Privacy Policy

The short version

We collect the minimum data needed to make Boom work. We don't sell your data. We don't run ads. We don't track you across the web. Your content is yours.

1. Who we are

Boom (boom.surf) is operated by Kenny Grant. For privacy questions, email kenny@kenny.is.

2. What we collect from account holders

When you create an account, we collect your email address, display name, and (if you sign in with Google) your Google profile information. We use this to authenticate you, display your identity on booms you create, and send you service-related emails like magic login links and daily digest notifications.

If you subscribe to a paid plan, payment is processed by Stripe. We store your Stripe customer ID and subscription ID in our database. We never see or store your credit card number, bank details, or other payment credentials — Stripe handles all of that directly.

3. What we collect from viewers

When someone views a boom page, we collect a client-generated fingerprint hash (for unique visitor counting), the HTTP referrer, user agent string, country (from the Cloudflare CF-IPCountry header), and timestamp.

We use cookies for deduplication: a cookie named boom_reacted_{slug} is set when a viewer submits a reaction, with a 90-day expiry. This prevents duplicate submissions. No tracking cookies. No third-party cookies.

If a viewer leaves a comment, we collect the name and email they provide in the comment form. This is voluntary — viewers choose what to enter.

4. Spam protection

We use Cloudflare Turnstile for spam protection on public interaction endpoints (reactions, polls, comments). Turnstile is a privacy-preserving CAPTCHA alternative — it does not use tracking cookies and does not collect personal data beyond what's needed for bot detection. For details, see Cloudflare's privacy policy.

5. Where your data lives

All data is stored on Cloudflare's infrastructure. Your uploaded files (videos, images, GIFs) are stored in Cloudflare R2 object storage. Your account data, boom configurations, reactions, poll responses, comments, and analytics are stored in Cloudflare D1 (SQLite). Session tokens and rate-limiting data are stored in Cloudflare KV. All data is encrypted in transit (TLS) and at rest.

6. How we use your data

We use your data to provide the service: authenticate you, display your booms, track views, deliver notifications, enforce plan limits, and process payments. We send service-related emails (magic login links, daily digest notifications if enabled). We don't send marketing emails unless you've opted in. We don't sell, rent, or share your data with third parties for their own purposes.

7. Third-party services

We use Stripe for payment processing (they receive your payment information directly), Resend for transactional email delivery (they process the email address and content of emails we send you), Google for OAuth authentication (if you choose to sign in with Google), and Cloudflare for hosting, CDN, DNS, storage, and spam protection. Each of these services has their own privacy policy governing how they handle your data.

8. Your rights

You can access, update, or delete your account data at any time from your dashboard settings. When you delete your account, we permanently delete all your data including your profile, booms, uploaded files, and associated responses (reactions, votes, comments). This is irreversible.

If you're in the EU/EEA, you have rights under GDPR including the right to access, rectify, erase, restrict processing, data portability, and object to processing. To exercise these rights, email kenny@kenny.is. We'll respond within 30 days.

9. Data retention

We retain your data for as long as your account is active. View analytics data is retained indefinitely to provide historical view counts. Session tokens expire and are cleared automatically. Rate-limiting data in KV has short TTLs (60 seconds) and is cleared automatically. When you delete your account, all associated data is permanently removed.

10. Children

Boom is not intended for use by anyone under 13. We don't knowingly collect data from children. If you believe a child has created an account, email kenny@kenny.is and we'll delete it.

11. Changes to this policy

We may update this policy. When we do, we'll update the effective date at the top. If the changes are material, we'll notify you by email. Continued use of Boom after changes take effect means you accept the updated policy.

12. Contact

Questions about this policy or your data? Email kenny@kenny.is.