Privacy policy

Heirs · last updated [PLACEHOLDER: date of publication]

This policy explains which personal data the game Heirs — the app for iOS and Android and the servers behind it — processes, why, on which legal basis, for how long, who receives it and which rights you have. It follows Article 13 of the General Data Protection Regulation (GDPR).

1. Who is responsible

The controller is [PLACEHOLDER: company or legal name], [PLACEHOLDER: postal address]. For anything about your data, write to [PLACEHOLDER: privacy contact email]. The full provider details are in the Impressum.

Data protection officer: [PLACEHOLDER: name and contact of the data protection officer, or a statement that none is appointed].

2. In short

3. What we process, why and for how long

3.1 Your account

What
Your email address; your password, stored only as a one-way bcrypt hash that cannot be turned back into the password; the account's role; when the account was created, last changed and last signed in; and the moment from which earlier sign-ins stop being valid (set when you sign out everywhere, change or reset your password, or delete the account).
Why
To create and run your account and to let you sign in.
Legal basis
Performance of the contract, Art. 6(1)(b) GDPR. An account cannot be created without an email address and a password.
How long
Until you delete the account.

3.2 Your game

What
Your houses and everyone in them (characters with their names, traits, relations and life events), items, gold, house platin, buildings, research, quests, actions and their timers, the house's timeline, auction listings and bids, tournament entries and prizes, a buried chest, and short-lived records of game operations that stop the same action from being applied twice (deleted after 48 hours).
Who sees it
Other players see your house where the game shows it to them: in the Hall of Legends (rank, name, status, reputation and generations, and — for players with a high enough Embassy — the characters of a living house), at the auction house and in tournaments.
Why and legal basis
To provide the game, Art. 6(1)(b) GDPR.
How long
Until you delete the account. Auction records that involve other players remain afterwards, with your house shown as departed and no longer linked to you.

3.3 Devices and sign-in sessions

What
For each app installation you sign in on: a random installation ID created by the app, the platform (iOS, Android or web), the app's build number, when the installation was first and last active, and up to which point it has shown you your house's timeline. For each sign-in: a session record with its creation, last use, expiry and, once ended, the reason. The server stores no password and no sign-in token in readable form, only one-way hashes of the tokens.
Why
To keep you signed in, to end sign-ins when you sign out or change your password, and to protect your account (each device holds at most one active session).
Legal basis
Art. 6(1)(b) GDPR; for the protection of accounts also Art. 6(1)(f) GDPR — our legitimate interest in a secure service.
How long
As long as the account exists.

3.4 Security log (sign-in records)

What
A record of security-relevant events: sign-ins, sign-outs, ended sessions (including “sign out everywhere”), password resets and changes, and the reuse of an already replaced sign-in token, which can be a sign that it was stolen. Each entry holds the kind of event, the time and identifiers of the session and the platform. Today this log stores no IP address.
Why
To detect and investigate attacks on accounts.
Legal basis
Art. 6(1)(f) GDPR — our legitimate interest in the security of accounts and of the game.
How long
[PLACEHOLDER: retention of security-log entries — the code deletes none today; 90 days are planned, see below]. When you delete your account, every link to you is removed from these entries: the account, the session and the platform. What remains is only that an event of a given kind happened at a given time. One further entry records that an account was deleted; it names no one and holds only counts (for example, how many houses were deleted).

Coming change. The sign-in log will be extended. Each sign-in will also record a shortened IP address — for IPv4 the first three of its four parts (a /24 network), for IPv6 the first 48 bits (a /48 network), never the full address — and the family of browser or operating system the sign-in came from, never the full browser identification. These entries will be deleted after 90 days, and when you delete your account the shortened IP address and the browser or operating-system family are wiped at once. Purpose and legal basis are as above. In effect from: [PLACEHOLDER: date the change takes effect].

3.5 Password reset emails

What
When you ask to reset your password, we email a link to your account's address. The link works once and for 30 minutes. We store only a hash of it, together with when it was issued, used or replaced by a newer one.
Who
The email is sent through Amazon Simple Email Service (Amazon Web Services, EU region).
Legal basis
Art. 6(1)(b) GDPR.
How long
The record of the link is kept as long as the account exists. We send no newsletters and no advertising email.

3.6 Push notifications

What
Only if you allow notifications on your phone: the installation's push address (an Expo push token and the underlying Apple or Google device token), the language notifications are written in, a count of failed deliveries, your choice for each kind of notification (Ready to collect, Energy restored, Family, Auctions, Arena, Your line — Energy restored is off unless you turn it on), and reminders scheduled for timers in your game (kind, due time and the action they belong to). Notifications name no item, no amount and no other house.
Who
Expo (650 Industries, Inc., USA) passes notifications to the Apple Push Notification service or Google Firebase Cloud Messaging, which deliver them to your phone.
Legal basis
Your consent through your phone's notification permission, Art. 6(1)(a) GDPR, and Art. 6(1)(b) GDPR for delivering the notifications you chose. You can withdraw at any time in your phone's settings or switch each kind off in the game's settings.
How long
The push address is removed when the last sign-in on that installation ends and when the account is deleted. Reminders are deleted 7 days after they were sent or cancelled.

3.7 Platin purchases

What
You buy platin through the App Store or Google Play; we never receive your payment details. RevenueCat, Inc. (USA) verifies purchases with the store on our behalf. We give RevenueCat only a random purchase ID created by our server — never your email address — and the app's RevenueCat component runs with its diagnostics and its automatic collection of device identifiers switched off. For each purchase we store the store, the product, the store's transaction ID, the platin amount, the price and currency, whether it is pending, granted or refunded (with the store's refund reason), whether it was a test purchase, and each change it made to your platin balance. With your account we store your bought-platin balance, your spending limit and any raise of it that is still waiting.
Why
To deliver what you bought, to handle refunds, to apply the spending limit and the purchase hold, and to keep the records the law requires.
Legal basis
Art. 6(1)(b) GDPR; for records we must keep by law, Art. 6(1)(c) GDPR.
How long
The balance, the purchase ID and the spending limit end with the account. The purchase records are kept after the account is deleted, with no link to you, for [PLACEHOLDER: statutory retention period for accounting records, e.g. 7 years under § 132 BAO (Austria) or 10 years under § 147 AO (Germany)]. When you delete your account, we also have RevenueCat delete its customer record.

3.8 Crash reports

What
When the app crashes or hits an error, it sends to Sentry: the error, the addresses of the requests just before it (without their contents or query parameters, and with identifiers replaced), the app's version, an anonymous ID of this installation and technical details of the phone such as its model and operating-system version. Never a name, an email address, a password or your account. Email addresses, tokens and identifiers are removed on the phone before a report leaves it.
Who
Sentry (Functional Software, Inc.), stored in its EU data region.
Legal basis
Art. 6(1)(f) GDPR — our legitimate interest in finding and fixing errors. You can object at any time by turning off “Send crash reports” in the app under Settings → Privacy; sending stops at once.
How long
[PLACEHOLDER: retention period of crash reports configured at Sentry].

3.9 Server logs

What
Our server logs each request it receives: time, method, path, result, duration and size, the IP address and the browser or app identification (user agent) of the requesting device, and a request ID. Errors are logged with the same details. Email addresses are never written to the logs. [PLACEHOLDER: confirm the fields and retention of the web server's (nginx) access log]
Why
To run the service, find errors and defend against attacks and abuse.
Legal basis
Art. 6(1)(f) GDPR — our legitimate interest in a working and secure service.
How long
[PLACEHOLDER: retention period of server logs — the code configures no rotation or deletion today]. Logs are kept after you delete your account until this period ends.

3.10 Backups

The database is copied every night into an encrypted, non-public storage bucket at Amazon Web Services in Ireland. Each copy is deleted after 30 days, and a replaced copy at the latest 7 days after that. Data of a deleted account can therefore remain in a backup for up to 37 days. Backups serve only to recover from a failure. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in not losing the game's data.

3.11 On your phone

The app keeps on your phone: your sign-in token and the installation ID in the phone's secure storage (iOS Keychain or Android Keystore, never synced to another device), and your settings such as sound, haptics, language and crash reports. They are removed when you uninstall the app.

3.12 Support and moderation

Coming change. Our staff will work from a separate, protected staff console, to help with support requests and to enforce the rules of the game. Each time a staff member views an account or acts on it, a record is kept: who acted, on which account and house, what was done and why, and any message sent to you. These records are kept after an account is deleted, but the reference to the account is removed from them. Records of views are deleted after [PLACEHOLDER: 1 year], records of actions (such as a warning, a forced rename, a ban or a compensation) after [PLACEHOLDER: 7 years]. Purpose: to make every staff access accountable and to protect you against its misuse. Legal basis: Art. 6(1)(f) GDPR, and Art. 6(1)(c) GDPR where the law requires us to document. In effect from: [PLACEHOLDER: date the change takes effect].

4. Recipients

The service providers process data on our behalf under a data processing agreement (Art. 28 GDPR). [PLACEHOLDER: confirm the contracting entity and the data processing agreement for each provider]

5. Transfers outside the EU

Expo, RevenueCat and Sentry are companies based in the USA, as are Apple and Google. Where data reaches the USA, the transfer is based on [PLACEHOLDER: for each provider, its certification under the EU–US Data Privacy Framework or the EU Standard Contractual Clauses]. Sentry stores crash reports in the EU.

6. Your rights

You have the right to:

To use these rights, write to [PLACEHOLDER: privacy contact email]. We answer within one month.

If a store refunds a second purchase of yours within 12 months, new purchases are put on hold automatically until they have been reviewed; platin you already hold can still be spent. You can contest the hold at [PLACEHOLDER: contact for appeals], and a person will review it. We make no other automated decisions about you.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. The authority responsible for us is [PLACEHOLDER: competent supervisory authority, e.g. Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, www.dsb.gv.at, if the controller is established in Austria].

7. Children

[PLACEHOLDER: minimum age for using Heirs and how it is ensured — under Art. 8 GDPR the age of digital consent is 14 in Austria and 16 in Germany]. Purchases follow the parental controls of the App Store and Google Play: a purchase that waits for a parent's approval stays pending and credits nothing until it is approved.

8. No advertising, no tracking

Heirs shows no advertising, contains no analytics or advertising tool, does not read the advertising ID and does not track you across other apps or websites. We do not create profiles of you.

9. Changes to this policy

We update this policy when the game changes how it handles data; the date at the top shows the current version. [PLACEHOLDER: how significant changes are announced, e.g. in the app]