Privacy Policy

Heroes 2 Online (heroes2online.com) is a free, non-commercial fan project run by volunteers. We decide what personal data the game uses and why, which makes us its controller. You can reach us at support@heroes2online.com about anything in this policy.

The controller is the maintainer of Heroes 2 Online. We give our name and a postal address to anyone who asks for them at support@heroes2online.com, and to data protection authorities.

We apply the European Union's data protection law (the GDPR) to everyone, wherever they live.

Only what the game needs to run. Everything below is stored in our own Amazon Web Services account (section 5).

Your account

• Email address: to sign you in, send your sign-up and password-reset codes, and send the game notifications you leave on. When you sign up we check that the address is not mistyped or a throwaway one, using Amazon SES's address check.
• Password: handled entirely by Amazon Cognito. Your browser proves it knows the password without sending it, so we never see or store it.
• Sign in with Google, if you use it: Google tells us your email address and that Google has verified it, through Amazon Cognito. We don't receive your Google password, contacts or anything else in your Google account, and we don't use your Google name or picture. If an account you created with a password already has that verified address, signing in with Google opens that same account.
• Display name (unique), your chosen avatar (a hero portrait), when you joined, your notification switches and the “fight automatically when attacked while away” setting.
• When you play: when you were first and last seen in the game, and your sessions (when each started and ended, and whether it was on a phone, a tablet or a computer, in the installed app or a browser tab, and which version of the site). We record only that kind of device, never your browser's full details or your IP address. Only our staff see it, to help with support requests and to look into abuse; other players never do.

Your games

• The matches you create or join, your seats, every move made in them (with the account that made it), and how each match ended.
• When a match ends, a copy of its moves and how it ended, to improve the computer opponents. The copy names no one: each side is only “a person” or the computer that played it, with no account, name, match name or time of day, and nothing in it leads back to the match or to you.
• Your results, totals by mode, your ranked rating in each season, your tier and your place on the leaderboard.
• While you queue for a match: the mode, the faction you picked, your rating, and a short lockout if you keep declining offers.
• Maps uploaded to start a match.

Maps you make

• The maps you make in the editor or upload to My Maps: their drafts, the versions you publish, their pictures, and whether you have played each one.
• A published map can be seen by others as you choose (in the gallery or only by its link), with your display name as its author. Before others see a version, its texts (the map's name, description and every text inside it) go through the same automated check as chat, using Amazon Comprehend; a version it flags is held for a moderator.
• Each map file gets a fingerprint, so a near copy of someone else's map stays visible only to its author.
• Star ratings you give maps you have played: a map shows only its average and how many ratings it has, never who gave them. Favourites you mark are seen only by you, and a map counts how many times it has been played.

Other signed-in players can see your profile: your name, avatar, when you joined, your rating and tier, your totals, and your recent and live ranked and quick matches. Private and solo matches are shown only to the people who played in them. Anyone with a link to your profile, signed in or not, can see its preview card: your name, avatar, when you joined, your rating, tier and place, and your totals, but no match. Anyone with one of your invitation links can see its preview: your name, avatar, tier and rating, and the map and settings of that game.

Chat and friends

• Match chat, read by that match's players.
• Direct messages between you and another player, with your inbox's state (unread, muted, message requests).
• Global chat, read by every signed-in player.
• Automated chat checks. Every line of match chat, direct messages and global chat is sent, just after it is posted, to Amazon Comprehend, which scores it for abuse (it reads English only). A line scored as a threat, hate speech, sexual, graphic or harassment above a high threshold is removed at once; a line scored lower, or as very strong swearing or insults, is kept and flagged for a moderator. For each flagged or removed line we keep a copy of it, its author and its scores. No account is muted or banned automatically: a moderator decides.
• Reports you make: a copy of the reported line, its author and when it was sent, you, and your reason. The copy stays with the report after the line itself has expired.
• Mutes our moderators place on an account, with their reason.
• Friends, friend requests and blocks. Whether a friend is online, in a match or queueing is worked out live from open connections and is not stored.

Moderators see a direct message only when one of its two players reports it, or the automated check flags or removes it.

Notifications

• Push subscriptions: when you turn on push notifications on a device, your browser gives us an address at its push service and the keys to encrypt messages to it. One per device, until you turn it off.
• Email preferences: which notifications you turned off. Every notification email has a one-click unsubscribe link.
• Delivery records: whether each email we sent you was delivered, bounced or marked as spam, and a suppression list of addresses that bounced or complained, so we stop mailing them.

