Privacy policy
This policy explains which personal data HnH Games handles when you use the HnH Hero site, launcher and server, and what your rights are under Brazil's General Data Protection Law (LGPD, Law 13,709/2018).
1. Who looks after your data
HnH Games is the controller of the data described here. For any privacy matter, contact the staff on the official Discord, linked in the site footer.
2. Data we collect
| When | Data |
|---|---|
| Sign-up | username, e-mail, password (stored only as a hash, never as text), preferred language, sign-up date and IP address |
| Site login | session cookie, IP address, browser and access time |
| Account actions | security log of the action (such as a password change), IP, browser and time |
| In game | characters, items, gold, progress, guild, in-game mail messages, reports and server access logs |
| HnH-Cash purchases | package, amount, order status and IP. Card or bank details are handled only by the payment provider: we never receive them |
We do not ask for documents, address or phone number.
3. What we use it for
- Creating and keeping your account, authenticating logins and confirming your e-mail (performance of contract).
- Sending sign-up confirmation and password reset e-mails.
- Protecting accounts and the game from fraud, bots and abuse, and enforcing the Rules (legitimate interest).
- Processing HnH-Cash purchases and meeting legal and tax obligations.
- Showing public rankings with character names, level, class, guild and PvP and war statistics.
4. Cookies
The site only uses necessary cookies:
- hnh_session: keeps you signed in. It is protected (httpOnly) and we store only a hash of the token.
- NEXT_LOCALE: remembers the language you chose.
Sign-up and login use Cloudflare Turnstile to stop bots; Cloudflare processes technical browser data for that check. We do not use advertising cookies.
5. Who we share it with
We never sell your data. It is only shared with those who help us run the service: hosting, e-mail delivery, Cloudflare (bot protection) and the payment provider, each with only what it needs. We may also provide data when the law or a court order requires it.
6. How long we keep it
- Account and game data: while the account exists.
- Access logs (IP, date and time): at least 6 months, as Brazil's Internet Civil Framework (Marco Civil da Internet) requires.
- HnH-Cash orders: for the period required by tax law.
When an account is deleted, we erase or anonymize its data, except what the law requires us to keep.
7. Your rights
You may ask at any time for: confirmation that we process your data, access to it, correction, anonymization or deletion, portability, information on sharing, and review of decisions. Ask the staff on the official Discord; we will confirm the account is yours before acting. You may also complain to Brazil's National Data Protection Authority (ANPD).
8. Security
Passwords and session tokens are stored only as hashes, administrative access is limited to the staff and sensitive actions are logged. No system is fully secure: use a password of your own and do not share it.
9. Minors
Players under 18 should only create an account with permission from a parent or guardian, who may exercise the rights above on their behalf.
10. Changes
We may update this policy. The date of the last update appears at the end of this page, and important changes will be announced on the site.
Updated October 27, 2026