HERDZ.IO
Privacy Policy
Overview
About us & how to contact us. Herdz.io is a free online multiplayer game operated by an independent solo developer ("we", "us", "our"). We process your information when you play. Questions, requests, or complaints about your data: privacy@herdz.io.
What we collect. Information you give us (such as a username, or details from a Google or Facebook sign-in), and information generated as you play (gameplay, device and log data). We also receive limited information from third parties such as our sign-in, analytics, advertising, and payment providers.
How we use it. To run and improve the game, save your progress, process purchases, measure and analyse usage, show advertising, and keep the game fair and secure.
Who we share it with. Service providers we rely on (hosting, database/auth, payments, analytics, advertising), other players (your username and in-game activity), and authorities where the law requires it.
Where we process it. Mainly in the European Economic Area (Germany) and the United States. Your rights. You can access, correct, delete, or port your data, and object to or restrict certain uses. Changes. Updates are posted here, with notice for significant changes.
Introduction
This privacy policy ("Policy") explains our practices regarding your Information. "We", "us" and "our"
refer to the independent developer operating Herdz.io, who is the data
controller for your Information. "Information" means any information relating to an identified or
identifiable individual, relating to your use of the Herdz.io game and website
at herdz.io (the "Game"). By using the Game, you understand that we collect, process, use,
and store your Information as described here. If you do not agree with this Policy, please do not use the
Game.
1. Information we collect
Information you provide to us
- Username / display name. When you play, you can choose a username. It is shown to other players. Please do not include personal information in your username.
- Social sign-in (optional). If you choose "Sign in with Google" or "Sign in with Facebook", we receive your provider account ID and, where you grant it, your email address and public display name. We use this only to link your progress to a recoverable account. We never receive your password, and we do not post anything to your social accounts.
- Support requests. If you email us, we receive your email address and whatever you choose to include (for example your in-game name or a description of an issue).
Information we automatically collect or generate when you play
- Identifiers. An anonymous device identifier we generate and store in your browser, your IP address, and device/browser information (such as model, browser, language, and operating system). We may infer an approximate, city-level location from your IP address.
- Gameplay & log data. Game session IDs, timestamps of game events, session length, scores, captures, raids, rankings, in-game currency and cosmetic-item activity, purchase records, and signals used to detect cheating or abuse.
- Cookies & local storage. We use cookies and similar browser-storage technologies to run the Game, remember your settings and session, measure usage, and (at launch) support advertising. See Cookies & local storage below.
- Analytics. We use Google Analytics to understand how the Game is used. It collects usage events and online identifiers (and processes IP-derived data) via cookies and similar technologies. See Google's practices at policies.google.com/privacy; you can opt out with Google's browser add-on.
Information we receive from third parties
- Sign-in providers. When you register through Google or Facebook, we receive your provider ID, name, and (optionally) email address.
- Payment provider. When you make a purchase, our payment provider (Xsolla) sends us transaction details — transaction ID, country, item purchased, currency, value, and timestamp. We do not receive or store your card or bank details.
- Advertising & analytics partners. We receive aggregated reports and limited interaction data from our analytics and advertising partners.
The Game is not directed to children under 13, and we do not knowingly collect their personal information. If you are in the European Economic Area, the minimum age for consent to processing may be higher (up to 16), in which case a parent or guardian must consent on your behalf. If you believe a child has provided us information, contact privacy@herdz.io and we will delete it.
2. How we use your information
- Provide the Game (contractual necessity): create and maintain your account, save and restore your progress, run matches (which may include AI "bot" opponents), operate the in-game economy, and process purchases through Xsolla.
- Improve and analyse the Game (legitimate interests): understand usage with Google Analytics, monitor for errors and crashes (Sentry), fix bugs, and develop new features.
- Provide support (legitimate interests / contractual necessity): respond to your questions and resolve issues.
- Advertising (consent where required, otherwise legitimate interests): show ads in the Game, which may be tailored to you. Where applicable law requires consent for personalised ads, we will ask for it, and you can withdraw it at any time (see Cookies).
- Keep the Game fair, secure, and lawful (legitimate interests / legal obligation): detect and prevent cheating, fraud, and abuse, enforce our terms, and comply with the law.
3. Who we share your information with
- Other players see your username and in-game activity (such as your score and ranking).
- Service providers who help us run the Game:
- Supabase — managed database and authentication, hosting your account, progress, and linked sign-in identities (data stored in the EU, Frankfurt region).
- Hetzner — hosting for our real-time game servers (United States).
- Sentry — error and crash monitoring to detect and fix bugs (EU region; configured without personal data — IP-address storage off) (privacy policy).
- Xsolla — payment processing for in-game purchases (privacy policy).
- Google — Google Analytics and Google sign-in (privacy policy).
- Meta / Facebook — Facebook sign-in (privacy policy).
