What Herumon Tower collects about you, why, who else sees it, how long it is kept, and what you can ask us to do with it. It describes what the game's server code actually does today; when that changes, this page changes first. Effective date: [EFFECTIVE DATE]. Opened from Settings › Legal & Support › Privacy Policy. The rules for using the game are in the Terms of Service.
The controller of your data is [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. Contact for anything in this policy: [PRIVACY CONTACT EMAIL], or Contact Support in the game.
| Data | Where it comes from | Why | Legal basis (GDPR / LGPD) |
|---|---|---|---|
| Your Steam ID (a 17-digit number) | Steam, when you sign in. We never see your Steam password, e-mail or payment details; we do not call the Steam Web API for your profile. | It is your account: every save, purchase and report is filed under it. | Contract — we cannot run your account without it. |
| Character name | You, at character creation. | Shown to other players on leaderboards and in PvP. | Contract. |
| Game save and history: progress, creatures, items, currencies, settings, the Adventure Log, recent earlier versions of the save | The game, as you play. | To keep your progress, check it for cheating, and roll it back if a bug damages it. | Contract; legitimate interest (preventing cheating and fraud). |
| Wraithgold ledger and purchase records | The game. | To know what you own and what you paid for, and to never charge twice. | Contract; legal obligation (records of sales, once sales open). |
| PvP and leaderboard records: your team snapshot, scores, ranks, match results | The game. | Other players fight a snapshot of your team in Auto PVP; boards are public. | Contract. |
| Session token | Created at sign-in, kept in the ht_session cookie. | Keeps you signed in. | Contract; strictly necessary storage. |
| Age band: whether your answer to the age question was under the consent age, 13–17 or 18+, and the threshold it was judged against | You, once, at first run before character creation (How old are you?). The number you type is not kept. | To keep the game from children under the digital-consent age (see §7). | Legal obligation (COPPA; GDPR Art. 8). |
| IP address | Every request. | Counted in memory to stop one address flooding the server. If an address goes over the limit, it is written to a traffic log with the time and the page asked for, and may be flagged for review. | Legitimate interest (security). |
| Bug reports: your text, its category, the state of the game when you filed it, a recent play log, the build, your browser's user-agent string, your Steam ID | You, when you send a report; and the game itself, which files an automatic report when it detects a fault on your side. | To find and fix bugs. | Legitimate interest (fixing the game); contract for reports you ask us to act on. |
| Adventure Log uploads and a random device ID | The game. The device ID is a random string made by your browser the first time you play; it says nothing about the device itself. | Your Adventure Log chapters are copied to the server so a log written on one device is not lost to another; the device ID keeps each device's copy apart. | Contract. |
| Server metrics: which kind of request was made, its result and a shortened one-way hash of the session; for battles against wild creatures, your Steam ID with the floor, turns and rewards | The server. | To see load and cost, and to balance the game. This is our own server's log, not a third-party analytics or advertising service. | Legitimate interest (running and balancing the game). |
| Anti-cheat observations | The server, when a save or request breaks the game's rules. | To keep rankings and the economy fair. | Legitimate interest (preventing cheating and fraud). |
We do not collect your real name, e-mail, address, phone number, location, contacts or payment card. We use no third-party analytics, advertising or tracking in the game, and nothing follows you to other sites; the Analytics switch in Settings records your choice in advance, and anything ever added must honour it. We do not sell or share your data for advertising, and we make no decisions about you by automated means that have legal or similarly significant effects; the anti-cheat checks reject invalid game actions and a person reviews any action on an account.
The game stores data in your browser so it works; none of it is used for tracking, so no consent banner is shown (EU ePrivacy Directive Art. 5(3) exempts storage strictly necessary for a service you asked for).
ht_session cookie — your sign-in session, HttpOnly, sent only to the game server.| Who | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts the game server and its storage; every request passes through it. | Global network; USA |
| Valve Corporation (Steam) | Sign-in. Valve's own privacy policy covers what Steam does. | USA |
| GitHub, Inc. | Hosts this codex site; bug reports are copied into a private development repository so they can be worked on. | USA |
| Google (Google Fonts) | The codex site loads its typefaces from Google, which receives your IP address when a page opens. | USA |
| Other players | See your character name, leaderboard scores and ranks, and your Auto PVP team. | — |
We will disclose data to authorities only where the law requires it. If the game or its company is sold, the data goes with it under this policy.
