米花爆 (BONMIPANG 米花國際) · Effective date: 21 August 2026
米花爆 (bnb.bonmipang.com, the "Service") is provided by BONMIPANG 米花國際 ("we", "us").
Our principle is simple: we collect only the minimum the game needs to work, we do no advertising tracking, and we sell no data.
This policy explains what we actually collect, how we use it, how long we keep it, and which rights you can exercise.
Password: only a salted hash (scrypt) is stored. The plain text is never stored, and we cannot read your password either.
If you sign in with Google: your Google account identifier and email address, used to recognise the same account. They are never used to send marketing email.
2. Game records
Level, experience, rating, matches played, wins and losses, knockouts and similar statistics, plus which coins and outfits you own.
For ranked online matches the server records a match replay containing the participants' display names, outfits and movements, so that you can rewatch it on your own profile page. Replays you choose to upload or publish are covered under "Public content" below.
3. Social content
Friend relationships and your block list.
Direct messages and message-board posts are stored on the server so that you and the other party can read them later.
Live chat in rooms and matches is relayed in real time and not stored.
4. Data stored in your browser (localStorage)
A login token, so you do not have to sign in every time, plus preferences such as language and volume.
Guest progress (coins, experience, outfits) lives only in your browser, and is carried into an account only when you sign up later.
A randomly generated anonymous measurement identifier (see below). The Service uses no third-party cookies.
5. Anonymous operational measurement
We run our own minimal measurement: aggregate numbers such as daily visits, matches started, matches finished, average match length and concurrent players, plus a return rate computed from an anonymous identifier.
That identifier is a random string. It contains no identity information, is not linked to your account, records no IP address and keeps no per-person activity detail, and we use no third-party analytics service.
6. Technical logs
As on most websites, the server and the proxy layer (nginx, Cloudflare) produce standard connection logs containing IP address, timestamp and request path. They are used for debugging, abuse prevention and security, are rotated and deleted regularly, and are not used for individual analytics.
2. What we deliberately do not do
We do not sell, rent or trade any user data.
We run no ads and install no advertising or third-party tracking code (no Google Analytics, no tracking pixels).
We do not store plain-text passwords.
We do not send unsolicited marketing email.
The measurement system records no IP addresses and builds no personal profiles.
3. Why we use your data
To provide the game itself: matches, saved progress, friends and messages (necessary to perform our agreement with you).
To operate and debug the Service, and to prevent cheating and abuse.
To understand overall use of the Service through aggregate statistics, and improve the game.
To cooperate with the competent authorities where the law requires it.
4. Who receives your data
Party
What they get
Why
Cloudflare
Connection traffic (including IP address)
Site proxying, caching and security protection; unavoidable on the connection path
Google (only if you choose to sign in with Google)
Google handles the sign-in flow; we receive only the account identifier and the email address
Offering the Google sign-in option
Apart from the technically necessary providers listed above and requirements of law, we give your personal data to no third party. All game data is stored on servers we manage ourselves.
5. What is public
Your display name and match statistics appear in rooms, on the match screen and on the leaderboard, where other players can see them.
Posts on the message board are visible to other signed-in players.
Replay share links: once you create a share link, anyone who has the link can watch that replay, including the display names and movements of every player in the match. The same applies to highlights published on your profile page. Treat a share link as public content.
Any participant in a ranked match may share that match's replay. Joining an online match means you understand this.
6. Retention and deletion
Account data and game records: kept until you ask us to delete the account, or until the Service ends.
Uploaded replays have size and count limits; the oldest are dropped once a limit is reached. You can also delete your uploaded replays yourself at any time.
Technical logs: rotated regularly, normally kept no longer than a few weeks.
Account deletion: for now, please ask through the contact channel below. We will delete the account data once we have confirmed your identity; public posts may be anonymised instead.
7. Your rights
Under Article 3 of the Personal Data Protection Act of the Republic of China (Taiwan), you may exercise the following rights against us at any time:
Enquire about or request to review your personal data.
Request a copy of it.
Request that it be supplemented or corrected.
Request that we stop collecting, processing or using it.
Request deletion.
How to exercise them: send us a direct message on Instagram @bonmipang with enough information to confirm that the account is yours. We will reply and act within a reasonable period.
8. Security measures
All traffic is encrypted with HTTPS.
Passwords are stored as salted scrypt hashes.
The server exposes only the ports it needs, and the database accepts no outside connections.
Minimal collection: data we do not need is never collected in the first place.
No online service can guarantee absolute security. If a data incident occurs that could affect your rights, we will notify you by in-game announcement.
9. Minors
The Service is a casual game suitable for a general audience and does not collect data specifically from children. If you are under eighteen, please use the Service only after your legal representative (a parent or guardian) has read and agreed to this policy; that representative may exercise the rights listed here at any time through the channel above.
10. Policy updates
We may update this policy as features change. Significant changes will be announced in-game and the effective date at the top of this page will be updated. Continuing to use the Service counts as acceptance of the updated policy.
The translations of this policy are provided for convenience only. In case of any discrepancy between versions, the Traditional Chinese version prevails.