Privacy Policy

Heroes 2 Online (heroes2online.com) is a free, non-commercial fan project run by volunteers. We decide what personal data the game uses and why, which makes us its controller. You can reach us at support@heroes2online.com about anything in this policy.

We apply the European Union's data protection law (the GDPR) to everyone, wherever they live.

Only what the game needs to run. Everything below is stored in our own Amazon Web Services account (section 5).

Your account

• Email address: to sign you in, send your sign-up and password-reset codes, and send the game notifications you leave on. When you sign up we check that the address is not mistyped or a throwaway one, using Amazon SES's address check.
• Password: handled entirely by Amazon Cognito. Your browser proves it knows the password without sending it, so we never see or store it.
• Display name (unique), your chosen avatar (a hero portrait), when you joined, your notification switches and the “fight automatically when attacked while away” setting.

Your games

• The matches you create or join, your seats, every move made in them (with the account that made it), and how each match ended.
• Your results, totals by mode, your ranked rating in each season, your tier and your place on the leaderboard.
• While you queue for a match: the mode, the faction you picked, your rating, and a short lockout if you keep declining offers.
• Maps uploaded to start a match.

Other signed-in players can see your profile: your name, avatar, when you joined, your rating and tier, your totals, and your recent and live ranked and quick matches. Private and solo matches are shown only to the people who played in them.

Chat and friends

• Match chat, read by that match's players.
• Direct messages between you and another player, with your inbox's state (unread, muted, message requests).
• Global chat, read by every signed-in player.
• Reports you make: a copy of the reported line, its author, you, and your reason.
• Mutes our moderators place on an account, with their reason.
• Friends, friend requests and blocks. Whether a friend is online, in a match or queueing is worked out live from open connections and is not stored.

Moderators see a direct message only when one of its two players reports it.

Notifications

• Push subscriptions: when you turn on push notifications on a device, your browser gives us an address at its push service and the keys to encrypt messages to it. One per device, until you turn it off.
• Email preferences: which notifications you turned off. Every notification email has a one-click unsubscribe link.
• Delivery records: whether each email we sent you was delivered, bounced or marked as spam, and a suppression list of addresses that bounced or complained, so we stop mailing them.

Logs and connections

Like every website, our servers see your IP address when your browser connects. We do not keep a log of your requests or your IP address. Our servers' own logs (errors and operational messages, which can include an account id but never a password, and show email addresses and push addresses shortened) are kept in Amazon CloudWatch for 30 days. Amazon's services that host the site and sign you in process connection details, including IP addresses, to deliver them.

Analytics

To see how the game is played (players active each day, matches started and finished, turns, battles, how many people come back), we compute totals from a copy of the game's database kept in the same AWS account. The copy follows the database, so what we delete leaves it at its next update (within about half an hour). The reports built from it use game records and counts, never chat text or email addresses, and nothing leaves our account.

The game does not send analytics events from your browser. If we turn that on, we will update this policy first; such events would never carry your email, your name or chat text.

In your browser

We use no cookies. We keep in your browser's local storage: your sign-in session (Amazon Cognito's tokens) and your display preferences (walking speed, smooth movement, repainted or original art, window and column layouts, open match tabs). A service worker shows push notifications if you turn them on.

• To run the game you signed up for: your account, matches, ratings, chat, friends and the notifications you ask for (the GDPR's “performance of a contract”).
• To keep it fair and safe: rate limits, the throwaway-address check, reports, mutes and bans, and the logs we need to find faults and abuse (our legitimate interest).
• To help you when you write to us (our legitimate interest, and yours).
• To improve the game, from totals rather than from watching individuals (our legitimate interest).
• Push notifications only after you allow them in your browser (your consent, which you can withdraw at any time).

• No ads, and no advertising or tracking cookies.
• We never sell your personal data, or share it for marketing.
• No third-party trackers, analytics or social media scripts. The site's fonts are served from our own site, not from Google.
• No open or click tracking in our emails: their links are not rewritten and they carry no tracking pixel.
• Links to other sites (GOG, fheroes2 on GitHub, the community map archives) leave Heroes 2 Online; those sites have their own policies.

Amazon Web Services hosts everything, in its us-east-1 region (Northern Virginia, United States): Amazon Cognito (accounts and sign-in), DynamoDB (the database), S3 (game states and maps), SES (email), EC2 (the game server), Amplify (the website), CloudWatch (logs), and, for the analytics copy, Glue, Athena and S3 Tables. AWS processes the data on our instructions under its data processing terms, which include the EU's Standard Contractual Clauses for transfers out of Europe.

Browser push services, if you turn on push notifications: your browser's maker runs the service that delivers them (Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge). They receive each notification encrypted and cannot read it.

Our volunteer staff (moderators and admins) see what their job needs: profiles, match and global chat, reported messages, and, to answer a support request, your email address.

Nobody else.

You may ask us to:

• tell you what personal data we hold about you (access);
• give you a copy of it in a common format (export);
• correct it;
• delete it, and your account;
• restrict or stop a use of it, or withdraw a consent you gave.

Write to support@heroes2online.com from your account's email address, so we know it is you. We answer within a month.

Some things you can do yourself: change your name and avatar on your profile, turn push notifications off for a device in your account menu, turn off each kind of notification email with the unsubscribe link in any of them, and block players.

An in-game button to delete your account is planned; until it exists, email us. Deleting removes your account, profile and personal data. The moves of matches you shared with others, and their results, stay in the other players' histories without your name.

If you think we have mishandled your data, please tell us first. You can also complain to the data protection authority where you live.

Heroes 2 Online is not directed at children under 13, and they may not make an account. In the European Union, if you are under 16 (or the lower age your country sets), you need the consent of a parent or guardian. If you believe a child has an account without it, write to us and we will delete it.

Every connection is encrypted (HTTPS). Passwords stay with Amazon Cognito. Sign-in tokens are never put in web addresses. Access to the data is limited to the few people who run the game, and to the services above.

When our data practices change, we update this page and its date first. We announce significant changes on the site, and by email when they affect what we do with data you already gave us.

Questions, requests or complaints: support@heroes2online.com. Our Terms of Service cover how the game may be used.