- Advertising partners — to serve and measure ads. Our current advertising partners and their privacy policies will be listed here once selected.
- Authorities and others where we believe in good faith it is necessary to comply with the law, enforce our terms, prevent fraud or abuse, or protect the rights, property, or safety of our users, the public, or us.
- Change of ownership. If we are involved in a merger, acquisition, or sale of assets, your Information may be transferred as part of that transaction.
Third-party practices. Google, Facebook, Xsolla, and our advertising partners are responsible for their own use of your Information under their own privacy policies. This Policy does not cover their practices.
Security. We use technical and organisational measures to protect your Information. No transmission over the internet is completely secure, but we take reasonable steps to safeguard it — for example, account secrets are stored in hashed form, and connections use encryption.
4. Where we process your information
We process your Information in the European Economic Area ("EEA") — our database and authentication are hosted in Germany (Frankfurt) — and in the United States, where our real-time game servers are hosted. When we transfer Information outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, recognised data-transfer frameworks, so that your Information remains protected.
5. How long we store your information
We keep your Information for as long as your account is active. You can ask us to delete it at any time (see Data & Account Deletion). We also automatically delete accounts that have been inactive for 24 months. When we delete Information, we take steps to make it permanently unrecoverable, except where we must retain limited records for legal, tax, security, or fraud-prevention purposes, or as anonymised aggregate data.
6. Your rights
Depending on where you live, you have rights over your Information:
- Access — get a copy of your Information and an explanation of how we use it.
- Deletion — ask us to delete your Information.
- Correction — fix inaccurate Information.
- Objection & withdrawal of consent — object to processing based on legitimate interests, or withdraw consent you previously gave (for example, to personalised advertising).
- Portability — receive Information you gave us in a portable format.
- Restriction — ask us to limit processing in certain circumstances.
To exercise any of these rights, email privacy@herdz.io, or for deletion follow Data & Account Deletion. If you are in the EEA, you also have the right to lodge a complaint with your local data protection authority. California residents: see Addendum 1 — California Privacy Rights.
7. Cookies & local storage
We use the following categories of browser storage:
- Strictly necessary — your anonymous device identifier, your sign-in session, and settings. The Game cannot function without these.
- Analytics — Google Analytics cookies/identifiers, to measure usage.
- Advertising (at launch) — cookies/identifiers set by our advertising partners to show and measure ads, which may be personalised.
You can control analytics and advertising storage through any in-game privacy settings we provide, your browser settings, and the opt-out tools linked above. Blocking strictly necessary storage may stop the Game working.
8. Changes to this Policy
We may update this Policy as the Game evolves. We will post updates here and update the "Last updated" date. For significant changes, we will provide notice in the Game or on the website.
9. Contact
For privacy questions, requests, or complaints: privacy@herdz.io.
Addendum 1 — California Privacy Rights
This Addendum applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"). "Personal Information" here has the meaning given by the CCPA and excludes deidentified, aggregated, or lawfully public information.
Categories collected and disclosed (last 12 months)
| Category | Examples | Sources |
|---|---|---|
| Identifiers | Device identifier, IP address, username, and (if you use social sign-in) provider ID, name, and email | You / your device; sign-in providers |
| Internet/network activity | Gameplay events, in-game activity, ad interactions | Your device; analytics and advertising partners |
| Geolocation | Approximate, city-level location from your IP | Your device |
| Commercial information | Records of purchases (transaction ID, item, value) | You; our payment provider |
We collect this Personal Information for the purposes described in "How we use your information" above: to operate and improve the Game, communicate with you, serve advertising, prevent fraud and abuse, and fix technical issues. We may disclose it to the categories of recipients listed in "Who we share your information with" above (service providers, advertising partners, other players, authorities, and a successor in a corporate transaction).
"Sale" and "Sharing" / right to opt out
We do not sell your Personal Information for money. However, when we use advertising and analytics partners that set cookies/identifiers to deliver or measure cross-context behavioural advertising, this may be considered a "sale" or "sharing" under the CCPA. You have the right to opt out: use any in-game privacy settings we provide, the opt-out tools linked above, or email privacy@herdz.io.
Your California rights
- Know/access the categories and specific pieces of Personal Information we collected, the sources, the purposes, and the categories of recipients.
- Delete Personal Information we collected from you.
- Correct inaccurate Personal Information.
- Opt out of "sale"/"sharing" (see above).
- Not be discriminated against for exercising your rights.
How to exercise: email privacy@herdz.io. We will verify your request by matching identifying details (such as your account/username) against our records, and we aim to respond within the timeframes required by the CCPA. You may use an authorized agent by emailing us. Shine the Light: we do not share Personal Information with third parties for their own direct marketing. Do Not Track: there is no common standard for responding to browser "Do Not Track" signals, and we do not currently respond to them.