Blue Wizard Digital

Privacy Policy

Updated October 17, 2026

This notice explains the current TOMB RUN website and its original Zom.Run city mode, provided by Blue Wizard Digital Inc. Read it alongside the Blue Wizard Privacy Policy, which covers the studio’s services more broadly.

Game saves and browser storage

Your browser stores progress, gold, upgrades, statistics, settings and an unfinished run. Browser storage and the offline cache help the game load quickly. Migration and conflict recovery keep copies of original local saves. The original Zom.Run city mode keeps its local save flow.

When cloud saving is enabled for TOMB RUN, the game sends progress and unfinished-run checkpoints to our server automatically. A random player identifier and a secure session cookie let this browser return to that save without signup. The server stores a hash of the session token. The cookie requests a one-year lifetime and renews during use, subject to browser limits. Settings and the separate leaderboard identity are not part of cloud progress.

An optional passkey lets you recover the player on another device or after losing the cookie. We store its public credential, random player handle, technical metadata and use times. We never receive the private key, fingerprint, face scan or device PIN. Your credential provider controls passkey synchronization. If all sessions and passkeys are lost, we cannot recover the player from its generated nickname.

Current cloud saves are retained until an authenticated deletion request is handled; they are not automatically removed for inactivity. Recovery history keeps the latest snapshots and milestones, daily snapshots for about 30 days and temporarily preserved conflict branches. When a season reset starts everyone’s progress again, the save it replaced is kept for about 180 days so the reset can be undone, and this device keeps a copy of the progress the reset took until you or your browser removes it. Operational backups may retain earlier copies under the hosting backup policy. Save reliability measurements contain bounded event counts, latency and pending age, not progress or credential contents; daily aggregate rows retain about 30 days.

The game’s reset control resets progress; it does not delete the cloud player, passkeys or recovery history. Clearing this site’s data removes local copies, settings and its session cookie, but does not delete server data; uninstalling a shortcut alone may not clear local storage. Contact the privacy address below for a server-data request. Local recovery copies remain until you or your browser removes them. Keep downloaded recovery files and Transfer codes private.

Delivering the website

When your browser requests pages, images or audio, the hosting service receives information such as your IP address, requested URL, request time and browser headers. Hosting and security systems may keep request logs to operate and protect the service. These records are separate from your local save and follow the hosting provider’s operational retention practices.

Copies of the game on other websites: when a page on another website runs this game’s code and asks our server for the score board, a league or the Daily Dungeon, your browser tells our server that website’s address, as browsers do for every request from one site to another. Our server records that website’s name, which of these features it asked for and the day, to find unofficial copies of the game. It records nothing about the person playing (no address, browser details, name or score). A copy cannot read our answers, and it cannot send scores. The official game at tomb.run never makes these requests.

Website analytics

Google Analytics loads when you open the game. Google receives information such as page views, referrers, browser and device details, interaction events and connection information, and uses analytics cookies to distinguish visits. See how Google uses information from sites that use its services. While the game is in testing it also sends Google Analytics a short event at moments in a run – a run starting and ending, reaching a room, choosing a card or a spell, meeting and beating a boss, being saved from a hit, a shop visit, a purchase, a reroll, finding or entering a secret door, opening the Catacombs, leaving a run before it ends and how the run ended – with the room, level, kills and similar game numbers, which of your runs it is, whether you steered by touch, mouse or keyboard, whether the device is a phone, tablet or computer, and whether the game is on tomb.run or inside a game website (and which one). It also sends how long the game took to load, which version of WebGL your browser offers and whether it draws graphics in software (never the graphics chip’s name), whether the game could not start because WebGL is missing, how smoothly a run played, when the score board offers you a place and when you post to it, whether the controls hint was needed and learned, and what you did with the Add to Home Screen card; and after a round whether an ad appeared and how long it took to load. If you press DECLINE on the cookie banner, or turn Analytics off under MANAGE, no game events are sent. We do not send your game save or transfer code to Google Analytics.

You can manage or block cookies using your browser’s settings, or use Google’s Analytics opt-out browser add-on where supported. Removing cookies does not delete information already received by Google.

Performance measurements

TOMB RUN is in testing, and while it is, the game measures how smoothly it runs and sends that measurement to our own server when a run ends. This is how we find out that the game stutters on a particular phone without having to ask somebody to send us a report by hand.

A measurement contains frame timings (averages, percentiles and the worst frames), how much of each frame was the game’s own code, what your browser reports about the device (rough memory size, number of processor cores, screen size and pixel density, and whether the page is running in a browser tab or as an installed shortcut), which browser engine and graphics backend were in use (and whether graphics are drawn in software, never the graphics chip’s name), the game version, and what was happening in the run at the time – the room number, the score and how many monsters, bullets and particles were on screen. For a sample of runs, and for any run that stuttered badly, the fuller report is sent as well; that one also includes your browser’s user-agent string and, if a script error occurred, the file name and line number.

