Privacy Policy
This policy explains what information Helbreath Forever collects, why we collect it, how we use and protect it, and the choices you have. It covers the game and this website. We have tried to keep it in plain language.
Helbreath Forever is operated by Pibardos LLC ("we", "us", "our"). We are the controller of the personal information described below. If you have questions, contact us at support@pibardos.llc.
1. Information we collect
Account information
- Email address and, if you register with email and password, a password. Passwords are stored only as a one-way cryptographic hash by our authentication provider; we never store or see your password in plain text.
- Sign-in identifiers if you continue with Google or Apple. We receive a stable account identifier and the email address associated with it. With Apple you may use Apple's private email relay, in which case we receive a relay address instead of your real email.
- Account status, such as whether your email has been confirmed.
Game information
- Character data you create or earn: character names, appearance, class, attributes, levels, experience, inventory and equipment, currency, position, faction and citizenship.
- Gameplay and world state needed to run a persistent multiplayer world, including which characters are online and where they are.
- Feedback you send us, such as bug reports and support emails.
Technical information
- IP address and connection metadata, used to operate the service, to apply connection limits and anti-abuse throttling, and to diagnose problems.
- Server and security logs, including timestamps, requested URLs and refused sign-in attempts. We log refused sign-ins with the account name and source address so we can notice someone guessing passwords.
- Basic device and app information that a client sends when connecting (for example, the game version and platform) so we can support the build you are running.
What we do not do on this website
- We do not set advertising or tracking cookies, and we do not run third-party analytics, social plugins, or fingerprinting scripts.
- Pages load only our own stylesheet, fonts, images and a small local script. There are no external requests from this website.
2. How we use your information
- To create and secure your account, verify your email and let you sign in.
- To run the game: save and load your characters, resolve combat and movement, and keep the shared world consistent.
- To keep the service safe and available: rate limiting, abuse prevention, troubleshooting and support.
- To send you service emails, such as sign-up confirmation and password recovery. These are transactional messages, not marketing. We do not send marketing email.
- To meet legal obligations and enforce our Terms of Service.
3. Legal bases (EEA, UK and Switzerland)
Where the General Data Protection Regulation applies, we rely on:
- Performance of a contract — to provide the game and account you asked for.
- Legitimate interests — to secure the service, prevent abuse, and keep it working, balanced against your rights.
- Consent — where you choose to sign in with a third-party provider, or where we otherwise ask for it.
- Legal obligation — where we must keep or disclose information by law.
4. How we share information
We do not sell your personal information, and we do not share it for advertising. We share it only with service providers that help us run the game, and only as needed:
| Provider | Purpose | Information involved |
|---|---|---|
| Supabase | Account authentication | Email, password hash, provider identifiers, session tokens |
| Resend | Delivery of confirmation and recovery emails | Email address and message content |
| "Continue with Google" sign-in | Account identifier and email | |
| Apple | "Continue with Apple" sign-in and private email relay | Account identifier and email or relay address |
| OVHcloud | Hosting the game server and this website | Connection metadata and server logs |
| Cloudflare | DNS for our domains | DNS queries; no game data |
We may also disclose information if required by law, to protect the rights and safety of players or the public, or as part of a business transfer. We would tell you if that happened, to the extent the law allows.
5. International transfers
Our servers and providers may process information in the United States and other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses for transfers of personal information out of the EEA or UK.
6. How long we keep information
- Account and game data: while your account exists. Because the beta world is reset periodically, gameplay data may be deleted as part of a planned wipe.
- Support and feedback: for as long as needed to resolve your issue and for a reasonable record afterwards.
- Server and security logs: kept for a short period and then rotated or deleted.
When you ask us to delete your account, we delete or de-identify your personal information within 30 days, except where we must keep something to comply with the law or resolve disputes.
7. How we protect information
Passwords are stored as hashes. Authentication sessions are handled by our provider, and access tokens and PKCE verifiers are held in memory by the game client rather than saved on your device with your password. Access to the server is restricted, administrative access uses SSH keys, and the game service runs with limited permissions. No system is perfectly secure, so we cannot promise absolute security.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. You can exercise these rights by emailing support@pibardos.llc. We may need to verify your identity first. You also have the right to complain to your local data-protection authority.
9. Account deletion
You can ask us to delete your account and its data at any time. See Delete your account for how to make a request. Deleting your account removes your login and game data; it cannot be undone.
10. Children
Helbreath Forever is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it. Where local law sets a higher age of digital consent, we require that age.
11. Cookies and tracking signals
This website does not set cookies and does not use trackers. The game client does not store your password in local preferences or logs. We do not respond differently to browser "Do Not Track" signals because we do not track you across sites in the first place.
12. California residents
We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not use it for cross-context behavioural advertising. The categories of information we collect and the purposes are described above. To exercise your California rights, email support@pibardos.llc.
13. Changes to this policy
We may update this policy as the game changes. When we do, we will revise the date at the top and, for material changes, provide a more prominent notice within the game or by email.
14. Contact
Pibardos LLC
Email: support@pibardos.llc