Privacy Policy — Heartforge

This privacy policy applies to Heartforge (henceforth "The App") developed by Kieksi Digital and distributed via the Apple App Store, Google Play Store, and the web.

2.1 Account Information

When you create an account, we collect your email address and generate a unique user identifier. Your email is used for authentication, account recovery, and essential service communications (such as subscription receipts). We do not send marketing emails.

2.2 User-Generated Content

Content you create within the App, such as characters, encounters, adventures, and notes, is stored locally on your device and, if you are signed in, synced to our cloud servers so you can access it across your devices.

Some content can be shared with other users at your request. See section 2.5.

2.3 Purchase and Subscription Data

We store records of your subscription status and purchase history to manage your access to premium features. We do not store or have access to your payment details (credit card numbers, billing addresses, etc.) — payment processing is handled entirely by third-party providers.

2.4 Device and Diagnostic Data

We may receive anonymous crash reports and basic device information (device type, operating system version) through platform-provided crash reporting services. This data is used solely to improve app stability and does not identify you personally.

2.5 Content You Share With Other Users

The App lets a Game Master invite players to an adventure with a join code, and lets a player link one character to that adventure. When you link a character, the character sheet you chose (its name, level, class, ancestry, statistics, and current state such as hit points, conditions, and money) becomes visible to that Game Master inside their adventure, and the Game Master keeps a copy of it there while the link is active. The Game Master can also update a few live values on your character during play, such as hit points, conditions, and money; everything else on the sheet stays yours to edit. The Game Master also sees the account identifier shown in your Settings (normally your email address), so they can tell which player each character belongs to. Your other characters, adventures, and notes are never shared this way. Linking is always your own action and requires a code issued by that Game Master; the App never shares your content with other users on its own.

You can leave an adventure at any time from the character sheet, and a Game Master can remove a player from their adventure. Once a link is ended, your character stops updating in the Game Master's adventure, and the Game Master no longer receives the changes you make.

If you are a Game Master, the join code you create and the list of linked players and characters are stored with your adventure. Player characters shared with you are provided for use in that adventure only. You can also choose to share your Compendium, or selected Collections from it, with the players linked to an adventure; they can view and copy that content for as long as the share and their link are active.

We use the data we collect for the following purposes:

• Providing the service: authenticating your account, syncing your content across devices, and managing your subscription
• Sharing with other users: showing a linked character to the Game Master of the adventure you joined, and showing a Game Master's shared Compendium content to their linked players
• Improving the App: diagnosing crashes and fixing bugs using anonymous diagnostic data
• Content delivery: downloading game content, compendium updates, and application updates

We do not use your data for advertising, profiling, or any purpose unrelated to providing and improving the App.

Heartforge uses internet connectivity for:

• Account authentication and session management
• Syncing user-generated content to the cloud
• Joining adventures and sharing linked characters with a Game Master
• Downloading game content and compendium updates
• Processing purchases and managing subscriptions

Content delivery operations (game data, compendium updates) are anonymous and do not transmit any personal information or usage analytics.

On iOS and macOS, users who have opted in to share crash data may send anonymous crash logs to Apple, made available to the developer via App Store Connect. You can control this under Settings > Privacy & Security > Analytics & Improvements.

On Android, similar anonymous crash and ANR (Application Not Responding) reports may be shared via Google Play Console, subject to your device's diagnostics sharing settings.

These reports include diagnostic information such as device type, OS version, time of crash, and stack traces. They do not contain personal or identifying information.

Heartforge relies on the following third-party services:

• Supabase: authentication, cloud data storage, and content sync. Subject to the Supabase Privacy Policy.
• Resend: delivery of account emails such as email confirmation, password reset, and sign-in links. Subject to the Resend Privacy Policy.
• RevenueCat: subscription and purchase management. Subject to the RevenueCat Privacy Policy.
• Apple App Store / Google Play Store: app distribution and payment processing on native platforms, each subject to their respective privacy policies.

These services process only the minimum data necessary to provide their respective functions. We do not share your personal data with any third parties for advertising or marketing purposes.

The App does not use any third-party analytics services, advertising frameworks, or tracking technologies. We do not collect usage analytics, behavioral data, or location information.

Your data is stored on secure, industry-standard cloud infrastructure. We use encryption in transit (TLS) for all communications between the App and our servers. Access to user data is restricted to essential service operations only.

On the web, the App uses browser local storage and cookies strictly for session management and authentication. No tracking cookies are used.

We retain your account data and user-generated content for as long as your account is active. You can delete your account and all associated data at any time from within the App by going to Settings > Delete Account. Self-service deletion is immediate and permanent. Alternatively, you may contact us at the address below, and we will process your deletion request within 30 days. Deleting your account also ends every adventure link you hold as a player or a Game Master.

Upon deletion, we permanently remove your account information, user-generated content, uploaded files, and storage quota records, except where retention is required by law or for legitimate business purposes (such as resolving disputes).

Anonymous diagnostic data (crash reports) cannot be attributed to individual users and is retained indefinitely for quality improvement purposes.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a portable format

To exercise any of these rights, please contact us at the address below.

The App is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us so we can take appropriate action.

We may update this Privacy Policy from time to time. We will notify users of significant changes through the App. Your continued use of the App after changes become effective constitutes acceptance of the updated policy.

If you have any questions about this privacy policy or the App's data practices, please contact us: