Privacy Policy

Effective date: July 16, 2026

This Privacy Policy explains how Bombooru (“we,” “us,” or “our”) handles information when you use bombooru.org and related services (the “Service”). It covers what we collect, why we collect it, how long we keep it, and choices you have.

If you disagree with this policy, please stop using the Service. Questions can be sent to webmaster@bombooru.org.

Related documents: Terms of Service and site rules.

1. Information We Collect

A. Information you give us
  • Account data. Username, password (stored as a secure hash, not in plain text), optional email address, and preference settings. You can change many of these in your account settings.
  • Content you upload or write. Posts, tags, comments, notes, forum posts, wiki edits, pools, private messages, reports, and similar contributions.
  • Actions on the Service. Favorites, votes, flags, saved searches, and other interactions we need to operate features.
  • Payment data (only if you buy something). If paid features exist, payment processors handle card data. We may receive limited billing-related details (for example country, postal code, transaction status, and IP at checkout) as needed to fulfill the purchase and prevent fraud.
  • Support and other optional input. Messages you send us for help, feedback, or surveys, if we offer them.
B. Information collected automatically
  • Technical and log data. IP address, approximate location derived from IP, browser and device information, timestamps, pages or posts viewed, searches, and similar usage data used for security, reliability, and debugging.
  • Cookies and similar storage. We use cookies (and similar browser storage) to keep you logged in, remember settings, and make the Service work. The Service will not function correctly without essential cookies.
C. Information from third parties

If you connect a third-party login or service (when available), we may receive profile information from that provider under their terms. We may also use infrastructure providers (hosting, CDN/DNS, captcha, email, or payment processors) that process limited technical data on our behalf.

For example, Cloudflare Turnstile may process challenge-related data to reduce bot signups, and our hosting provider (currently Hetzner) processes server logs as part of running the Service.

2. How We Use Information

We use the information above to:

  • Operate, maintain, and improve the Service.
  • Create and secure accounts, authenticate users, and enforce rate limits.
  • Display user Content and enable community features (tags, comments, wiki, etc.).
  • Detect abuse, spam, fraud, security incidents, and rule violations.
  • Respond to support requests and important service notices.
  • Comply with law and respond to valid legal process.
  • Process purchases if paid features are offered.

3. How We Share Information

We do not sell your personal information.

We may share information in these situations:

  • Public Content. Posts, comments, usernames, and other material you choose to make public are visible to others and may be indexed or scraped by third parties.
  • Service providers. Hosting, storage, CDN/DNS, email, captcha, analytics (if used), and payment processors that help us run the Service, under obligations to use data only for that purpose.
  • Legal and safety. When we believe disclosure is required by law, or needed to protect users, the Service, or others from harm, fraud, or abuse.
  • Business changes. If the Service is transferred, merged, or reorganized, information may move with it, subject to this policy or a successor policy.
  • With your direction. If you ask us to share something or use a feature that necessarily discloses it.

4. Public Nature of the Service

Bombooru is largely a public imageboard. Usernames, uploads, tags, comments, and similar contributions are typically public by design. Do not post personal data you are not comfortable making public. Private messages and certain account settings are not intended for public display, but no system is perfectly secure.

5. Retention

We keep account and Content data for as long as needed to run the Service and for legitimate operational, security, and legal reasons. You may request account deactivation or deletion of certain data where available in the product or by contacting us. Some records (for example backups, security logs, or Content others still rely on) may remain for a limited time after deletion requests.

6. Security

We use reasonable technical and organizational measures (such as access controls, HTTPS, password hashing, and network firewalls) to protect the Service. No method of transmission or storage is 100% secure. You are responsible for keeping your password confidential and for activity under your account.

7. International Processing

The Service may be hosted and accessed from different countries. If you use the Service from outside the hosting region, your information may be processed in the country where our servers or providers operate (for example, the EU when using Hetzner infrastructure). By using the Service, you understand that transfer.

8. Children

The Service is not directed to children under 18. We do not knowingly collect personal information from children under 18. If you believe a child has provided information, contact us so we can take appropriate steps.

9. Your Choices

  • Account settings. Update profile fields, email, and many preferences in your account settings.
  • Email notices. If email notifications are enabled, you can usually disable non-essential mail in settings or via unsubscribe links. We may still send important security or account messages.
  • Cookies. You can block cookies in your browser; some features (including login) may stop working.
  • Access / correction / deletion. Depending on your location, you may have rights to access, correct, or delete personal information. Contact us to make a request. We may need to verify your identity and may refuse requests that are unlawful, abusive, or that would break the Service for others.

10. Third-Party Sites

Links on the Service may point to other websites. Their privacy practices are their own. Review those policies before providing information to them.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The effective date at the top will change when we do. Material updates may also be announced on the Service. Continued use after an update means you accept the revised policy.

12. Contact

For privacy questions or requests, contact webmaster@bombooru.org or use other contact options published on the Service.