Transfers outside your country. Our providers are in the United States. Transfers from the EU, UK and Brazil rely on [TRANSFER MECHANISM — e.g. EU-US Data Privacy Framework certification of each provider, or Standard Contractual Clauses]. For players in Japan, the providers' countries and safeguards are listed above, as APPI Art. 28 requires.
| Data | Kept |
|---|---|
| Account, save, ledger, leaderboard and PvP records | While the account exists; deleted 7 days after you ask to delete the account, except purchase records the law requires us to keep, which stay without your account attached ([RECORD-KEEPING PERIOD, per tax law of GOVERNING LAW]). |
| Earlier versions of your save | A short rolling history, for repairs. |
| Disaster-recovery backups | A copy of each save in a five-day ring: each day's copy is overwritten five days later. Deleting the account deletes its copies. |
| Session | 90 days, or until you sign out. |
| IP addresses in the traffic log | 7 days. An address flagged for review is kept with the flag for 90 days, then the flag row is deleted by a daily sweep (a flag a person clears earlier goes earlier). |
| Adventure Log uploads | 180 days from upload, deleted by a daily sweep; earlier if you delete the account. |
| Server metrics | For Cloudflare Analytics Engine's retention period, after which Cloudflare discards them. |
| Bug reports | 180 days from filing, after which a daily sweep removes your account, play log, context and browser details from the report and keeps only its text (the same anonymisation account deletion applies); a report marked resolved is deleted outright 180 days after it was closed. Deleting the account anonymises your reports at once. |
Depending on where you live (EU/EEA, UK, Brazil, Japan, California and elsewhere) you can ask us to:
Confirming Delete Account (typing DELETE) signs you out on every device and schedules the deletion 7 days later. If you sign in during those 7 days the game shows the date and offers Cancel deletion, which restores everything as it was. After the 7 days the account is deleted for good, within a day:
Signing in with the same Steam account afterwards starts a brand-new account.
We answer within one month (GDPR) or the shorter period your law sets, and we will not treat you differently for using these rights. You can also complain to your data protection authority — for example your EU national authority, the UK ICO, Brazil's ANPD, or Japan's Personal Information Protection Commission. We do not sell personal information and do not respond to “Do Not Track” signals differently, because we do no tracking for them to switch off.
The game is not directed at children under 13, and we do not knowingly collect data from them. At first run, before character creation, the game asks once How old are you? (a neutral question, nothing on the screen says what age is needed). The answer is judged against the digital-consent age of the country the request came from — 13 by default, higher where the law sets it higher (16 in Germany, the Netherlands, Ireland, Croatia, Hungary, Luxembourg, Poland, Romania, Slovakia and Lithuania; 15 in France, Czechia, Greece and Slovenia; 14 in Austria, Bulgaria, Cyprus, Italy, Spain and South Korea) — and the account keeps only the band the answer fell in, never the number. An answer under that age gets no account: the sign-in is signed out on the spot, the deletion described in §6 is scheduled for the identity it created, and signing in again before the deletion only shows the same notice. If you believe a child under 13 (or under the digital-consent age in your country) has an account anyway, tell us and we will delete it.
Traffic is encrypted (HTTPS). Sessions are random tokens checked on the server; saves live in a per-player database object that only the server can write. No system is perfect; if a breach puts your data at risk we will tell you and the authorities as the law requires.
When this policy changes in a way that matters, the game tells you before the change takes effect. Each version is dated, and the changelog below lists what changed.
play/markup.html creation gate, /api/account/age), the account keeps the band only, and an under-age answer takes the Delete Account path at once (§2 gained the Age band row). §5 named no period for bug reports, Adventure Log uploads or flagged addresses because the server had none; it now has retentionSweep (daily, src/worker.js): 180 days for reports (anonymised, resolved ones deleted) and uploads, 90 days for a flagged-address row. Probes: tools/probe_t21_age.py, tools/probe_t21_retention.py.dfmc-client/src/worker.js (delPurge, deleteSweep); §5 retention rows updated to match.dfmc-client/src/worker.js, 2026-10-01): Steam OpenID only, no profile fetch; ht_session cookie, 90-day session; per-IP rate limits with over-limit addresses kept 7 days in the world object's traffic log; reports store text, context, play log, build and user-agent, and screenshots have been dropped since 2026-08-05; Adventure Log uploads to R2 under a client-minted device id; the R2 save mirror is a five-slot daily ring; Analytics Engine carries request classes and, for PvE battles, the Steam ID; no third-party analytics, ads or payment processor. Bracketed fields are company information that does not exist yet; D's ruling put filling them in and a counsel review on the backlog (Legal review of privacy/terms/credits).