Privacy

What we store about your account

• Your nickname and a password hash. The password is hashed with bcrypt and cannot be read back. No email address, real name, phone number or date of birth is asked for or stored.
• Game data. Games you play, your bids and results, coins, cards, decks, market listings and offers, draft teams, duel results and streaks.
• Feedback you send. The category and text of messages sent through the feedback bubble, linked to your account so we can follow up in the game.
• Online status. While you have the game open, the server knows you are connected so friends can challenge you. Nothing about this is kept afterwards.

Cookies

• session (necessary): keeps you signed in for up to 90 days. It is HTTP-only and never readable by scripts.
• Google Analytics (optional): only set if you answer “Sure!” to the cookie question. It gives us anonymous statistics about which parts of the game get played. Nothing is sent to Google before you answer, and answering “No thanks” keeps it that way. To change your answer, clear the site data for herodrafts.com in your browser and you will be asked again.

Third parties that see your IP address

Like any website, the servers that deliver the game see your IP address in order to send you the page:

• Render (the game server) and Cloudflare (network proxy in front of it).
• Turso, where the database lives. It only sees the server, not you directly.
• The image hosts for character art: akabab.github.io, the Fandom wiki CDN and StarWars.com's Databank CDN.
• Google Analytics, but only after you have said yes to it.
• YouTube, but only if you press play on the trailer on the front page. Until then nothing is loaded from YouTube.

None of them receive your nickname or game data from us.

What we do not do

• No ads, no ad networks, no tracking pixels.
• No selling or sharing of data with anyone.
• No chat between players, so there is nothing to moderate or store.
• No real-money purchases. Coins and dollars in the game are pretend.

Children

The game is designed so that a child can play without giving away anything personal: a made-up nickname is all that is needed. Parents who want a child's account and its data removed can ask through the feedback bubble from that account, or from their own.

Deleting your data

Send a message through the feedback bubble while signed in and ask for your account to be deleted. The account, its cards, coins, listings and results are then removed. Aggregated game statistics that no longer identify you may remain.

Changes

If what we store changes, this page changes with it, and the date at the top is updated.