Last updated: 13 August 2026
Bonkonauts is a multiplayer vehicle-building game. This policy explains exactly what the
app collects, why, and what you can do about it. It applies to the Android app
(be.bonks.bonkonauts) and the game servers it connects to.
The short version. Bonkonauts has no ads, no analytics, no trackers and no third-party SDKs of any kind. The app requests a single Android permission —
INTERNET— because it is an online game. The only personal data held is the account you choose to create: a username, a hashed password, and your in-game progress. Nothing is sold or shared with anyone.
Bonkonauts is operated by an independent developer in Belgium. The game servers are self-hosted; no cloud analytics or advertising platform is involved. For anything in this policy, including requests about your data, contact privacy@werya.be.
| Data | Why | Kept |
|---|---|---|
| Username (chosen by you) | Identifies your account so your progress persists between sessions. | Until you delete the account |
| Password | Signing in. Never stored in readable form — only a PBKDF2-HMAC-SHA256 hash with a random per-account salt, so the stored value cannot be turned back into your password. | Until you delete the account |
| Session token | A random value that keeps you signed in without re-entering your password. Stored on your device and on the server. Logging out invalidates it. | Until you log out or sign in again |
| Game progress — nickname, coin balance, unlocked and selected skins | Running the game: showing you to other players, and remembering what you have earned. | Until you delete the account |
| Match state — your vehicle design, position, score, lives | Simulating the match on the server, which is what makes multiplayer fair. | Discarded when the match ends |
| IP address | Processed while you are connected, and used briefly to rate-limit login attempts and room creation so the servers cannot be flooded. It is not written to the database or linked to your account. | In memory only, discarded within about a minute |
No real name, email address, phone number, postal address or date of birth. No location data. No contacts, photos, files, camera or microphone access. No advertising identifier, device identifier or fingerprinting. No payment information — in-game coins are earned by playing and cannot be bought with real money. No crash reporting or usage analytics.
Nobody. There are no advertising networks, analytics providers, or third-party services receiving your data. It is not sold, rented or traded.
Two things are visible to others by design: the nickname you choose is shown to the other players in your room, and an administrator can see account usernames, coin balances and who is currently in a game, in order to moderate and support the service.
On self-hosted servers located in Belgium (European Union). Data is not transferred outside the EU.
No system is perfectly secure. Please use a password you do not reuse elsewhere.
You can have your account and everything attached to it — username, password hash, session token, coin balance and unlocked skins — permanently erased, using the deletion form or by emailing privacy@werya.be. There is nothing retained afterwards.
Under the EU General Data Protection Regulation you may request access to your data, its correction, its erasure, a portable copy of it, or restriction of its processing, and you may object to processing. Write to privacy@werya.be.
The lawful basis for processing is performance of a contract (running the game account you asked for) and legitimate interest (keeping the servers available and resistant to abuse).
If you believe your data has been mishandled you may complain to the Belgian Data Protection Authority, the Gegevensbeschermingsautoriteit / Autorité de protection des données (dataprotectionauthority.be).
Bonkonauts is not directed at young children and does not knowingly collect personal data from them. The only data an account holds is a username of your choosing and game progress. If you are a parent or guardian and believe a child has created an account you would like removed, use the deletion form or email privacy@werya.be.
Copies of the game installed outside Google Play check for new versions by requesting a small version file from the developer's own server. That request is a normal web request and reveals only what any web request does, such as your IP address; it is not logged against you or used to build a profile.
If this policy changes, the date at the top will change with it, and the current version will always be available at this address.