Privacy policy

Hearthhold beta · last updated 15 October 2026

Hearthhold is a cozy castle-strategy game that you play in your browser. This page says what the game keeps about you, why, for how long, and how to get it deleted. We try to keep as little as we can.

The short version

You sign in with Google. We keep your Google account id and email address for sign-in and moderation. Other players never see them.
We keep a hashed network address and browser fingerprint for 30 days, only to stop cheating.
We do not sell or share your data, and the game has no advertising or analytics trackers.
You can ask us to delete it at any time: lastblezebub@gmail.com.

Who we are

Hearthhold is run during its beta by the stewards of the realm (“we”, “us”). The game is at hearthhold.harisp.com. You can reach us at lastblezebub@gmail.com.

What we keep, and why

Your Google account id and email

The number Google gives your account and the (verified) email address of your Google account.

Why: So you can sign in, so the game always finds your lord again, and so the stewards can handle moderation: keeping a banned account out, and answering you when you write to us.
Who sees it: You (Settings shows “Signed in with Google as …”) and the stewards. Never other players. It is in no chat, ranking, map, letter or report.
How long: As long as your lord exists in the realm, or until you ask us to delete it.

Your lord

The lord name you choose, your tribe, and the names of your towns and alliance.

Why: It is who you are in the game.
Who sees it: Every player: on the map, in the ranking and in chat. Choose a name that is not your real name if you prefer. We never take it from your Google profile.
How long: As long as your lord exists.

What you do in the game

Your towns, buildings, troops, heroes and items; battle reports; the chat lines you write; letters you send and receive; friends; alliance membership and notices; and when you were last online.

Why: It is the game. Without it nothing would be there when you come back.
Who sees it: Other players see what the game shows them (a town on the map, a chat line in world or alliance chat, a letter to them). If someone reports a message or a letter, the stewards see a copy of it.
How long: As long as your lord exists. If the beta world is reset or ends, it goes with it.

Your honor and realm history

The honor your lord earns by fighting other lords (offense, defense and the total), the lifetime total of all your realms together, and a short history of the realms you played: which realm, the name of your lord there, how much honor you earned and where you finished. It is kept with your Google account id, so that it can follow you to the next realm and your medal comes with you.

Why: Honor is carried over from one realm to the next, which needs something that stays when a realm is reset or ends.
Who sees it: Other players see your honor numbers of the current realm on the Honor board and the medal your lifetime honor has earned beside your name. They never see the account behind it. The stewards see all of it.
How long: Until you ask us to delete it. Unlike the rest of your game data it is kept when a realm is reset or ends; deleting your account deletes it too.

Anti-cheat signals

Which networks and browsers an account is used from and when, how fast its commands arrive, and what moves between accounts. Of your network address only the network part is used, and of your browser only its type, screen size, time zone and language. All of it is run through a one-way hash with a secret key, so nobody can read an address or a browser back out of it.

Why: To notice cheating: one person running several accounts, or a program playing for someone.
Who sees it: The stewards only, in their dashboard. Nothing is ever banned automatically: a steward looks at it and decides.
How long: 30 days, then it is deleted.

Error reports

If the game breaks in your browser it may send us a short report: the error message, the page, your browser type and the game version. Session codes and anything after a “?” in the address are removed before it is stored.

Why: So bugs get fixed.
Who sees it: The stewards.
How long: Reports are grouped and only the most recent groups are kept.

Our server records what it is doing in a log. The log holds no email address, no Google account id, no password or session code and no letters.

What we get from Google

“Sign in with Google” shows you Google’s own window. Google tells our server who you are by sending a signed ID token. We check the signature and use two things in it: the account id and the verified email address. The token also carries the name and picture of your Google profile; we ignore them and do not store them. We never see your Google password, your contacts, your files or anything else in your Google account, and we do not ask for any of it.

Hearthhold’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The Google account information is used only to sign you in and for moderation, and is not used for advertising or sold or given to anyone.

You can stop Hearthhold from using your Google account at any time on your Google account’s connections page. We will not be able to find your lord until you sign in again.

We do not sell your personal information and we do not share it for advertising. The game has no ad or analytics trackers. Your data is shared only with:

the service providers that host the game and keep its backups (a cloud server and, for copies kept elsewhere, an object-storage service). They store it for us and may not use it for anything else;
Google, which handles the sign-in itself under its own privacy policy;
anyone the law obliges us to give it to.

Cookies and local storage

We set no cookies of our own. Your browser’s local storage (not cookies) holds what the game needs to play: a random session code that keeps you signed in, the realm you entered last, and your settings (sound, camera tips, the town you looked at last). Your Google ID token is kept in memory only while you choose a realm, and never stored. You can clear all of it whenever you like; you will only have to sign in again.

Google’s sign-in button is loaded from Google on the sign-in screen only, and Google may set its own cookies for it.

How long we keep it

Google account id and email, lord, game data: while your lord exists in the realm, or until you ask us to delete them.
Anti-cheat signals: 30 days.
Backups of the realm contain the data above and are rotated out within about two weeks.
If the beta world is reset, the data in it is deleted with it. Your honor and realm history stay (see above), until you ask us to delete them.

Your choices and deletion

Settings shows the email address we hold for you. You can ask us for a copy of what we keep about you, ask us to correct it, or ask us to delete it.

To have your data deleted, write to lastblezebub@gmail.com from the email address of your Google account and tell us your lord’s name. We will remove the Google account id and email address from the realm’s records, sign every session out and retire your lord (its towns stay on the map under a neutral name, like any abandoned lord’s) and empty its mailbox. We answer within 30 days. Letters and battle reports that other players already hold keep the name they were written under.

One exception: if an account was banned, we keep its Google account id for as long as the ban lasts, so that the ban holds. We use your data to run the game you asked to play, and to keep the game fair and safe for everyone (moderation and the anti-cheat signals).

If you live where data-protection law gives you more rights (the EU and UK, for example: access, correction, deletion, objection, a copy of your data, a complaint to your authority), you have them; write to us and we will honour them.

Young players

Hearthhold is meant for players aged 13 and over (or the age at which your country allows you to use an online service with a Google account). We do not knowingly collect data from younger children. If you believe a child has signed up, write to us and we will delete the account.

Keeping it safe

The game is served over HTTPS. There are no passwords to leak: sign-in is Google’s. Session codes are stored only as hashes. The stewards’ dashboard needs a secret token and keeps a record of what every steward does. No system is perfect; if something goes wrong with your data we will tell you, as the law requires.

Changes

If we change this policy we will change the date at the top and, for bigger changes, say so in the game’s announcement bar.

Contact

Questions, a copy of your data, or deletion: lastblezebub@gmail.com