HeroBrawl Privacy Policy

NewFound Studios · Effective date: 11 October 2026

This policy explains what information HeroBrawl (the "game") collects, how it is used, and the choices you have. It applies to the HeroBrawl mobile game published by NewFound Studios ("we", "us"). Your use of the game itself is governed by our Terms of Service.

Information we collect

Created automatically when you first play

• Player ID — a randomly generated identifier created on your device. It is not derived from your name, phone number, email, or advertising ID, and it is what identifies your account on our servers.
• Display name — the in-game name you choose, visible to other players.

Optional account information

• Email address and password — only if you choose to link your account for recovery. The password is stored in hashed form by our backend provider (Microsoft PlayFab); we never see or store it in readable form. The email address is used solely for signing in on a new device and sending account-recovery emails — not for marketing.
• Google account sign-in — only if you choose to sign in with Google. We use Google Identity Services and request the basic sign-in scopes only (your Google account ID, email address and basic profile name). The account email is bound to your game account through our account provider (PlayFab) so you can recover it on other devices. We do not receive your Google password, contacts or any other Google data.

Gameplay data

• Game progress and inventory: heroes, gear, currencies, levels, quests, and settings — saved to our servers so your progress survives device changes and reinstalls.
• Battle and activity data: matches played, results, and related gameplay events. Some of this is also validated server-side to keep the game fair (cheat prevention).
• Purchase entitlements: which in-app products your account owns. Payments themselves are processed by Google Play — we receive a purchase confirmation, never your card or billing details.

Social features

• Friend lists, friend requests, and gift activity.
• Guild and team membership and related activity.
• Chat messages you send in public, guild, or private channels. Messages are stored on our servers and are visible to their intended audience. Automated filtering and human moderation may review messages to enforce our conduct rules; violations can result in restrictions or bans.

Support requests

• When you contact support in the game, we receive the category, subject and message you write, your Player ID, and your game version, platform, device model, operating system and language, so we can answer you and look into the problem.
• Images you choose to attach — a few screenshots or other images per request (the support form shows how many; currently up to three), picked with your device's own photo picker. The game receives only the images you select: it cannot see the rest of your photo library and asks for no storage permission. Each image is re-encoded on your device before it is sent, which removes location, camera and other embedded details.

Diagnostic and technical data

• Crash reports (via Firebase Crashlytics and Unity's engine diagnostics): device model, operating system version, and the technical state of the game when a crash or freeze occurred.
• Analytics events (via Firebase Analytics and GameAnalytics): gameplay events such as sessions, progression milestones, and feature usage, tied to app-scoped identifiers. GameAnalytics also receives your device's advertising ID with these events and uses it to tell devices apart in our analytics; it is not used to personalise ads. You can reset or delete your advertising ID in your device's Google settings (Settings → Google → Ads).
• Server logs: our servers temporarily record IP addresses and request metadata as a normal part of operating an online service.
• Anti-abuse records: to prevent cheating, ban evasion and automated abuse, we keep an identifier of the device you play on and an encrypted record of the network address you play from, linked to your player ID, for up to 90 days after you last play. We use these only to detect accounts that share a device or network with a banned account, to spot automated play, and to enforce bans. They are deleted with your account, except where they are needed to enforce a ban for serious abuse (see Data retention).
• Play Integrity checks: when you sign in, the game asks Google Play Integrity to confirm that it is the genuine game installed from Google Play, running on a genuine Android device. Google's answer also says roughly how often the game asked for these checks on your device in the last hour, whether Google Play Protect is turned on and has found harmful apps, and whether apps that could see your screen, draw over the game or control your device are installed, and if so whether they came from Google Play. Google reports only these categories, never which apps. We keep Google's result (whether those checks passed, the details above, and when) with your account to detect cheating and fraud. The part that identifies your device is deleted 90 days after that device was last checked.

