HeartShard

Privacy Policy

Version 2026-11-03 · Last updated: 3 November 2026

In short: we keep only what we need to run the game. We only take your e-mail address and a one-way hash of your password if you make your account permanent. The data lives on a server in Germany (Nuremberg, EU); an encrypted copy of the backups is in Finland (Helsinki, EU). We show no ads in the game, never sell your data and use no tracking tools or ad pixels; we measure whether our ads work only by the campaign label in the link and by totals. You can delete your account from inside the game.

1. Who we are

HeartShard is a browser game developed and run by an independent developer ("we", "us"). We are the data controller under the EU General Data Protection Regulation ("GDPR") and the Turkish Personal Data Protection Law No. 6698 ("KVKK"). For any question or request: support@heartshard.com.

2. What we process

• Guest account: a randomly generated session token and an account number. The token stays in your browser's local storage; the server keeps only a one-way hash of it (SHA-256).
• Permanent account: your e-mail address, a one-way Argon2 hash of your password (we never store or see the password itself), your year of birth (for the age limit only), and when you accepted the Terms of Use and this policy, and which version.
• Sign in with Google: if you choose "Sign in with Google" or save your guest account with Google, Google sends us your Google account's permanent ID number ("sub") and the e-mail address Google has verified. We keep these two to take you to the same account each time and to link an account opened with the same e-mail to your Google account. Your Google name, profile picture and anything else from Google are not stored, and we never see your Google password. An account opened with Google has no password and is not asked for a year of birth.
• Game data: your characters' names and looks, levels, items, gold, bank, quests, position on the map and play time; friends, guild, in-game mail, auction and trade records.
• Settings and block list on your account: so they are the same on every device, your key bindings, sound, chat and swear filter, gameplay settings and the players you blocked are kept on your account; the interface layout, interface size, camera and frame rate are kept per kind of device (computer, tablet, phone). Your language choice stays on your device only.
• Login records: each time you enter the game, the time, the kind of login (password, Google, guest, sign-up), the kind of device (only the browser and operating system family, such as "Chrome · Android"), your IP address in masked form (e.g. 85.105.x.x) and a one-way hash of your IP address made with a secret key. They let you see your recent logins in Settings → Account, power "Log out everywhere" and help us notice a banned account coming back as a new one. Moderators cannot see them.
• Ad source: if you came through an ad or a shared link, the link's campaign label (utm_source, utm_medium, utm_campaign or ref; e.g. "instagram/november") is written to your account once, when it is created; "davet" if you came through an invite link, "dogrudan" (direct) if through no link. Ad platforms' click ids (such as gclid, fbclid, ttclid, msclkid) are never read and are removed from the address bar. The label is not written to your device.
• Password reset: if you use "Forgot password?" and your e-mail address belongs to an account, we send a 6-digit code to that address. We keep only a salted one-way hash (SHA-256) of the code, which account it is for, how many wrong tries it has had and when it stops working. We use your e-mail address only for logging in and password resets; we send no newsletters or ads.
• Chat: chat messages are not stored on the server. When a player reports someone, the chat lines before the report are saved with it for review.
• Player letters: letters between players (subject, text, attachments) are stored on the server: until the reader deletes them; unread ones, or ones whose attachments still wait, for at most 30 days (then they go back to the sender or end). When the reader deletes a letter its text is erased at once. When an account is deleted, its mailbox and the text and name of the letters it wrote are erased. The admin panel cannot see a letter's text; the record of large letters holds only who, to whom and what.
• Bug reports: the text you write, your character, map and position, game version, browser details (user agent), screen size, language and time.
• Crash reports: if the game page hits an unexpected error, the error's message and location, the game version, your character number and a coarse device class (phone, tablet or computer; the browser's family, such as Chrome or Safari; the device memory the browser reports, in GB) are sent automatically. Identical errors are grouped into one record; a record not seen for 30 days is deleted.
• Cheat detection: the server records actions that break the game's rules (for example moving or sending requests too fast) with the character and account number, the kind and the time. These records are deleted after 30 days; the suspicion score worked out from them, which fades over time, is deleted with the character.
• Moderation and security: warnings, mutes and bans; an audit log of admin actions. Your IP address is processed on the fly for connection and abuse limits and may stay in server logs for a short time. A new account opened from the same IP hash as a banned account, or from a browser that still held a banned account's session, is flagged for review; this is not an automatic ban, a person decides.
• Moderators: the moderators we appoint to keep the game in order see players and reports; they can warn, mute for up to 24 hours, remove a player from the game, and close reports and bug reports. They cannot see e-mail addresses or IP details and cannot ban. When your report or bug report is closed, you get an in-game letter; it never names the player you reported or quotes your note.
• Statistics: which days an account played (by account number) and totals such as players online; how many of the accounts made on a day came back on the 1st, 7th and 30th day (by ad source) and in which act of the main story new players stop, kept as totals only.

