Privacy Policy

This Privacy Policy explains how Halvel mini (“Halvel mini”, “we”, “us”, or “our”), the operator of the game available at mini.halvel.com (the “Service”), collects, uses, discloses, and safeguards your information when you use the Service. By creating an account or using the Service, you agree to the collection and use of information in accordance with this Policy.

1. Information We Collect

Information you provide

• Account data: your email address and a password. Passwords are never stored in plain text — they are hashed (using bcrypt) before storage and cannot be read by us.
• Gameplay data: the characters you create and their attributes (race, class, level, equipment, inventory, gold, skills, quests, guild and group membership), and the choices you make in the game.
• Communications: messages you send in guild chat and any correspondence you send to our support address.

Information collected automatically

• Technical data: your IP address, browser/device type, and request logs, collected by our hosting provider for security, abuse-prevention, and reliability.
• Authentication token: a signed session token stored in your browser’s local storage to keep you logged in (see “Cookies & local storage”).

We do not intentionally collect special-category (sensitive) personal data, and we ask that you do not submit such data through gameplay or chat.

2. How We Use Your Information

• To create and maintain your account and game progress.
• To operate core features — idle progression, dungeons, raids, guilds, groups, chat, and the marketplace.
• To authenticate you and keep your session active.
• To protect the Service against fraud, abuse, cheating, and security threats.
• To diagnose problems, improve performance, and develop new features.
• To respond to your support requests.

We do not sell your personal information, and we do not use it for third-party advertising.

3. Legal Bases (EEA/UK users)

Where the GDPR or UK GDPR applies, we process your data on the bases of: performance of a contract (to provide the Service you signed up for); our legitimate interests (securing and improving the Service); your consent where required; and compliance with legal obligations.

4. Cookies & Local Storage

We use your browser’s localStorage to store a session authentication token and your selected character so you stay logged in between visits. This is strictly necessary for the Service to function. We do not use third-party advertising or cross-site tracking cookies. You can clear this data at any time through your browser settings, which will log you out.

5. How We Share Information

• With other players: your character name, level, class, and role are visible to other players through features such as guild rosters, group search, dungeon/raid parties, and leaderboards; guild chat messages are visible to members of your guild.
• Service providers: with vendors who process data on our behalf to host and run the Service (see “Hosting & processors”).
• Legal & safety: where required by law, legal process, or to protect the rights, property, or safety of Halvel mini, our users, or the public.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy.

6. Hosting & Processors

The Service is hosted on DigitalOcean, LLC (application hosting and managed database) in the United States. Your account and gameplay data are stored in a managed MySQL database. DigitalOcean processes data on our behalf under its own security and privacy commitments.

7. Data Retention

We keep your account and gameplay data for as long as your account remains active. If you request deletion, we will delete or anonymize your personal data within a reasonable period, except where we must retain certain information to comply with legal obligations, resolve disputes, or enforce our agreements. Backups and logs are retained for a limited period and then overwritten.

8. Security

We take reasonable technical and organizational measures to protect your information, including password hashing, encrypted (TLS) connections to the database, signed session tokens, and restricted network access to our infrastructure. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Your Rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data; to object to or restrict certain processing; and to withdraw consent. Residents of the EEA/UK have rights under the GDPR; residents of California have rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them. To exercise any right, contact us using the details below. You may also have the right to lodge a complaint with your local data-protection authority.

10. Children’s Privacy

The Service is not directed to children under 13 (or the minimum age of digital consent in your jurisdiction), and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

11. International Transfers

We operate from, and host the Service in, the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S., which may have different data-protection laws than your country. Where required, we rely on appropriate safeguards for such transfers.

12. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide a more prominent notice. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

13. Contact Us

Questions or requests regarding this Policy or your data can be sent to [email protected].