This page is maintained by Thieefy GameStudios to answer common privacy questions about Heroes of the Reel. It is app-owned editable content and is not independent legal advice or a certification by any third party.
Who We Are (Data Controller)
Heroes of the Reel is operated by Robin Aashildrød-Kjølner, trading as Thieefy GameStudios (the "seller"). For the purposes of applicable data protection law (including the EU/UK GDPR), the seller is the data controller for personal data collected through the game. Contact us at support@thieefygamestudios.com.
What We Collect
We collect the minimum data needed to run the game and support your account:
- Account data: email address, authentication tokens, and a player display name you choose.
- Game data: coins, diamonds, mana, experience, level, prestige, gear inventory, achievements, skins, battle progress, and shop purchases.
- Device & usage data: browser type, approximate region, session duration, and crash reports to help us fix bugs.
- Cookies & identifiers: we and our advertising partners (such as Google AdSense) use cookies and similar technologies to serve ads and measure their performance.
- Purchase data: when you buy diamonds, our payment processor Paddle collects the personal and payment details it needs to complete the sale (see "Payments & Paddle" below). We receive a transaction reference and the pack purchased, but not your full card number.
How We Use Data & Legal Basis
We rely on the following legal bases under GDPR Article 6 (and equivalents elsewhere):
- Contract (Art. 6(1)(b)): to create and secure your account, save your game progress, display leaderboards and public profiles, and deliver items you purchase.
- Legitimate interests (Art. 6(1)(f)): to analyze gameplay trends, improve balance and performance, prevent cheating and fraud, and respond to support requests.
- Consent (Art. 6(1)(a)): for non-essential cookies and personalized advertising, where required by law. You can withdraw consent at any time via our cookie banner or your Google Ads Settings.
- Legal obligation (Art. 6(1)(c)): to keep tax and accounting records related to purchases, and to respond to lawful requests from authorities.
Payments & Paddle (Merchant of Record)
Our order process is conducted by our online reseller Paddle.com. Paddle is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns. When you buy diamonds, your name, email, billing address, IP address, and payment method are collected and processed by Paddle to complete the transaction, calculate sales tax/VAT, prevent fraud, and issue an invoice. Paddle acts as an independent controller for this payment data. See Paddle's Buyer Privacy Notice and Buyer Terms for details.
Advertising & Third Parties
We use Google AdSense to display ads. Google and its partners may use cookies, device identifiers, and similar technologies to personalize ads and measure ad delivery. You can manage ad personalization through Google Ads Settings and learn more about how Google uses data at How Google uses information from sites or apps that use our services.
Who We Share Data With
- Hosting & infrastructure providers that store the game database and serve the site (acting as our processors).
- Paddle, our Merchant of Record, for payment, tax, invoicing, fraud prevention, and refund handling.
- Google (AdSense) for advertising and measurement.
- Authorities or professional advisers where required by law or to protect our legal rights.
Security
We apply reasonable technical and organizational measures to protect your data, including HTTPS/TLS encryption in transit, encrypted database storage at rest, access controls and least-privilege for admin accounts, hashed authentication secrets managed by our hosting provider, and server-side validation with row-level security so players can only read and modify their own data. Payment card details are handled entirely by Paddle on PCI-DSS compliant infrastructure — we never see or store your full card number. No system is 100% secure; please use a strong, unique password and contact us immediately if you suspect unauthorized access.
Data Retention & Deletion
We keep your account and game data for as long as your account is active. If you delete your account, we will remove or anonymize your personal data within a reasonable period, except where we are required to keep it by law (for example, purchase records that Paddle and we must retain for tax and accounting purposes, typically for up to 7 years). To request deletion, email us at support@thieefygamestudios.com.
Your Rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent at any time. EU/UK/EEA users have the right to lodge a complaint with their local supervisory authority. You can update your display name and other in-game preferences from the Hero page. For other requests, contact us at the email above and we will respond within one month.
International Transfers
Our hosting, Paddle, and Google may process your data outside your country (including in the United States). Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision.
Children
Heroes of the Reel is not directed at children under 13 (or the applicable age of digital consent in your country). We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.
Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page shows when it was last revised. Continued use of the game after changes means you accept the updated policy.