PRIVACY

You can browse and attack without an account, an email, or a name. We do not run advertising trackers, we do not use Google Analytics, and we do not sell anything to anyone.

We store three things, and only these three:

• A random identifier in a cookie. It is a random number with no personal data inside. Its only job is to know that this browser already attacked this boss.
• A hash of your IP address. Not the address — we never store your IP in readable form. It is put through a one-way function with a secret key, so it cannot be turned back into your address. It is used only to detect abuse, and it is never shown publicly.
• The host you arrived from, if any — for example t.co. Only the host, never the full address of the page you came from.

We also count, once per person and per boss: that you saw the battle, that you attacked, that you clicked through to the project, and that you pressed share. Doing any of those a second time changes nothing.

• No browser fingerprinting.
• No third-party advertising or analytics scripts.
• No marketing or tracking cookies. The only cookie we set is the one above, which the site needs to work.
• No profiles that follow you between sites.
• No selling or sharing of data with anyone for marketing.

We also store:

• What you gave us for the page: project name, tagline, link, logo, optional screenshot and optional X username. All of that is public — that is the point.
• Your contact email. This is private and never shown on the site. We use it to tell you that your project was approved, that your battle went live, and to answer you.
• The email your payment came through, kept separately from your contact email, because they are often different and we do not want to lose the one you chose.
• The payment reference from Stripe. We never see or store your card.

Four services, each doing one thing:

• Stripe — processes payments. Your card details go to them, never to us.
• Cloudflare — Turnstile checks you are not a bot, and R2 stores the logos.
• Resend — sends the emails to buyers.
• Neon — hosts the database.

• The visitor cookie lasts a year.
• Battle records are permanent and public. That is what the buyer paid for.
• Abandoned submissions that were never paid for are deleted after 24 hours, images included.
• Buyer contact emails are kept while we may still need to talk to you about your battle.

Write to hello@internetboss.lol and we will tell you what we hold about you, correct it, or delete it.

Two honest limits. First: if you are just a visitor, we usually cannot find you — a random cookie value and a salted hash are not enough to identify a person, which is exactly why we collect so little. Clearing your cookies removes the only link between you and anything here.

Second: we will not delete a finished battle record on request. Its numbers were published as part of what the buyer bought.

This page describes what the software actually does. It is not a statement of compliance with any specific regulation. We have not completed a formal GDPR assessment, we have not appointed a data protection officer, and we are not claiming certifications we do not hold.

Before we take real payments, this will be reviewed by someone qualified.