phone number, date of birth, location, contacts, device
  fingerprint, or anything else not listed in clause 02. We buy no data about you
  from anybody, and there would be nothing to match it against if we did.

## 04 — Your display name is public, and on a grave it is permanent

This is the part people are most likely to be surprised by, so it gets its own
clause. The name you type at checkout is not a profile field. It is published —
in the feed while you hit, on the leaderboard while the boss lives, and on the
grave forever if yours is the last smack.

> Treat the box as a billboard. Do not put your real name in it unless you are
> content to see your real name on a public page indefinitely, and do not put an
> address, an email, a phone number, anything private, or anything about another
> person into it. An engraved name can be removed on request (clause 09) — but it
> will have been public in the meantime, and other people's screenshots and
> search-engine caches are not ours to erase.

## 05 — Cookies, and what sits in your browser

This site sets **no cookies at all** until you buy something.

- **One cookie**, and only after a purchase: `vm_credit_token`, set by our API
  when Stripe sends you back, lasting 30 days. It holds the same wallet handle
  that is already in your browser storage, as a second way of handing your own
  smacks back to you. It is read for nothing else, and it identifies a wallet
  rather than a person.
- **Browser storage**, on your device, sent nowhere except to our own API: your
  wallet handle, your last known balance, your display name, how many free smacks
  you have left, your visitor id, and whether you muted the sound.

Every item of it is yours to delete from your browser without asking us — which
is also the warning in clause 08.

## 06 — Who else sees any of this

Four companies, for four specific jobs, and nobody else.

- **Stripe** takes the payment, and collects your display name and an email on
  its own hosted page. Stripe's privacy policy governs everything that happens
  there: <https://stripe.com/privacy>.
- **Vercel** serves this website and keeps its own request logs for the pages it
  serves. Vercel also runs the page-view counter described in clause 03 — it
  receives the page you opened, an approximate location, and your browser and
  device type, with no cookie and no IP address stored.
  <https://vercel.com/legal/privacy-policy> and
  <https://vercel.com/docs/analytics/privacy-policy>.
- **BackupCity, Ljubljana, Slovenia** rents us the machine the game API and its database run
  on. They do not process any of it for purposes of their own.
- **Anthropic** names bosses. When a new one spawns we may ask a model to choose
  between the names our own generator produced and to write its lore. That
  request contains the boss's number, tier, silhouette, hit points and modifiers
  — **no user data of any kind**. If it fails, the boss keeps its procedural name
  and nobody notices.

Nothing is sold, rented, shared with advertisers or handed to data brokers. There
is no advertising on this site to sell it to. We would disclose something if a
court in Slovenia ordered us to, which has not happened.

Stripe and Vercel are US companies, so data reaches the United States. We rely on
the safeguards those two publish for their own services, and we have no separate
arrangement with either of them.

## 07 — Keeping it safe

Everything travels over HTTPS. Card details never reach us. Wallet handles are
cryptographically signed, so one cannot be guessed or edited into somebody else's
smacks, and the database holding them is not reachable from the internet.

We are not going to claim a certification we do not hold or an audit we have not
had. This is a small site run by a small operation, and the most useful thing it
does for your privacy is the thing in clause 03: it does not collect the data in
the first place.

## 08 — The other side of having no accounts

Not knowing who you are is what makes this page short. It is also what makes the
following true, and it is the single most important sentence here:

> If you clear your site data, use private browsing, switch browser or device, or
> your browser evicts its own storage, your unspent smacks are gone and **we
> cannot restore them**. Not because we will not — because there is no email, no
> password and no account to prove they were yours. A Stripe receipt shows that a
> payment happened; it cannot show us which browser the smacks belong to.

The same rule is in [the terms](/terms.md), clause 06. Buy on the browser you
actually intend to play on, and do not buy a large pack you plan to spend slowly.

## 09 — Your rights, and how to use them

You can ask for access to what we hold about you, correction of it, erasure of
it, restriction of how it is used, and a portable copy of it — and you can object
to any processing we do on the basis of legitimate interests. You can also
complain to a data protection authority: the one in Slovenia, or the one
where you live.

**Write to ziga@flisko.si** and a person will read it. Say plainly what you want
done.

> **One honest catch.** There is no account, so we cannot look you up by "you".
> To find anything, we need something we can search on: the **display name** you
> used, or the **Stripe session id** from the address bar of your receipt page.
> Without one of those we genuinely hold nothing we can identify as yours — which
> is a consequence of collecting almost nothing, not an excuse for ignoring you.

**Removing a name** replaces it with `[removed]` everywhere it appears: the
feed, the leaderboard, the grave. The boss, the damage and the grave itself stay,
because they record an event rather than a person. A removal is not a refund —
the smacks were delivered.

There is no automated decision-making here and no profiling of any kind. Nothing
on this site is aimed at children; if a name on it belongs to one, write to us and
it comes off.

## 10 — Who to write to

The controller of everything described above is Flisko — Informacijske storitve, Žiga Flis s.p., in
Slovenia. Every question, request and complaint goes to the same place:
ziga@flisko.si. [The contact page](/contact.md) says what to include and how long a
reply takes.

If this page changes, the date at the top changes with it, and the version
published here at the time is the one that applies.

---

Worth repeating, because the whole site rests on it: there are no prizes and no
payouts of any kind. You are buying swings at a piñata and the chance to have a
name carved on its grave. Nothing of value is ever won here — and nothing about
you is worth anything to us, because we did not collect it.

---

## This document

This is the `text/markdown` representation of a page on https://openboss.lol. Every HTML
page here has one: append `.md` to its path, or send
`Accept: text/markdown`. The HTML page is the canonical one and says the same
things.

- [`/index.md`](https://openboss.lol/index.md) — the arena: the boss up right now, live
- [`/about.md`](https://openboss.lol/about.md) — what this is, how it is built, who runs it
- [`/rules.md`](https://openboss.lol/rules.md) — the mechanics, generated from the shipped constants
- [`/pricing.md`](https://openboss.lol/pricing.md) — every pack price, live from the API, and the free smacks
- [`/terms.md`](https://openboss.lol/terms.md) — what you are buying; the authoritative document
- [`/privacy.md`](https://openboss.lol/privacy.md) — everything stored, why, and for how long
- [`/contact.md`](https://openboss.lol/contact.md) — one email address, and what to put in it
- [`/graveyard.md`](https://openboss.lol/graveyard.md) — every boss that has died, and who killed it
- [`/llms.txt`](https://openboss.lol/llms.txt) — the site map written for agents, including the read-only public API.

**There are no prizes and no payouts of any kind, ever.** Nothing of value is
won on this site. Money moves in one direction only, in exchange for smacks. It
is an entertainment purchase, not gambling.