Advertising (optional rewarded ads)

• The game offers rewarded ads: short videos you can choose to watch in exchange for an in-game reward. They are served by the Unity Ads network through the ironSource LevelPlay mediation SDK. There are no forced, banner, or interstitial ads.
• To serve and measure these ads, the ad SDK may collect your device's advertising ID, IP address, and general device information (model, OS version, language). You can reset or delete your advertising ID, or limit ad personalisation, in your device's Google settings (Settings → Google → Ads).
• Ad views are counted by our servers to grant the reward and enforce the daily limit.

The game does not collect your precise location or contacts, and it does not access your photos or files — apart from any images you choose to attach to a support request.

How we use this information

• To operate the game: authenticate your account, save and sync progress, resolve battles, and deliver purchases.
• To provide social features: friends, guilds, teams, and chat.
• To keep the game fair and safe: server-side validation, anti-cheat and anti-fraud checks, and chat moderation.
• To fix problems and improve the game: crash diagnostics, performance data, and aggregate analytics about how features are used.
• To provide player support when you contact us.
• To show and reward the optional ads you choose to watch, and to enforce their daily limit.
• To comply with legal obligations.

Where the GDPR or similar laws apply, we process this data because it is necessary to provide the game you asked for (performance of a contract), for our legitimate interests in keeping the service secure, fair, and improving (in ways that do not override your rights), or to comply with law.

Service providers

We use a small number of third-party services to run the game. Each receives only the data needed for its role and processes it under its own privacy policy:

Sharing

We do not sell your personal data. We share it only with the service providers listed above (acting on our behalf), with other players where a feature is inherently social (your display name, profile, and chat messages are visible to others), when required by law, or as part of a business transfer such as a merger or acquisition — in which case this policy would continue to apply to data collected under it.

Data retention

We keep personal information for the periods below, unless the law requires us to keep it longer.

Kept after account deletion. A few records are kept for a limited time after your account is deleted, with your player ID replaced by a pseudonymous code, and used only for the stated purpose: purchase records for 720 days (refunds, chargebacks and payment fraud); records of a fraud investigation for 720 days; records needed to enforce a ban for serious abuse, while the ban is in force and for 90 days after it ends; records of actions our team took on your account, until 400 days after each action; and reports you made about other players, which stay with those players' moderation records.

Deleted information can remain in backup copies for up to 51 days before it is removed automatically. Statistics that do not identify you, such as aggregated gameplay figures, may be kept longer.

Account & data deletion

In the game: open Settings → Delete Account. The request is filed as a support ticket tied to your account — you can track it, and cancel it from the same button while it is still pending. Deletion completes within 30 days of the request.

If you no longer have the game installed: email support@newfoundstudios.com from the address linked to your account, or include your player ID and in-game display name so we can verify ownership.

Deletion is permanent: progress, purchases, and social connections cannot be restored. A few records are kept for a limited time afterwards, as set out under Data retention.

You can also request a copy of the data associated with your account, or correction of inaccurate data, through the in-game Support screen (Settings → Support) or the same email address.

Children

HeroBrawl is not directed at children under 13 (or the higher minimum age required in your country, such as 16 in parts of the European Economic Area). We do not knowingly collect personal data from children below that age. If you believe a child has created an account, contact us and we will delete it.

International transfers

Our servers and service providers may store and process data in countries other than yours, including the United States and the European Union. Where required, transfers are protected by appropriate safeguards such as the providers' standard contractual clauses.

Security

Data is transmitted over encrypted connections and stored with access controls. Game-critical actions are validated server-side. No online service can guarantee absolute security, but we design the game so that sensitive data we do not need is simply never collected.

Your rights

Depending on where you live (for example under the GDPR, UK GDPR, or the California Consumer Privacy Act), you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to lodge a complaint with your local data protection authority. Exercise any of these rights via the in-game Support screen or support@newfoundstudios.com. We do not discriminate against players who exercise their privacy rights, and we do not sell or "share" personal data as those terms are defined under the CCPA.

Changes to this policy

If we change this policy, we will update this page and the effective date above. For material changes we will also notify you in the game before they take effect.

Contact

NewFound Studios
support@newfoundstudios.com