How we handle your data.
What we collect, why, who helps us process it and how you keep control, described as Heralds Store really operates.
Last updated: 17 October 2026
The gist: you can browse and play without an account and without giving any personal details. If you open an account or write to us, we use what you provide only to run the account and to reply. There are no ads, no analytics or tracking tools, no sale of data, and we never ask for card or payment details.
Who is responsible
The data controller for this website is (company number ), .
“We” and “us” refer to whoever operates Heralds Store (heraldsstore.com). For questions about your data, use the contact form and select “Privacy question”, or email .
What we collect
1. When you open an optional account
- By email: first and last name, a screen name, an email address and a password. The password is kept only as a scrambled hash, never in readable form.
- By Google: your name, verified email and Google account ID, which Google sends us after you approve the sign-in. We then ask for a screen name and your date of birth.
- Date of birth: checked once at sign-up to confirm you are 18+. It is not stored; we keep only the fact that your age was confirmed.
- Account records: when you joined, your most recent sign-in, how you registered (email or Google), and a failed-attempt counter that locks the account for 15 minutes after five wrong passwords.
2. When you write to us
The contact form gathers your name, email address, topic and message, plus the name of the game if you came from a game page. Please keep passwords and sensitive details out of your message.
3. When you reset a password
We create a single-use link valid for 60 minutes. Until it is used or expires, we hold only a scrambled version of its secret code.
4. Technical and security data
- Abuse limits: to slow spam and password guessing, the server keeps short-lived counters linked to a hashed form of your IP address. They expire within a day.
- Mail results: a technical log noting whether each email was sent or failed, with any error text from the mail server. It does not contain your message.
- Server logs: as with most websites, our host’s web server may record standard details such as IP address, browser type and pages requested, for security and troubleshooting.
5. What we never collect
Payment or card details (nothing is for sale), advertising or analytics data, and profiles built about you.
Why we use it, and the legal basis
| Purpose | Data | Basis |
|---|---|---|
| Open and run an account, keep you signed in | Account details, session cookie | Performing our agreement with you |
| Check you are 18 or over | Date of birth (not stored) | Legal obligation and legitimate interest in keeping minors out |
| Reply to your messages and requests | Contact form data | Legitimate interest in replying, and your request |
| Email a password-reset link | Email address, reset link | Performing our agreement with you |
| Prevent spam, abuse and password guessing | Hashed IP counters, failed-attempt counter | Legitimate interest in security |
Where it goes, and who else sees it
- Our server. Account details sit on our web server in protected files that cannot be opened from the web. There is no database.
- Email delivery. Contact messages and reset emails go through our email provider, Brevo (SMTP relay), and arrive in our support inbox. We keep messages only as long as needed for your request and any follow-up.
- Google. Only if you choose “Continue with Google”. Google’s sign-in code loads only on the sign-in and sign-up pages, and Google handles sign-in under its own Privacy Policy.
- Hosting. Our host stores the site and its server logs.
- The games. Games are served from our own domain (heraldsstore.com) and load inside our pages. A game may save its own settings or progress in your browser storage; we do not use that to identify you.
Some providers may process data outside your country. We do not sell personal data or share it for advertising, and we may disclose data where the law requires.
How long we keep it
- Account: until you delete it in My account (immediate) or ask us to.
- Messages: as long as your request and follow-up need, then deleted.
- Reset links: up to 60 minutes, or until used.
- Abuse counters: about a day at most.
- Sessions: until you sign out, or up to 30 days if you choose “Keep me signed in”.
Security
Passwords are hashed, account files are kept out of reach of the web, forms are protected against cross-site requests, and repeated wrong passwords briefly lock an account. No system is perfectly secure, so please use a strong, unique password.
Your rights
Depending on where you live, you may be able to ask to see the data we hold about you, correct or erase it, restrict or object to its use, receive a copy, or withdraw consent. If you opened an account you can delete it yourself at any time in My account. For anything else, use the contact form and select “Privacy question”. You may also complain to your local data protection authority.
Cookies and browser storage
Only strictly necessary cookies and storage are used. See the Cookie Policy.
Children
Heralds Store is for adults aged 18 and over, and we do not knowingly collect data from anyone younger. If you think a child has opened an account, let us know and we will remove it.
Changes
If our practices change, we will update this page and its date.