This policy explains what data the Havoc Wreakers mobile game (iOS and Android) and the havocwreakers.com website collect, why, how long we keep it and what rights you have. We keep it plain and specific: if something is not listed here, the game does not collect it.
1. Who is responsible for your data
The data controller is Axperts Dariusz Zalewski, ul. Pelikana 1/3, 71-698 Szczecin, Poland, tax ID (NIP) 851 319 2109, REGON 363785540, the maker of Havoc Wreakers. For anything about your data, write to [email protected].
2. What the game collects and why
The game runs on our server, so some data has to go there to let you play, save your progress and find a match. Here is the full list.
Player account
On first launch the game creates an account by itself. We store a random account number, your player tag (for example #8QLC2V), your in-game name (generated by the game or changed by you), your chosen hero, the dates the account was created and last connected, and a device login key; if the account is banned for breaking the rules, also the reason and duration of the ban. The login secret itself stays on your phone, the server only knows its hash.
Why: to run your account and save progress. Legal basis: performance of a contract, that is providing the game (Art. 6(1)(b) GDPR).
Device
A device identifier (on iPhone the identifier for vendor, IDFV; on Android a hash of the Android ID), phone model, system version, platform, game version and build number, game language, and the dates of the first and last connection from that device. We keep at most the 10 most recent devices of an account. The device identifier is not used for login or for ads.
Why: to recognise your account when you ask for help, to ask you to update an old game version, and to find bugs that happen on specific phones. Legal basis: performance of a contract and our legitimate interest in a working, secure game (Art. 6(1)(b) and (f) GDPR).
Progress and matches
Your heroes, their levels, trophies and wins, weapons, skins, in-game currencies (coins, upgrade points, Marbles), season pass, quests, Prize Bombs, account settings, the history of settled matches (mode, hero, result, trophy change, match time) and messages from the game team sent to your account. The server calculates match results.
Why: gameplay, rewards, rankings and cheat detection. Legal basis: Art. 6(1)(b) and (f) GDPR.
In rankings other players see your tag, in-game name, avatar hero, trophies and place. Friends also see whether you are in the menu, in a queue or in a match.
Usage statistics
The game records how you use it: launching and returning to the game, going through the tutorial (start, each step, skipping, finishing), the screens you open (for example the menu, heroes, shop, season pass, rankings, friends, settings, match results), taps on the main buttons (for example PLAY, Shop, Heroes), entering and leaving the queue, the start and end of a match (mode, hero, map, result, duration, whether the match was abandoned), opening the shop and purchases (including test purchases), opening Prize Bombs and errors shown on screen (for example no connection or an update request). Each event carries a random game session number, the time and your account number, device identifier, platform and game build number. These are only fixed names from a list inside the game: we do not record any text you type or anything outside the game.
Events travel over an encrypted connection to our own server, not to analytics companies. We look at them in aggregate (how many people finish the tutorial, play a second match, come back the next day, where errors happen) and, when you ask for help, at the event history of your account.
Why: improving the game, which means finding where players struggle or give up, and fixing bugs. Legal basis: our legitimate interest in developing and improving the game (Art. 6(1)(f) GDPR). How to turn it off: in the game, Settings, the Usage statistics button. When you turn it off, the game stops collecting events, deletes the ones waiting to be sent, and the server deletes your account's events on the next connection. You can turn it back on with the same button.
Purchases
Until launch, in-game purchases are trial purchases: nobody pays, and we only record what was granted to the account. When we switch on real payments, Apple (App Store) or Google (Google Play) will handle them. We will receive a confirmation of the transaction (identifier, product, date), never your card details. We will update this policy before payments go live.
Sign-in (optional)
You can link your account to a sign-in method to move your progress to another phone:
- Apple: the Apple user identifier for our app and your email address if Apple shares and verifies it (this can be a private relay address that Apple forwards to your inbox).
- Email: your email address. We send it a 6-digit code that the server keeps only in memory for 10 minutes.
- Google (once Google sign-in goes live): the Google account identifier and your email address.
Why: to move and recover your progress. Legal basis: Art. 6(1)(b) GDPR. You can unlink a sign-in at any time in the game (Settings, Account, Unlink).
Friends and teams
Your friends list, sent and received requests, blocked players and the players you played with in the last 48 hours (so you can easily add someone as a friend). Legal basis: Art. 6(1)(b) GDPR.
Crews (if you join a crew)
A crew is a group of up to 30 players. When you create one, we store its name, description, emblem and settings; every player can see the name and description in search, in the recommended list and in the crew ranking, so do not put personal data or contact details there (the server rejects addresses, numbers and rude words, and the game team can change or hide the name and description). While you are in a crew, we store your role, the date you joined, join requests and invites, and the crew log (who joined, left or was promoted, crew records and quick messages from a fixed list; the game has no chat). Other members see your tag, name, hero, trophies, role, whether you are in the game and when you last played, and any player viewing the crew sees the members' tags, names, heroes, trophies and roles. Crew trophies are the sum of the members' trophies. Why: to run crews. Legal basis: Art. 6(1)(b) GDPR.