While the game is with testers, every run also sends its fuller report and a play record: what happened in the run, so the game can be balanced from real play. That is each card you were offered and which you took, the spells you gained, each room reached, the bosses, each visit to the shop and what it offered, each reroll and what it cost, each secret door that appeared and whether you went through it, each time a ward or extra life saved you and from what, and how the run ended; a sample once a second of the room, level, kills, gold, extra lives, how many monsters and spells were on screen, how close the nearest monster was, whether a boss fight was on and the frame rate; the wizard’s position ten times a second; and the text of any script error; and for the ad break after the previous run, whether an ad appeared, its size and how long it took to load, the size of an ad that did not fit the screen and the space it had, or why none was requested (for example, no advertising permission, or the one-minute pause between ads); and, when the page last opened, whether a saved run was waiting in this browser, how old it was and which room, whether it was put back or why not, whether saving was switched off at the time, and whether the browser seemed to be a private window (a guess from how much storage the page is allowed and whether the browser lets it use file storage). The fuller report also includes your run’s combat multipliers and permanent damage, firing-speed and knockback upgrade levels. During play, your browser keeps a local interrupted snapshot about every 30 seconds and after errors so that a later visit can send the part before a page crash. It is compressed in your browser before it is sent. If it cannot be delivered, your browser keeps it (at most five closed runs, for up to a week, plus the current run’s snapshot) and sends it again the next time the game is open.

A measurement contains no name, no country, no save and no transfer code, and not the random token the score board uses. While the game is in testing each run carries two random numbers made on your device: one for the run, and one kept in this site’s local storage as tombrun_tester_id, so that one tester’s runs can be read together. They say nothing about who you are, and clearing the site’s storage makes a new one. Runs are kept for about three months, and the short measurement for about a week. Nothing from them is ever shown to other players. As with any request, the hosting service also receives your IP address and browser headers (see Hosting and logs below); it is not stored with the measurement.

To switch it off, set tombrun_perf_optout to 1 in this site’s local storage using your browser’s developer tools, or write to us and we will tell you how; anything still waiting to be sent is then discarded. Blocking the request has the same effect: the game does not notice and plays identically either way.

There is also a performance test you can start deliberately, which never runs on its own: the game plays itself for about nine minutes through a fixed set of scenes and reports how each one ran. It is started by a link, by a hidden gesture on the results screen, or from the Options menu, and it shows you the whole result on the screen before sending anything, with buttons to copy, share or save the same file. What it sends is the same kind of information as above – frame timings, device capabilities and what was on screen – for each scene rather than for a run, plus any short label you type yourself. It carries no identifier of any kind, so one test cannot be linked to another or to you, and it does not touch your saved game: your progress is put back exactly as it was when the test ends.

Sharing runs

The game remembers up to 24 recent rivals, their chosen names, latest shared scores and rivalry results with your saved progress. You can choose who a challenge is for under Share → TO: (on the card), and forget a rival inside Share → Edit. This history travels with cloud progress when enabled and with a Transfer code. New challenge links contain random public rivalry identifiers and run sequence numbers, alongside both players’ names and results for replies, so renamed players and reopened messages can be recognized. These public identifiers are separate from account credentials and the leaderboard identifier. Anyone who receives or is forwarded a link can read its public details. The game cannot read your contacts or identify whom you selected in a chat app. Clearing site data loses this memory unless you restore saved progress.

