Loading…
LIVE · --:--:-- UTC
JOIN THE PACKJOINPlain and honest — here is exactly what data KaboomKartell stores, why it stores it, and what it deliberately does not do. No tracking, no data trade, no dark patterns.
KaboomKartell is a private, non-commercial hobby project run by Florian Winkler (4Flow). There is no company behind it, and your data is never sold or shared for advertising.
Privacy questions: 4flow@kaboomkartell.com
If you create an account: your email address, username and display name, plus anything you choose to add (bio, avatar, optional links to your own social profiles). Your password is never stored in plain text — only a bcrypt hash of it. That's it: no location, no device fingerprinting, no purchase history.
Two-factor secrets are strongly encrypted before they touch the database, never stored in plain text. For security-relevant events (logins, password changes, 2FA changes) we keep a short audit log with the IP address and browser user-agent — strictly to detect abuse and help you recover a hijacked account, never for profiling.
Only functional cookies: a session token that keeps you logged in, a small cookie remembering your language, and short-lived state cookies during a Discord or Twitch connection. No advertising or tracking cookies — which is why there is no cookie consent wall.
Some showcase tracks play via the official SoundCloud player. The embed only loads after you tap play — before that, no request is sent to SoundCloud. Once loaded, SoundCloud may set its own cookies under its own privacy policy.
KaboomKartell runs zero third-party analytics, trackers or advertising scripts. Nothing about your visit is sent to Google, Meta or any analytics service. The only counter is an anonymous per-link tally that stores no IP, no user and no timestamp.
We only ever email your own address — to verify your account, reset your password or send a 2FA code. The daily-drop newsletter is opt-in only and requires your explicit consent; you can withdraw it at any time.
Both connections are optional and always started by you. For Discord we read your public profile once when you link it and do not keep the access token afterwards. For Twitch the access token is stored securely and used only to display your live status. You can disconnect either connection at any time in your settings.
You can ask for a copy of your data, have it corrected, or have your account and its data deleted — just write to the contact address above and it will be handled.