Logs and connections

Like every website, our servers see your IP address when your browser connects. We do not keep a log of your requests or your IP address. Our servers' own logs (errors and operational messages, which can include an account id but never a password, and show email addresses and push addresses shortened) are kept in Amazon CloudWatch for 30 days. Amazon's services that host the site and sign you in process connection details, including IP addresses, to deliver them.

Analytics

To see how the game is played (players active each day, matches started and finished, turns, battles, how many people come back), we compute totals from a copy of the game's database kept in the same AWS account. The copy follows the database, so what we delete leaves it at its next update (within about half an hour). The reports built from it use game records and counts, never chat text or email addresses, and nothing leaves our account.

The game does not send analytics events from your browser. If we turn that on, we will update this policy first; such events would never carry your email, your name or chat text.

In your browser

We use no cookies. We keep in your browser's local storage: your sign-in session (Amazon Cognito's tokens) and your display preferences (walking speed, smooth movement, repainted or original art, window and column layouts, open match tabs). A service worker shows push notifications if you turn them on.

If you play as a guest, without an account, or choose to save a game on this device when signed in, that game runs and is saved in your browser only (its IndexedDB storage): it is never sent to us, and clearing your browser's site data removes it.

• To run the game you signed up for: your account, matches, ratings, chat, friends and the notifications you ask for (the GDPR's “performance of a contract”).
• To improve the computer opponents: copies of finished matches that name no one (our legitimate interest in making the game better).
• To keep it fair and safe: rate limits, the throwaway-address check, the automated chat checks, reports, mutes and bans, and the logs we need to find faults and abuse (our legitimate interest).
• To help you when you write to us (our legitimate interest, and yours).
• To improve the game, from totals rather than from watching individuals (our legitimate interest).
• Push notifications only after you allow them in your browser (your consent, which you can withdraw at any time).

• No ads, and no advertising or tracking cookies.
• We never sell your personal data, or share it for marketing.
• No third-party trackers, analytics or social media scripts. The site's fonts are served from our own site, not from Google.
• No open or click tracking in our emails: their links are not rewritten and they carry no tracking pixel.
• Links to other sites (GOG, fheroes2 on GitHub, the community map archives) leave Heroes 2 Online; those sites have their own policies.

Amazon Web Services hosts everything, in its us-east-1 region (Northern Virginia, United States): Amazon Cognito (accounts and sign-in), DynamoDB (the database), S3 (game states and maps), SES (email), EC2 (the game server), Amplify (the website), CloudWatch (logs), Comprehend (the automated checks of chat and of published maps' texts), and, for the analytics copy, Glue, Athena and S3 Tables. AWS processes the data on our instructions under its data processing terms, which include the EU's Standard Contractual Clauses for transfers out of Europe.

Google, only if you sign in with Google: Google confirms who you are and sends us your email address (section 2). Google's own privacy policy covers what it does when you sign in there.

Browser push services, if you turn on push notifications: your browser's maker runs the service that delivers them (Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge). They receive each notification encrypted and cannot read it.

Our volunteer staff (moderators and admins) see what their job needs: profiles, when you were last online and your recent sessions, match and global chat, reported messages, chat lines the automated check flagged or removed (direct messages among them), and, to answer a support request, your email address.

Nobody else.

You may ask us to:

• tell you what personal data we hold about you (access);
• give you a copy of it in a common format (export);
• correct it;
• delete it, and your account;
• restrict or stop a use of it, or withdraw a consent you gave.

Write to support@heroes2online.com from your account's email address, so we know it is you. We answer within a month.

Some things you can do yourself: change your name and avatar on your profile, turn push notifications off for a device in your account menu, turn off each kind of notification email with the unsubscribe link in any of them, block players, and delete your account.

To delete your account, use Delete account at the foot of your profile, once you have given up the matches you still play (or email us). Deleting removes your account, profile and personal data. The moves of matches you shared with others, and their results, stay in the other players' histories without your name.

If you think we have mishandled your data, please tell us first. You can also complain to the data protection authority where you live.

Heroes 2 Online is not directed at children under 13, and they may not make an account. In the European Union, if you are under 16 (or the lower age your country sets), you need the consent of a parent or guardian. If you believe a child has an account without it, write to us and we will delete it.

Every connection is encrypted (HTTPS). Passwords stay with Amazon Cognito. Sign-in tokens are never put in web addresses. Access to the data is limited to the few people who run the game, and to the services above.

When our data practices change, we update this page and its date first. We announce significant changes on the site, and by email when they affect what we do with data you already gave us.

Questions, requests or complaints: support@heroes2online.com. Our Terms of Service cover how the game may be used.