Challenge links include the room reached, what killed the wizard, your saved public scoreboard name (or “A WIZARD”), your country only if you chose one, and the name of the friend it is for if you typed one under For (the game remembers up to five such names on this device only, and never sends them to measurements); share pictures show the room, what killed the wizard, your scoreboard name if you have saved one, and that friend’s name if you typed one. Anyone with the link can read that information. Links contain no account token or save and are invitations, not verified scores. Preparing a picture sends these public details to our server. So a challenge link fits on one line (tomb.run/c/…), the results screen also sends the same public details, and the league identifier below, to our server, which keeps them under a short code so the short link can open the full challenge. Nothing else is kept with them: no address, browser details, account or device. A short code is kept for about two years; after that, or if it is ever lost, the short link opens the game without the challenge. The full-length link always works. Our server also counts how often challenge links and their pictures are opened, as daily totals (for example, how many links were opened and how many were replies, by route label); that counting does not store the link, the names in it, or anything about who opened it, such as an address or browser details. We measure share attempts, completion or cancellation, copied links, picture downloads and opened challenges through the existing measurement controls; these events do not include your name, country or the shared URL. The device does not tell us which app you choose in its share sheet. We record which of our buttons was tapped, not which app the sheet finally chose. A short via label in a challenge link identifies the sharing route (for example a QR code or COPY LINK); it is not a player identifier. A challenge link also carries a random league identifier (lg) so the people who play from it share a small board (see Leagues under the score board). Sharing measurements include share_attempt, share_complete, share_cancel, share_error, share_copy, share_download, shared_link_open, share_qr_shown, share_caption_copied, share_inapp_hint, challenge_accepted, challenge_declined, rival_dropped, challenge_beaten, league_created, league_joined, league_posted (a league post’s rank only, never the league or a name) and league_news (whether the title’s league news was shown, dismissed or answered with a rematch, never who), with the cause, room, format, method, and where relevant the button, image flag, route label, the room to beat, the reply round and whether a run won, tied, came close or lost against it. The end of a run records the same outcome and whether it was played against an opened link or a remembered rival, never who the rival is. Opening a compose page or downloading a picture does not tell us whether you posted it. Save the picture (on a computer) also tries to copy the suggested caption to your clipboard, locally on your device; that clipboard write sends nothing to us. QR codes are generated locally, and no social-network code is loaded into the game for these buttons. The kill cam video (Send the kill cam, and the KILL CAM chip that plays it on the card) is made on your device from the last few seconds of the run; it is never sent to us, and leaves your device only through the share sheet or a download you choose. When you send a challenge link, the game also sends our server the kill cam’s recording of those last few seconds — not a video, but which of the game’s own pictures were drawn where (the wizard, the monsters, the floor), the game art it used, and the room reached — so a friend who opens the link sees your death replayed in their game before they play. It is kept under the random player and run numbers the link already carries, with a random key your device keeps so only it can add your later recordings; nothing else is kept with it: no name, address, browser details, account or device. Recordings are kept for 30 days. Measurements record only that a replay was shown, skipped or followed by a run (challenge_replay), never who sent it. The Tomb-o-gram picture (TOMB-O-GRAM) is drawn on your device in the same way from the run's room, cause of death, your scoreboard name and the name of the friend it is for, and is shared, with the kill cam video when it is ready, only through the share sheet or a download you choose.

Advertising

Unless you decline advertising, Setupad and its advertising partners may load an ad after a round ends. We do not ask first: the game shows no advertising popup, and choosing to decline is under Options → Privacy preferences. They receive connection and device information such as your IP address, browser headers and page URL, and may use cookies or similar storage for ad delivery, measurement and personalization according to your choices and their settings. See Setupad’s privacy policy. We do not pass your cloud player ID, progress, passkeys or Transfer code to the ad tag.

Use Options → Privacy preferences to change advertising permission. Declining advertising keeps the game playable, and stops game ad breaks until you allow them again. An advertising provider may also present its own regional consent controls. Changing permission stops new game ad requests and closes any current placement; it does not delete data already received by partners.

Playing inside another website

Some game websites show TOMB RUN inside their own pages. There, that website’s privacy policy covers its page, its ads and its sign-in. The game inside works as described here, with three differences: it shows no ads of its own and asks nothing about advertising; your progress saves only in your browser for that website, with no cloud save and no passkeys; and Google Analytics keeps a separate cookie for that website.

Separate copies of the game hosted by itch.io and CrazyGames themselves carry their own short privacy page: they send nothing to Blue Wizard Digital, keep progress only in your browser, and have no score board, cloud saves, sharing, analytics or advertising of ours.

Inside Bizarrecade’s feed (bizarrecade.com), the game runs as that page’s connected game: the feed sends the game its taps and the passing of time, and the game sends the feed the run’s score (the room reached) as it changes and once more when the run ends, with the number of monsters killed and the run’s length. Nothing else passes between them; the feed never sees your name, saves or device details through the game, and the game’s preview in the feed plays itself, saves nothing and reports nothing. Bizarrecade’s own privacy policy covers what it does with the score.

Transfers, sharing and external services

Transfer creates a code containing your progress on your device. Anyone you give that code to can read or import it. Copying uses your clipboard; sharing sends content through the app or service you choose.

The original city mode requests Google Fonts, which receives normal connection information such as your IP address. The default dungeon mode hosts its fonts locally. External links, email and sharing services have their own privacy practices.

The global score board

The board is the only feature that publishes anything: when you press Post score, once you have saved a scoreboard name, when a run beats your best in a league you play in (see Leagues below), or when you take part in challenges (see Your rivals below). Nothing you type, and nothing anyone else can see, is sent otherwise.

