Privacy Policy
Service: HANMAL: Heroes of the Late Han
Operator: Projectteamforyou
Effective: October 12, 2026 (announced October 5, 2026 · previous edition September 4, 2026)
Contact: [email protected]
Projectteamforyou ("we", "us") respects your privacy and complies with applicable data protection laws, including the GDPR and the CCPA.
1. Information We Collect
The game is played without an account. The items below are collected only when you use the corresponding feature.
1-1. What we collect today
| Category | Data | When | Required |
|---|---|---|---|
| Leaderboard records | Scenario · game seed · command record · result (turns taken · cities held) · the name tag you type (shown publicly on the leaderboard) | When you press "Upload for verification" | Optional |
| Daily Realm leaderboard | Name tag (up to 12 characters · may be left blank · shown publicly) · date · result · seed and command record for verification · rate-limit hash | When you press "Post to leaderboard" | Optional |
| Running totals · Feat completion rates | Aggregate numbers only (total visits · games launched · number of completions per Feat) — nothing that could identify you is stored | On visit · game launch · earning a Feat | Automatic |
| Automatic | Hash of your IP address combined with a secret salt (server operation logs) · error logs | When you use the leaderboard server | Automatic |
Hosting providers' logs: the systems of Cloudflare (which delivers the website) and Railway (which runs the leaderboard server) may temporarily retain logs containing your original IP address for security and incident response, under each provider's own policies. We do not use these logs to identify users.
Daily Realm leaderboard: to limit submissions to three per day, we store a hash of your IP address (for IPv6, the first 64 bits) combined with a random value used only for that day; the IP address itself is not stored. The random value is deleted when the day changes, and the hashes on earlier days' entries are cleared.
1-2. Features not yet offered (this applies from the moment they launch)
| Category | Data | Required |
|---|---|---|
| Account · social sign-in | Email address · display name · provider identifier (Google / Apple / Steam) | Optional |
| Cloud sync | Save files · progress | Optional |
| Analytics | Platform · play time · game outcome (de-identified) — only with your opt-in consent | Optional |
| Purchases | Receipt hash · product identifier | Yes (for purchases) |
These features are not currently offered, and we do not collect this data. Before launching any of them we will revise this policy and give advance notice.
We never collect government identification numbers, payment card numbers, or bank account numbers.
2. How We Use Your Information
- To verify and display leaderboard records (we replay the submitted seed and command record on our server)
- To prevent fraud and abuse of the service (submission limits · security logs)
- To understand how the service is used (aggregate numbers)
- To respond to support enquiries
- Once the features in 1-2 are offered: to identify accounts · synchronise saves · confirm purchases · analyse statistics for users who opt in
Legal bases (GDPR): performance of a contract (1; and account, sync and purchases under 5), legitimate interests (2, 3, 4), consent (analytics under 5).
3. Retention
| Data | Retention |
|---|---|
| Leaderboard records (name tag · faction · result) | For as long as the leaderboard is operated; deleted when you request deletion or when the service ends |
| Leaderboard command records | Stored only for records that pass verification, and deleted 90 days after verification (no command record is stored for records that fail) |
| Daily Realm leaderboard (name tag, result, command list) | Deleted 30 days after submission (the rate-limit hash is cleared once the day has passed) |
| Analytics | Automatically deleted 180 days after collection |
| Server operation logs (IP hashes) | Up to 3 months |
| Hosting providers' logs | Under each provider's (Cloudflare · Railway) retention policy |
| (When offered) Account information · save data · purchase records | Erased within 30 days of account deletion · until account deletion · as required by applicable commerce law (typically 5 years) |
4. Disclosure to Third Parties
We do not sell or share your personal data with third parties, except:
- With your prior consent
- When required by a lawful request from a competent authority
5. Processors and International Transfers
| Processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Content delivery, static hosting | United States and others |
| Railway Corp. | Application servers and database | United States |
| Valve Corporation | Steam authentication and payments (once offered — not currently offered) | United States |
| Apple Inc. / Google LLC | App store authentication and payments (once offered — not currently offered) | United States |
Data may be transferred outside your country of residence. The data transferred are the items in Section 1, for the purposes in Section 2, and are retained as set out in Section 3. Transfers rely on Standard Contractual Clauses or equivalent safeguards. You may refuse international transfer simply by not submitting records to the leaderboards (you can still play the game as usual).
6. Your Rights
You may at any time request to:
- Access your personal data
- Correct inaccurate data
- Delete your data ("right to be forgotten")
- Restrict or object to processing
- Export your data (portability)
- Withdraw consent for analytics (once opt-in analytics is offered)
Email [email protected]. We respond within 10 days. When asking us to delete a leaderboard record, telling us the record number (rp_…) or the name tag and date helps us find it quickly.
Saves stored on your device are never sent to our servers, so they are deleted immediately when you clear your browser storage.
California residents (CCPA/CPRA): we do not sell or share personal information as defined by the CCPA, and we do not discriminate against users who exercise their rights.
7. Children
This service is not directed to children under 13 (or under 16 in the EEA, where applicable). If we learn that we have collected such data, we delete it promptly.
Leaderboard name tags are public. Do not enter your real name, contact details or anything else that could identify you.
8. Security
- TLS encryption in transit (HTTPS only · HSTS)
- In the logs we keep, IP addresses are stored only as hashes combined with a secret salt (originals are not retained)
- Least-privilege access controls
- The leaderboard server replays submitted records in an isolated workspace for verification, and limits size and frequency to prevent abuse
9. Cookies and Local Storage
We use the browser's localStorage and sessionStorage to save your game progress, display settings and chosen language. This data stays on your device and is not automatically transmitted to us (except for the records you choose to send when posting to a leaderboard). You may clear it in your browser settings, which will also delete your saved game data.
We do not use cookies, and we use no advertising or analytics tracking cookies or third-party analytics tools.
10. Contact
- Data Protection Contact, Projectteamforyou
- Email: [email protected]
EEA users may also lodge a complaint with their local supervisory authority.
11. Changes
We will announce changes in-service at least 7 days in advance (30 days for material changes).
| Edition | Announced | Effective | What changed |
|---|---|---|---|
| 2nd | October 5, 2026 | October 12, 2026 | Separated what we collect today from features not yet offered · removed the "anonymous key", settings menu and password items, which are not collected or provided · retention of leaderboard records · hosting providers' logs · IP hashing method · notice that name tags are public · storage and cookie notice |
| 1st | — | September 4, 2026 | First published |
Effective: October 12, 2026