The short version. We collect only what we need to run an online game: your username, a scrambled (hashed) version of your password, your game progress, and the messages and trades you make in the game. There are no ads, no analytics or tracking SDKs, and we never sell or share your data with advertisers. We don't ask for your email address, location, contacts or photos. You can delete your account in the app at any time, and your data is stored in the EU.
Who we are
Hearthvale, the game for iPhone (the “app”), its game servers and this website, hearthvale.app, are made and run by Cal Bass, an individual developer based in the United Kingdom (“we”, “us”). We are the data controller for the information described here. This policy explains what information the app and the game servers process, why, and the choices you have. If you have a question about it, write to support@hearthvale.app.
Information we collect
Your account
- Username. The name you choose when you sign up (1–12 letters, numbers or spaces). It is shown to other players in the game.
- Password. We never store your password itself. The server keeps only a salted scrypt hash, a one-way scrambled value that lets us check your password when you sign in.
- Account dates. When the account was created and when you last signed in.
- Terms acceptance. When you agreed to the Terms of Use and which version you agreed to.
- Moderation status. If your account is muted or banned, until when and the reason.
Your game
- Progress and inventory. Your character's appearance, skill levels and experience, hitpoints, inventory, equipment, bank, coins, quest progress and where you are in the world.
- Social lists. Your friends and ignore lists (as usernames) and the clan chat channel you have joined.
- Grand Bazaar offers and trades. Your buy and sell offers, and a record of completed Bazaar trades (item, quantity, price, time and the buyer and seller accounts). Recent trade prices are used to show guide prices to all players.
- Player-to-player trade logs. When you trade directly with another player, we keep a record of who traded with whom, what each side gave and when. We use these logs to help with support requests, and to investigate scams, cheating and abuse.
Chat and private messages
Public chat, clan chat and private messages pass through our servers so they can be delivered to other players. Public chat is visible to players near you, clan chat to members of that channel, and private messages to the recipient. An automatic profanity filter is on by default. Our servers relay messages in real time and keep the last few lines from each player in memory only, so that they can be attached to a report. Please don't share personal information in chat.
Reports
When you report a player, we store the report so a moderator can review it: your username, the reported player's username, the reason you chose, any note you added, the time, and a copy of the reported player's recent chat (up to their last 20 public chat lines and the private messages they sent you, with times). If someone reports you, the same is stored about your messages. We use reports only for moderation, such as removing content and muting or banning players who break the Terms of Use.
Connection and security data
To connect you to the game, our servers see the IP address your connection comes from. We use it to limit sign-in attempts and account creation (to stop password guessing and spam) and to protect the service. IP addresses also appear in our server logs, for example when an account is created or signs in. As with any internet service, our hosting and network providers (listed below) also process connection data such as IP addresses to deliver and secure traffic.
Stored on your iPhone
- Session token. After you sign in, the server issues a random session token. The app stores it in the iOS Keychain on your iPhone so it can sign you in automatically next time. The server accepts each token for up to 30 days. Signing out or deleting your account removes it.
- Preferences. Settings such as music and sound volume, graphics quality, haptics, which hints you've dismissed and (if you leave “remember me” on) your username are stored locally in the app's preferences on your device. They are not sent to us.
What we don't collect
- No analytics, tracking, advertising or crash-reporting SDKs. The app contains no third-party code that collects data; it talks only to our own game server.
- No advertising and no ad networks.
- No tracking. We don't track you across other companies' apps or websites, and we don't access the advertising identifier (IDFA).
- No sale or sharing of your information with third parties for their own purposes.
- No location, no contacts, and no access to your photos, camera, microphone or health data.
- No email address or real name is needed to play. We only receive your email address if you write to us.
- No payment information. The game has no in-app purchases.
This website
hearthvale.app is a static website. It sets no cookies and runs no analytics or advertising scripts. Like any web host, our network provider processes the IP address and basic request details of visitors in order to serve and protect the site.
How we use information
- To run the game: create your account, sign you in, save your progress and deliver your messages and trades.
- To run the Grand Bazaar and show guide prices.
- To keep the game fair and safe: preventing cheating, scams, spam and abuse, reviewing reports, and enforcing the Terms of Use.
- To answer your support requests.
If you are in the EU, UK or a similar jurisdiction, we process this information because it is needed to provide the game you asked for (performance of a contract) and for our legitimate interests in keeping the service secure and free of abuse.
Where your data is stored and who processes it
Your data is stored in the EU. The game servers, their database and its backups are hosted by Railway in its EU West region (Amsterdam, the Netherlands). Traffic to the game servers and to this website passes through Cloudflare, which provides our network, TLS encryption and protection against attacks. These providers act as our processors: they handle data only to provide their services to us. Cloudflare operates a global network, so connection data may be processed in data centres near you.
We don't share your information with anyone else, except where the law requires it (for example, a valid legal request) or where it is needed to protect players or the service from serious harm.
Other players can see what the game shows publicly: your username, your character, your public and clan chat messages, and your offers when you trade with them.
How long we keep it
- Account, progress and social data: for as long as your account exists.
- Session tokens: up to 30 days, or until you sign out.
- Reports, including the chat lines attached to them: up to 12 months, then deleted.
- Trade records and server logs: only as long as needed for support, security and moderation, after which they are deleted or anonymised.
- Backups: the database is backed up once a day and each backup is kept for 7 days. Anything deleted from the game, including a deleted account, is gone from all backups within 7 days.
Deleting your account and your rights
In the app: go to Settings → Delete account and confirm with your password. Deletion is immediate and permanent. We delete your account, password hash, session tokens, character and progress, inventory, bank, friends and ignore lists and open Grand Bazaar offers, your username becomes free for others, and the app removes its session token from your Keychain. It can't be undone.
By email: if you can't sign in, email support@hearthvale.app with your username and the subject “Account deletion”. Because accounts have no email address attached, we may ask you to confirm that the account is yours first.
After deletion, records of completed trades stay only as anonymous entries that are no longer linked to any account, and reports you made or that were made about you are kept for moderation for up to 12 months. Deleted data disappears from our backups within 7 days.
You can also email us to ask for a copy of your data, to correct it, or to object to how we use it. If you are in the EU or UK you also have the right to complain to your local data protection authority.
Deleting the app removes the preferences stored on your device. iOS may keep the Keychain session token until it expires; signing out in the app before deleting it removes the token right away.
Children
Hearthvale is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us and we will delete it.
Security
Passwords are stored only as salted scrypt hashes, release builds connect to the game over an encrypted connection (TLS), and session tokens on your device are kept in the iOS Keychain. No system is perfectly secure, so please use a password you don't use anywhere else.
Changes to this policy
If we change this policy, we'll post the new version here and update the effective date above. If the changes are significant, we'll also let players know in the game.
Contact
Questions, requests or concerns about privacy: support@hearthvale.app.