A post contains the name you type, the country you choose (or none), the figures from that run (kills, rooms, seconds, gold and bosses, plus the run’s number of level-ups, which is used only to check that the run was possible and is not kept), and for a Daily Dungeon run, that day’s date, so it goes on that day’s Daily board and a random identifier this game generates and keeps in your browser so a league board can hold your best run rather than every run (the other boards keep each run you post). That identifier is not linked to you, is never shown to other players, and is cleared when you clear this site’s data. Your save, your transfer code and your settings are not sent. Your browser also remembers which board entries it posted, so your own name can be marked on the board; that list stays on your device.

The country is a suggestion worked out on your device from its time zone and language settings; nothing about that leaves your device, and you can change the suggestion or leave the country blank before posting. If the hosting service tells us which country a request came from, we may suggest that instead. The country you post is shown next to your name.

A published entry shows the name, country and figures to everyone who opens the results screen, so choose a name you are happy to be public. Names are up to 8 characters: letters, numbers, spaces and emoji. Names matching a list of offensive words are refused, and we may remove a published name at our discretion. As with any request, the hosting service also receives your IP address and browser headers (see Hosting and logs below); your address is not stored with the entry.

Before a name is published, our server sends the name and the country you chose to TypeSafe, a moderation service, which says whether the name is fit for a public board. Nothing else is sent to it: not the run, not the random identifier, not your address. TypeSafe does not use what it is sent to train its models; see TypeSafe’s privacy policy. A name it judges unfit is refused; a name it is unsure of is kept off the boards until one of us has looked at it, and then published or deleted. We keep the result for each name and country, so the same name is not checked twice.

Leagues. A challenge link you send carries a random group identifier (the lg part of the link), made on your device, so that everyone who plays from that link, in a group chat for example, shares one small league board. Opening such a link joins its league on your device; a newer link from another group makes that group’s league the one your links carry, and this device keeps up to two earlier leagues, with your best run in each, so that a run that beats that best is still posted there. These identifiers are kept in this browser’s local storage, not with your saved progress. So the title screen can say when a friend has passed you, this browser also keeps the names, rooms and kills of your league’s board as you last saw it, and the game uses them during a run to show the next friend to pass and where a friend’s best run ended; none of this is sent anywhere. Runs posted to a league are shown, with the scoreboard name, to everyone who has a link to it. Once you have saved a scoreboard name, a run that beats your best in your league is posted to that league automatically, with the same details as any post, and to that league alone; otherwise the game offers Post score as usual. A league nobody has posted to for 30 days is deleted. Anyone with a league link can see its board, so forwarding the link shares it. The league identifier is never sent to Google Analytics.

Your rivals. When you play a run from a friend’s challenge link, you and that friend become rivals, and each of you sees one board of your rivals and their rivals. To build it, the end of each run sends our server the random rivalry identifier the game keeps with your progress (the same one your challenge links already carry), your friend’s identifier when the run answered their link, your saved scoreboard name, the country you chose, and the run’s figures (rooms, kills, seconds, gold and bosses, checked like any post). This happens only once you have answered a link, sent one, or have a rival. The server keeps your name, country, best rooms and kills, when you last played, which identifiers you are rivals with, and a one-way scrambled form of your scoreboard token that lets rivals send you messages (below); no address, browser details or account. Your name, country, best rooms and kills are shown to your rivals and their rivals. Anyone who has not played for 21 days leaves other people’s boards, and a player not heard from for 120 days is deleted. Measurements record only that a rivalry formed (rivalry_formed, with the room reached), never who.

Messages from friends. On a league or rivals board you can tap a friend to send them one of the game’s own short messages (“Rematch?”, “GG”); nobody types anything. The game sends our server your scoreboard token, the friend’s board address (a one-way scrambled form of their token, shown only on boards they share with you) and which message you picked. The server checks that you share that board and keeps, until the friend next opens the game, your board name and address, the message’s number, the board’s kind and when; it is deleted when it is delivered, and after 7 days if it never is. It also remembers for 7 days that you wrote to that friend that day, so a friend gets at most one message from you a day. You can block a sender from a message, and switch all messages off in Options; the server then remembers only that choice. Measurements record that a message was sent and its number, never who to.

Email data-controller@bluewizard.com to have an entry removed. Tell us the name and roughly when it was posted.

Contact, choices and requests

Email data-controller@bluewizard.com for privacy questions or to request access, correction or deletion of personal information Blue Wizard holds about you. Depending on your location, you may have additional rights, including objection, restriction, portability or a complaint to a privacy regulator. We may need enough information to verify and answer your request. We cannot retrieve a save that exists only in your browser.

If you contact support, we receive the address and information you send and use it to respond. Send only what is needed for your question. You can also use Blue Wizard’s data-request page.

Children

Blue Wizard does not knowingly collect personal information from children under 13. This game does not verify a player’s age. If you believe a child has provided personal information to us, contact the privacy address above so we can investigate and address it.

Changes

We will update the date above when this notice changes. Material changes to data collection will be explained and any required consent will be requested.