3. What stays on your device

We use no cookies. Your browser's local storage keeps your session token, the character you played last and your game settings, and your e-mail address if you choose "Remember me". If you choose to, your password is kept only by your browser's own password manager; we never write it to local storage. All of the game's files, fonts included, come from our own server. The one exception is Sign in with Google: its button is loaded from Google's servers (accounts.google.com) only on the start screen and in the form that saves a guest account; Google then processes your IP address and browser details under its own privacy policy and may use its own cookies. Nowhere else in the game does a request go to another company's servers. We use no advertising, analytics or tracking services: there is no ad platform pixel or tag (such as Meta, Google or TikTok) in the game, and we take no device fingerprint. The campaign label of a link is not written to your device.

4. Why we process it (legal bases)

• To provide the game, keep your account and progress (your account's settings and block list included) and let you log in (Sign in with Google included): performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• To protect your account (recent logins, logging out everywhere), notice ban evasion, and measure with totals which ads bring players and whether players stay: legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• To apply the age limit and record your acceptance: legal obligation and legitimate interest (GDPR Art. 6(1)(c) and (f); KVKK Art. 5(2)(ç) and (f)).
• To prevent cheating and abuse, protect players, handle reports and bug reports, and keep the system secure and backed up: legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• To answer lawful requests: legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).
• To send a reset code to your e-mail address when you forget your password, so you can get back into your account: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).

We do not use your data for marketing and do no processing that relies on consent.

5. Where the data is kept, and transfers

The game's server and database run on a server we rent in Hetzner's Nuremberg (Germany, EU) data centre. Hetzner hosts it for us and may not use your data for its own purposes. An encrypted copy of the nightly backups is kept in a storage space in Hetzner's Helsinki (Finland, EU) data centre; only we hold its key. For players in Türkiye this is a transfer abroad, made under the conditions of KVKK Art. 9 and only as far as needed to provide the service.

If you sign in with Google, the sign-in itself is run by Google LLC (USA) under its own privacy policy, as an independent controller for it; it passes us only the two items in section 2. We send Google none of your game data.

We never sell your data or share it with anyone for advertising. We may share it with the authorities only when the law requires it.

Sending e-mail: password reset e-mails are sent through the Google Workspace account of the heartshard.com domain. Google is our processor for this: it handles your e-mail address and the e-mail's content only to deliver the e-mail and may not use them for its own purposes. Google's servers may be outside the EU and Türkiye, so this is a transfer abroad, made under the conditions of KVKK Art. 9 and only as far as needed to deliver the e-mail.

6. How long we keep it

• Account data is kept while the account exists.
• Deleting your account: in Settings → Account → "Delete my account", type your password (an account opened with Google, which has no password, holds the button instead). The account waits 30 days; logging in during that time (with Google too) cancels the deletion. After 30 days the account, its characters and the data tied to them are deleted for good, and your character names become free for others. A guest account is deleted right after you confirm.
• Backups: the database is backed up every night; the backups and their encrypted off-site copies (Helsinki) are kept for 14 days, so deleted data leaves the backups within 14 days at most.
• Login records are deleted after 30 days.
• The ad source label is removed from the account 35 days after it was created; only totals by source and day remain.
• The record of which days an account played, by account number, is deleted after 3 days; the totals counted from it remain.
• Password reset codes work for 15 minutes; one is deleted as soon as it is used, and within an hour of expiring otherwise.
• IP addresses of admin panel logins are deleted after 30 days.
• Records that concern other players (a reported chat, a moderation record kept by account number) may remain after your account is deleted, to keep the game fair and safe.
• Guest accounts not used for a long time (at least 12 months) may be deleted.

7. Security

Connections are encrypted with HTTPS. Passwords are stored as Argon2 hashes and session tokens as SHA-256 hashes; the IP hash in login records is made with a secret key held on the server. The off-site backup copy is encrypted. The database is not reachable from the internet; only the authorised operator can access the server, with a key. No system is perfectly secure; if a data breach happens we will inform you and the competent authority as the law requires.

8. Age limit

Permanent accounts are for players aged 16 and over; we ask for your year of birth when you sign up, and nobody under 16 can create a permanent account. Playing as a guest or with Google also confirms that you are 16 or older. If we learn that we hold data of someone under 16, we delete that account.

9. Your rights

You have the right to access your data, have it corrected, have it deleted, restrict its processing, receive it in a portable format, and object to processing based on legitimate interest (GDPR Art. 15–21). Under KVKK Art. 11 you may also ask whether and how your data is processed, who it was transferred to, have third parties told of corrections or deletions, object to a result reached solely by automated analysis, and claim compensation for unlawful processing.

Write to support@heartshard.com from the e-mail address of your account; we answer within 30 days. If you are not satisfied, you may complain to the data protection authority of the EU country where you live, or to the Turkish Personal Data Protection Authority (KVKK).

10. Changes

If we change this policy we publish the new version on this page and update its version date. Permanent accounts are shown the new version and asked to accept it at their next login.