Privacy Policy
Last updated 11 August 2026
This describes what Bagout collects, why, and who else sees it. It covers bagout.io and the game servers behind it.
What we store
- Account identity. An account identifier from our authentication provider, and the email address or wallet you signed in with.
- Your username, which is public: it appears on the leaderboard, in the kill feed, to your friends, and in your invite link.
- Your wallet address, used to show where a payout would go.
- Your balance and a full transaction ledger: every buy-in, payout, cash-out, deposit, withdrawal and purchase, with amounts and timestamps. This is financial record-keeping and is not deleted on request.
- Game record: matches joined, and items you own.
- Your friends list and pending friend requests.
- Referrals. If you arrived through someone’s invite link, we store who invited you. They are shown counts only (how many people joined and how many bought in), never who you are.
- Deposits and withdrawals: transaction signatures, the sending or receiving address, and amounts.
Diagnostics
The game client reports performance problems to the server so they can be investigated: frame rate, round-trip latency, dropped updates and main-thread stalls. These are written to our server logs alongside your account identifier. They contain nothing about you beyond how well the game is running.
Our servers also record connection metadata, including your IP address, as any web server does.
What we do not do
No advertising retargeting, and we do not sell or rent your data to anyone. We do count visits using Google Analytics, which sets cookies to do so, and we do collect crash reports so we can fix what breaks. Both are described below.
Stored in your browser
Cookies. Google Analytics sets a small number of cookies (_ga,
_ga_*) to tell one visit from another. We do not read them ourselves, and they are
not used for advertising.
Everything else here is local storage, not cookies, readable only by this site:
bagout_nameandbagout_skin: your display name and chosen cube colour.bagout_region: which regional server you picked.bagout_perf_hud: whether the performance overlay is showing.bagout.referral: the invite code you arrived with, kept for up to 30 days so it survives signing in, then discarded.
Our authentication provider also stores what it needs to keep you signed in. Clearing site data removes all of it.
Who else receives data
- Privy: authentication and wallet management. They hold your login identity.
- Neon: hosts the database holding everything in the first section.
- DigitalOcean: hosts the game servers.
- Solana: deposits and withdrawals are public blockchain transactions. Amounts, addresses and timing are permanently public and outside our control, and we cannot delete or amend them.
- CoinGecko and Jupiter: consulted for the SOL price. Nothing about you is sent to them.
- Sentry: crash reporting. When something in the game throws an error, the error and the code path that produced it are sent so we can fix it. It carries your account identifier, so we can tell whether a problem hit one person or everyone, and nothing else about you: no email, no wallet address, no username. Console output is stripped before sending, specifically so an access token cannot leave inside a crash report.
- Our visitor counter: a separate, cookieless analytics tool that counts visits so we know how many people arrive and from where. It sets nothing on your device, cannot follow you to another site, and does not build a profile of you.
- Google Analytics: also counts visits and page views. Unlike the counter above, it sets the cookies described above to do this. We have not linked it to Google Ads and do not use it for advertising or retargeting.
How long we keep it
Account and gameplay data is kept while your account exists. Financial records are kept as long as we are required to keep them, which is longer, and outlasts account closure.
Your choices
You can change your username, change or clear your wallet, and stop using the Service at any time. To request a copy of your data or ask us to close your account, write to support@bagout.io. Depending on where you live you may have additional rights over your data, including correction and erasure; the financial ledger is the main thing we cannot erase while records must be kept.
Children
The Service is not for anyone under 18 and we do not knowingly hold data about a child. If you believe we do, contact us and we will remove it and close the account.
Changes
We will update this page when what we collect changes, and change the date at the top when we do.