HeroBrawl Privacy Policy

NewFound Studios · Effective date: 10 September 2026

This policy explains what information HeroBrawl (the "game") collects, how it is used, and the choices you have. It applies to the HeroBrawl mobile game published by NewFound Studios ("we", "us"). Your use of the game itself is governed by our Terms of Service.

Information we collect

Created automatically when you first play

• Player ID — a randomly generated identifier created on your device. It is not derived from your name, phone number, email, or advertising ID, and it is what identifies your account on our servers.
• Display name — the in-game name you choose, visible to other players.

Optional account information

• Email address and password — only if you choose to link your account for recovery. The password is stored in hashed form by our backend provider (Microsoft PlayFab); we never see or store it in readable form. The email address is used solely for signing in on a new device and sending account-recovery emails — not for marketing.
• Google account sign-in — only if you choose to sign in with Google. We use Google Identity Services and request the basic sign-in scopes only (your Google account ID, email address and basic profile name). The account email is bound to your game account through our account provider (PlayFab) so you can recover it on other devices. We do not receive your Google password, contacts or any other Google data.

Gameplay data

• Game progress and inventory: heroes, gear, currencies, levels, quests, and settings — saved to our servers so your progress survives device changes and reinstalls.
• Battle and activity data: matches played, results, and related gameplay events. Some of this is also validated server-side to keep the game fair (cheat prevention).
• Purchase entitlements: which in-app products your account owns. Payments themselves are processed by Google Play — we receive a purchase confirmation, never your card or billing details.

Social features

• Friend lists, friend requests, and gift activity.
• Guild and team membership and related activity.
• Chat messages you send in public, guild, or private channels. Messages are stored on our servers and are visible to their intended audience. Automated filtering and human moderation may review messages to enforce our conduct rules; violations can result in restrictions or bans.

Diagnostic and technical data

• Crash reports (via Firebase Crashlytics): device model, operating system version, and the technical state of the game when a crash occurred.
• Analytics events (via Firebase Analytics and GameAnalytics): aggregate gameplay events such as sessions, progression milestones, and feature usage, tied to app-scoped identifiers.
• Server logs: our servers temporarily record IP addresses and request metadata as a normal part of operating an online service and preventing abuse.

Advertising (optional rewarded ads)

• The game offers rewarded ads: short videos you can choose to watch in exchange for an in-game reward. They are served by the Unity Ads network through the ironSource LevelPlay mediation SDK. There are no forced, banner, or interstitial ads.
• To serve and measure these ads, the ad SDK may collect your device's advertising ID, IP address, and general device information (model, OS version, language). You can reset or delete your advertising ID, or limit ad personalisation, in your device's Google settings (Settings → Google → Ads).
• Ad views are counted by our servers to grant the reward and enforce the daily limit.

The game does not collect your precise location, contacts, photos, or files.

How we use this information

• To operate the game: authenticate your account, save and sync progress, resolve battles, and deliver purchases.
• To provide social features: friends, guilds, teams, and chat.
• To keep the game fair and safe: server-side validation, anti-cheat and anti-fraud checks, and chat moderation.
• To fix problems and improve the game: crash diagnostics, performance data, and aggregate analytics about how features are used.
• To provide player support when you contact us.
• To show and reward the optional ads you choose to watch, and to enforce their daily limit.
• To comply with legal obligations.

Where the GDPR or similar laws apply, we process this data because it is necessary to provide the game you asked for (performance of a contract), for our legitimate interests in keeping the service secure, fair, and improving (in ways that do not override your rights), or to comply with law.

Service providers

We use a small number of third-party services to run the game. Each receives only the data needed for its role and processes it under its own privacy policy:

Sharing

We do not sell your personal data. We share it only with the service providers listed above (acting on our behalf), with other players where a feature is inherently social (your display name, profile, and chat messages are visible to others), when required by law, or as part of a business transfer such as a merger or acquisition — in which case this policy would continue to apply to data collected under it.

Data retention

We keep your account and gameplay data for as long as your account exists. Server logs are kept only for a short operational window. Crash and analytics data is retained according to the respective provider's retention settings. When your account is deleted, associated personal data is deleted or irreversibly anonymized, except where we must retain records to comply with law (for example, purchase records) or to enforce bans for serious abuse.

Account & data deletion

In the game: open Settings → Delete Account. The request is filed as a support ticket tied to your account — you can track it, and cancel it from the same button while it is still pending. Deletion completes within 30 days of the request.

If you no longer have the game installed: email support@newfoundstudios.com from the address linked to your account, or include your player ID and in-game display name so we can verify ownership.

Deletion is permanent: progress, purchases, and social connections cannot be restored. We may retain limited records where the law requires it (for example, purchase records) or to enforce bans for serious abuse.

You can also request a copy of the data associated with your account, or correction of inaccurate data, through the in-game Support screen (Settings → Support) or the same email address.

Children

HeroBrawl is not directed at children under 13 (or the higher minimum age required in your country, such as 16 in parts of the European Economic Area). We do not knowingly collect personal data from children below that age. If you believe a child has created an account, contact us and we will delete it.

International transfers

Our servers and service providers may store and process data in countries other than yours, including the United States and the European Union. Where required, transfers are protected by appropriate safeguards such as the providers' standard contractual clauses.

Security

Data is transmitted over encrypted connections and stored with access controls. Game-critical actions are validated server-side. No online service can guarantee absolute security, but we design the game so that sensitive data we do not need is simply never collected.

Your rights

Depending on where you live (for example under the GDPR, UK GDPR, or the California Consumer Privacy Act), you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to lodge a complaint with your local data protection authority. Exercise any of these rights via the in-game Support screen or support@newfoundstudios.com. We do not discriminate against players who exercise their privacy rights, and we do not sell or "share" personal data as those terms are defined under the CCPA.

Changes to this policy

If we change this policy, we will update this page and the effective date above. For material changes we will also notify you in the game before they take effect.

Contact

NewFound Studios
support@newfoundstudios.com