Privacy Policy

Last updated: 2026-10-08.

This Privacy Policy explains what personal data HeroBrowser (the "Service") collects, why, and what rights you have over it under the EU General Data Protection Regulation (GDPR).

1. Who Controls Your Data

The data controller for the Service is:

Privacy requests: privacy@herobrowser.app. The controller's full identification is on the Company Information page.

2. What We Collect

• Guest play: nothing on our servers. Your progress is stored only in your own browser's local storage and never reaches our servers.
• Google sign-in: the Google account identifier, email address, display name, and profile picture URL that Google gives us when you sign in.
• Email/password accounts: your email address and a securely hashed password. We never see or store your password in plain text.
• Game save data: your character progress, floor reached, equipped gear, in-game currency balances, gifts and mailbox contents, and your Trading Post listings and purchases, tied to your account.
• Summon history: the last 100 items you received from the in-game Summon, with the time of each summon and whether it used tickets or diamonds, tied to your account so you can review your past summons. Older entries are dropped automatically.
• Purchase records: when you buy Gold Diamonds, we keep a record of the pack purchased, the price paid, the date, and its status (paid, refunded, or disputed), together with a Stripe payment reference (a Checkout session or payment intent id) used to reconcile refunds and disputes. We do not receive or store your card number — Stripe processes your payment directly.
• Crash reports: if the game hits an error or an unhandled rejection on your device, your browser automatically sends us a report so we can find and fix the bug. A report contains the error's kind, name, and message, a short portion of its stack trace, the page path you were on (never the full URL or any query string), a build identifier, the active game scene, whether you were signed in or a guest, your locale, and your browser viewport size. If you are signed in, the report is attached to your account; a guest's report is not identified to anyone.
• Activity telemetry: for each day you play while signed in, we record your account id and that calendar day only — no gameplay details, no event payloads — so we can measure day-level player retention internally.
• Referral program (when enabled): if you use a referral link or code, we record which account referred which other account, so the referral reward can be paid to both. A referral code you have not yet redeemed is held temporarily in your browser's local storage until you sign in.
• Public leaderboard: if you sign in, your chosen display name, hero class, hero nickname, the floor and level you reached, and any title, name frame, or skin you have equipped may appear on the public leaderboard, visible to anyone. There is a board for each difficulty tier, an all-time board ranked by level, an all-time board for the deepest "vowed" clear, and a board for each difficulty tier that resets every season. The website's landing page also shows the top rows of the season board, refreshed on a schedule rather than live. We never show your email address there.
• Live events schedule: the in-game "what's currently running" schedule is fetched without sending or requiring any personal data.
• Technical data: your IP address may be processed briefly by our infrastructure to prevent abuse (rate limiting) and is not stored against your account afterward.

We do not run ad networks or sell your data to third parties. Our public site pages (not the game itself) load a cookie-free page-view analytics beacon from Cloudflare — see Who We Share It With below.

3. What We Store In Your Browser

Some data lives only in your browser's local storage and is never sent to, or held on, our servers as part of any account record:

• Your sign-in session — a session token and your display name, so a returning player doesn't have to sign in again on the same device.
• An operator console session — present only on staff devices that use the internal admin console; ordinary players never have this.
• A pending referral code — the code from a share link you followed, held until you sign in so it can be redeemed automatically.
• Your guest save, if you play as a guest — your entire character progress, stored only in your own browser and never uploaded to our servers (see "Guest play" above).

We do not use any other browser storage beyond what is listed here and the Cloudflare analytics beacon described below.

4. Why We Process It

• Performance of our contract with you: creating and running your account, saving your progress, and fulfilling purchases.
• Legal obligation: keeping purchase and transaction records for accounting and tax law.
• Legitimate interests: preventing cheating, fraud, and abuse, keeping the Service secure and running, fixing crashes, and running our referral program.
• Consent: We do not send marketing email. If we ever ask for consent for something new, we will ask separately and you can withdraw it at any time.

5. Who We Share It With

We use the following processors, each only for the purpose described:

• Google LLC — verifying Google sign-in.
• Stripe, Inc. — processing real-money purchases; Stripe receives your payment details directly and we never see your full card number.
• Resend — sending transactional email (sign-up verification, password reset) if you use an email/password account.
• Microsoft Ireland Operations Limited (Microsoft Azure) — hosting infrastructure that stores your save file, crash-report logs, and activity telemetry (currently deployed on Microsoft Azure, in United States regions).
• Cloudflare — content delivery and a cookie-free page-view analytics beacon on our public site pages; this does not touch your account data.

Our hosting (Microsoft Azure, United States regions), payment processing (Stripe) and sign-in (Google) may process data outside the EU. Each of these providers is bound by the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.

6. How Long We Keep It

We keep your account and game save data for as long as your account is active. Purchase and payout records are kept for 7 years, the period Dutch tax law requires. Crash reports and activity telemetry are kept in server logs for 30 days (the retention configured on our Azure Log Analytics workspace), and are not linked back to your account beyond that window. Referral program records (which account referred which) are kept for as long as your account is active, for reward bookkeeping. We delete or anonymize data once it is no longer needed, unless law requires us to keep it longer.

7. Your Rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten");
• restrict or object to certain processing;
• receive your data in a portable format; and
• lodge a complaint with your national data protection authority the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

8. How to Exercise Your Rights

Email privacy@herobrowser.app with your request. We will respond within the time required by law (normally one month).

9. Children

The Service is not directed at children under 16. We do not currently verify age at sign-up. If you believe a child has given us personal data, contact us so we can delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised policy here with a new "Last updated" date.

11. Contact

Questions about this policy: privacy@herobrowser.app.