Terms and privacy

The only terms in Basement today are eight lines you accept before your first real-B3 deposit, pick or Drop. Play credits don't need them. This page quotes those terms and explains what Basement stores, what other players see, and how analytics work.

The B3 terms, word for word

After you sign in, the wallet's B3 tab shows Before you play for B3 with these lines:

1. "You're 18 or older, and B3 games are legal where you live"
2. "Basement holds your B3 in its vault on Base. Your deposit address is run by Basement"
3. "Send only B3 on Base to your deposit address. Anything else won't reach your balance"
4. "Withdrawals go only to addresses you add. A new address opens between 2 hours and 3 days after you add it, depending on how you confirm it. We email you each time"
5. "Deposits unlock for withdrawal as you play them. Winnings can be withdrawn any time"
6. "Fixed odds. Each round's seed is locked in a hash before picks open and revealed after"
7. "Not offered in Cuba, Iran, North Korea, Syria, Crimea, Donetsk or Luhansk"
8. "Only play with what you can afford to lose"

You tick I'm 18 or older and accept these terms, then tap Continue. The current version is 2026-10-19.1. You accept each version once, and the app asks again if the terms change. Where real B3 is available covers line 7 in more detail, and Withdraw B3 explains the wait in line 4.

There's no separate terms-of-service page or privacy policy, so the rest of this page describes what Basement stores and who can see it. The app has no button to delete an account, and you can't change your sign-in email yet. To ask about your data, or to ask for your account to be deleted, report it without posting personal details in public.

What Basement stores about you

For every account, guest or signed in, Basement stores:

• a random account id and your handle
• your network address at the moment the account was made, stored only as a hash and used to limit abuse such as mass sign-ups
• your session token, also stored only as a hash
• your picks and Drops, your refill and streak days, the fighters you follow, and your invites
• hashed network addresses used to check that invites aren't self-referrals: up to 8 for each player who invites, and one on each invite that's claimed

If you sign in, it also stores:

• your email address, to send sign-in codes and security emails. The accounts and money records keep only a masked hint of it, like s•••@example.com, and a keyed hash used to find your account when you ask for help
• if you sign in with Google, a link to your Google account and the access token Google sends at sign-in, stored encrypted. Basement doesn't keep your Google name or profile picture
• your passkeys' public keys, their names and when you saved them. Your face, fingerprint and the passkey's private key never leave your device
• for each sign-in, the kind of device and browser, how you signed in and when, but not its IP address
• when you ask for a sign-in code, your network address next to a keyed hash of your email, for up to 3 days, to limit how many codes go out. The sign-in service also keeps your network address in its rate limits for up to an hour
• your deposit address, the withdrawal addresses you add and their names, which terms version you accepted, your deposits and withdrawals, and changes to your account's security

To send a code or a security email, Basement passes your email address and the message to its email provider, Resend. When the app asks you to confirm you're a person, Cloudflare Turnstile runs the check and receives your network address.

If you turn on notifications, Basement keeps your device's push subscription, which notifications you chose, your time zone offset and the fighters you follow. Reactions are passed along live and never saved.

What other players can see

Your handle is public. Other players see it:

• next to your picks and wins in the live activity line on a card, with amounts, B3 included
• on a Drop you throw, and on the result when your Drop is named Kingmaker
• on a leaderboard in the app, only while you're up for that period
• on a link or clip you share

The page a friend opens from your link never shows an amount or a pick that lost. A clip shows what you won only when your pick won.

Other players never see your balance, your email or your addresses. The share of picks on each side counts people without naming them.

Cookies and browser storage

Basement's own cookie is __Host-bsmt. It keeps you on the same account between visits and lasts 400 days. The server keeps only a hash of it, and signing in replaces it with a new one. Clearing it starts a new guest account, so a guest can't get the old one back.

When you sign in, the sign-in service sets its own: __Host-bsmt-auth.session_token, which lasts 30 days, and while a Google or passkey sign-in is in progress, a cookie that lasts 5 minutes. All of them are readable only by Basement's server.

The wallet also remembers, in this browser only, which way you last signed in (local storage). While a code is on its way, the open tab keeps the email it went to for up to 10 minutes (session storage, gone when the tab closes), so a reload takes you back to code entry. Each time it loads, Basement clears any cookies and storage the old B3 sign-in left in your browser.

Analytics

Basement measures how the app is used with its own anonymous counts and with PostHog.

First-party counts

Events such as a swipe, a pick or a share are recorded with the arena, round, device type and country, and a pick's event also has its amount and currency. They're tied to a random id for that browser tab, never to your account, handle or IP address.

The server also counts steps of signing in and depositing, such as a code sent, a sign-in that worked or failed, and a deposit that arrived or was credited. These counts carry no email, address, account or session.

PostHog

Basement also uses a US product analytics service, reached through Basement's own address. It loads after the first match appears, and never loads if your browser sends Do Not Track or Global Privacy Control. It knows you by a scrambled form of your account id, never the id itself.

It never gets your handle, wallet address, email or B3 balance, and share and invite codes are taken out of the links it sees. An email address that turns up in any text, an error message included, is blanked before it's sent. It keeps its id in your browser's local storage, not in a cookie. The server also sends it a few events of its own, such as a round settling (with no amounts or people), a Kingmaker, or an invite being claimed.

PostHog also records a replay of about 1 in 5 browser tabs. Everything you type is masked, and so are your balance, B3 amounts and handles. The wallet, where you sign in, deposit and withdraw, is never recorded, and neither is the match itself.

PostHog receives your IP address to estimate country and city.