Notifications (if you turn them on)
The push token from Apple or Google, the game language and your time zone. We use the time zone so we do not send notifications between 22:00 and 8:00 your time. Notifications are about friend and team invites. Legal basis: your consent given in the phone's system dialog (Art. 6(1)(a) GDPR); you can turn them off in your phone settings.
IP address
The game server sees the IP address of each connection and uses it for limits that protect against abuse (for example the number of connections, registrations and login attempts from one address). The counters live only in server memory, for at most one day. We do not store IP addresses in the account database or in the game logs. Legal basis: our legitimate interest in security (Art. 6(1)(f) GDPR).
Contacting us
When you email us (support, account deletion), we receive your address and your message. We use them only to reply and to handle your request. Legal basis: Art. 6(1)(b) and (f) GDPR.
Launch notification
If you send us a message with the "Tell me when it launches" button on the website, we keep your email address to write to you once, when the game arrives on the App Store and Google Play. We send nothing else and share the address with no one. We delete it after sending that one message, or earlier if you tell us you have changed your mind. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
3. What we do not collect
- The game has no ads and no third-party analytics. We collect usage statistics (section 2) ourselves, on our own server, and share them with no one. We do not track you across apps and do not use the advertising identifier.
- The game does not ask for your location, contacts, photos, microphone or camera.
- We do not ask for your name, age or date of birth.
- The game has no text chat, so we store no conversations.
The game is built on the Unity engine. On launch the engine may send anonymous hardware statistics (for example device model, system and graphics chip) to Unity Technologies. We do not use Unity Analytics or Unity Ads.
4. Who processes data for us
We do not sell data. We use a few providers that process data on our instructions:
- DigitalOcean, LLC: the game server and account database in a data center in Frankfurt (Germany).
- Cloudflare, Inc.: name service for the havocwreakers.com domain (DNS). Game traffic does not pass through Cloudflare.
- Resend (Plus Five Five, Inc.): sending sign-in code emails.
- Apple: App Store, TestFlight, Sign in with Apple and notifications on iPhone.
- Google: Google Play, notifications on Android (Firebase Cloud Messaging) and, once live, Google sign-in.
- Unity Technologies: the game engine (anonymous hardware statistics, described above).
A daily backup of the database is also copied to a second server owned by Axperts, located in Szczecin, Poland. Some providers are based in the USA. Transfers outside the European Economic Area rely on the European Commission adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses.
5. How long we keep data
- Account and progress: until the account is deleted. An account nobody has signed in to for 400 days is deleted automatically.
- Match history: 90 days.
- Crews: membership until you leave the crew or delete your account; a crew disappears when its last member leaves. Join requests and invites expire after 7 days. The crew log keeps the 50 newest entries; entries with your name stay there after you leave until newer ones push them out, and deleting your account removes them at once.
- Usage statistics: 90 days from the event, after which the server deletes them automatically every day. Sooner if you turn off Usage statistics in the game or delete your account. Events the game has not sent yet wait on the phone for 3 days at most.
- Backups: 14 days. A deleted account disappears from backups within 14 days at the latest.
- Email sign-in code: 10 minutes, in server memory only.
- Rate limit counters with IP addresses: at most one day, in server memory only.
- Account change log: the server records changes made by the game team (who, when, what changed). After an account is deleted, a deletion entry with the account number, tag and name remains as proof that the request was carried out.
- Email correspondence: up to one year after the matter is closed.
How to delete your account is explained on the account deletion page.
6. The website
The havocwreakers.com website uses no cookies, loads no scripts, fonts or images from outside services and has no analytics tools. That is why we show no cookie banner.
The site is served by an Axperts server in Szczecin through the Cloudflare network (Cloudflare, Inc., protection and speed). Our server does not log visitors' IP addresses or the pages they open; it only logs server errors, kept for 14 days. Cloudflare processes the IP address to forward traffic and protect against attacks, under its own privacy policy.
7. Your rights
You have the right to access your data and get a copy, to have it corrected or deleted, to restrict processing, to data portability and to object to processing based on our legitimate interest. The quickest way to object to usage statistics is in the game itself (Settings, Usage statistics), but you can also write to us. You can withdraw consent for notifications at any time in your phone settings. Write to [email protected] and include your player tag. We will reply within one month.
You can also lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the authority in your country.
8. Children and teenagers
We design the game for a PEGI 12 age rating. We do not ask for your age or for data that would reveal who you are, the game has no chat (crews also have only events and quick messages from a fixed list), and friends are added only by tag or QR code. Crew names and descriptions go through a rude-word filter, and the game team can change them and hide a crew from public lists. If you are a parent or guardian and want to check or delete your child's account, write to us.
9. Security
Match results and rewards are calculated only by the server; the phone sends nothing but movement, aim and buttons. The account database cannot be reached from the internet, and only Axperts staff can access the game's admin panel. The connection to the account service (sign in, email codes, profile, friends, match tickets) and the greeting to the match server are encrypted, and the game checks that it is talking to our server. Only the match itself (movement, aim, buttons, arena state) is sent unencrypted, and it contains no personal data.
10. Changes to this policy
When we change how the game uses data, we will update this page and the version date at the top. We will also announce important changes in the game.