Privacy policy

Last updated 18 October 2026. Applies to bura.com.ge.

Bura is a card game you can play against the computer or with friends online. You can play without an account, and then almost nothing about you leaves your browser. This page says what we collect when you do sign in or play online, why, who else handles it, and how to get it deleted. Questions or requests: contact@bura.com.ge.

Without an account

Your settings, the name you type, and your current game are kept in your own browser (local storage), not on our servers. When you play a friend online, your moves and chat go between the two browsers through public relay servers (see "Who else handles your data"), encrypted with a key made from the room code. We don't store that chat.

With an account

Sign-in: your email address. If you sign in with Google, also the name and profile picture address Google shares with us.
Profile: the username, emoji avatar and card deck you pick, and the profile picture you upload, if any. Uploaded pictures are reviewed by an admin before anyone else sees them; rejected ones are kept in a private storage area until removed.
Game records: results of finished online matches against other signed-in players (who won, the score, when), which other players can see.
Coins: your balance, which other players can see, and a record of every change (daily rewards, purchases with coins, matches played for coins). Coins have no money value and can't be bought or cashed out.
Matches played for coins: the stake, both players' reports of the result, and the information needed to check the match was fair (each side's random seed and the list of moves).
Online games: a record that your account joined a game room, stored as a scrambled code rather than the room code itself, and deleted after two days.
Chat signatures: when you play online signed in, your browser creates a key to sign the chat messages you send. The private part never leaves your device; the public part is stored with your account so an admin can check reported messages are real.
Reports: if you report someone, we store your report, including any chat lines you attach. If someone reports you, we store theirs. Reports are seen only by admins and the person who filed them.
Moderation: any suspension or chat ban on your account, and a log of admin actions.

Why we use it

To run the game: sign you in, show your name and picture to the people you play, keep your coins and records, and settle matches played for coins.
To keep it fair and safe: check reported chat and pictures, stop cheating, and enforce bans.
To send the sign-in emails you ask for. We don't send marketing email.

We don't sell your data. The legal basis is providing the service you signed up for and, for moderation and anti-cheating, our legitimate interest in keeping the game fair and safe.

Who else handles your data

Supabase stores accounts, profiles, pictures, coins, records and reports.
Vercel hosts the website and, like any web host, sees your IP address and keeps short-term request logs.
Resend delivers sign-in emails, so it receives your email address.
Google handles "Continue with Google" if you use it. Fonts are loaded from Google Fonts, which receives your IP address.
jsDelivr serves two code libraries the page loads (for sign-in and online play), and receives your IP address.
EMQX and HiveMQ run the public relays online games pass through. They see your IP address and encrypted traffic they can't read.
Telegram carries alerts to the admin about reports and pictures waiting for review. These contain usernames and the text of reports.

Some of these companies process data outside Georgia, including in the European Union and the United States, under their own privacy terms and safeguards.

The site may show ads, including optional ads you can watch in exchange for coins. Ads are provided by Google (AdSense). Google and its partners use cookies and similar technology to show ads and to measure them, and may use them to personalise ads based on your visits to this and other sites. You can turn off personalised ads at Google's ad settings and read how Google uses data at policies.google.com/technologies/partner-sites. Where the law requires it, we'll ask for your consent before ads use cookies.

What's kept on your device

Local storage and IndexedDB in your browser hold your settings, your sign-in session, the chat signing key, and records of matches played for coins (so a page that closes mid-match can still settle it). Clearing your browser's site data removes them.

How long we keep it

Account data is kept while your account exists. Room records are deleted after two days. When an account is deleted, its profile, pictures, coins, match records, keys, and reports by or about it are deleted with it. The admin log (a record of actions such as bans, by account number) is kept so repeat abuse can be recognised.

Your rights

You can ask to see the data we hold about you, correct it, get a copy, or have your account and its data deleted, by writing to contact@bura.com.ge from the email address on your account. You can change your username and picture yourself at any time. If you think we've handled your data wrongly, you can complain to Georgia's Personal Data Protection Service (personaldata.ge) or, if you live in the European Union, to your local data protection authority.

Children

Bura isn't aimed at children under 13, and they shouldn't create an account. In the European Union the age is 16 unless a parent agrees. If you think a child has given us their data, write to us and we'll delete it.

Changes

If this policy changes, the date at the top changes too. For significant changes we'll say so on the site.