PRIVACY

You can browse and attack without an account, an email, or a name. We do not run advertising trackers, we do not use Google Analytics, and we do not sell anything to anyone.

We store three things, and only these three:

• A random identifier in a cookie. It is a random number with no personal data inside. Its only job is to count you once: one view, one attack, one click and one share per boss, and one view and one click per Challenger Spotlight. Doing any of those a second time changes nothing.
• A hash of your IP address. Not the address — we never store your IP in readable form. It is put through a one-way function with a secret key, so it cannot be turned back into your address. It is used only to detect abuse, and it is never shown publicly.
• The host you arrived from, if any — for example t.co. Only the host, never the full address of the page you came from.

• No browser fingerprinting.
• No third-party advertising or analytics scripts.
• No marketing or tracking cookies. Besides the visitor cookie above, we set two more, and only when you use them: a sign-in cookie for managing your own project, which lasts 8 hours, and a short-lived cookie of 30 minutes that lets the confirmation page recognise a defense payment you just made. All three exist only so the site works.
• No profiles that follow you between sites.
• No selling or sharing of data with anyone for marketing.

We also store:

• What you gave us for the page: project name, tagline, link, logo, optional screenshot and optional X username. All of that is public — that is the point.
• Your contact email. It is private and never shown on the site. It is also the key to your project: we send sign-in links to it, and the alert with a private defense link if someone challenges your reign. We use it to tell you about approval, going live, challenges and the end of your reign, and to answer you. When you pay, we pass it to Dodo Payments so your receipt reaches you.
• The email your payment came through, kept separately from your contact email, because they are often different and we do not want to lose the one you chose.
• The payment reference from Dodo Payments. We never see or store your card. At checkout you give a billing name, country and postcode: they go to Dodo to issue your receipt and work out tax, and we do not store them.

Five services, each doing one thing:

• Dodo Payments — the merchant of record. They process the payment, issue your receipt and handle applicable tax. Your card details and billing address go to them, never to us.
• Cloudflare — Turnstile checks you are not a bot, and R2 stores the logos.
• Resend — sends the emails described above.
• Neon — hosts the database.
• Hostinger — hosts the site. Like any host, it keeps standard connection logs.

• The visitor cookie lasts a year. The sign-in cookie lasts 8 hours and the defense-confirmation cookie 30 minutes.
• Battle records and Spotlight records are permanent and public. That is what the buyer paid for.
• Submitted projects stay until they are reviewed. A project that is not approved never appears on the front page, in the directory or in the rankings, though its profile page can still be opened by its address. Write to us if you want it deleted.
• Contact emails are kept while the project exists, because the email is how its owner gets back in.

Write to hello@internetboss.lol and we will tell you what we hold about you, correct it, or delete it.

Two honest limits. First: if you are just a visitor, we usually cannot find you — a random cookie value and a salted hash are not enough to identify a person, which is exactly why we collect so little. Clearing your cookies removes the only link between you and anything here. If you submitted a project, the link is your contact email: write from it and we can find everything tied to it.

Second: we will not delete a finished battle record on request. Its numbers were published as part of what the buyer bought.

This page describes what the software actually does. It is not a statement of compliance with any specific regulation. We have not completed a formal GDPR assessment, we have not appointed a data protection officer, and we are not claiming certifications we do not hold.

Before we take real payments, this will be reviewed by someone qualified.