This notice explains how Rustic Ruby Games processes personal data in connection with the Hearth & Banner website and private-test game services.
Controller and contact
Rustic Ruby Games is the controller for the personal data described in this notice. For privacy questions or requests, contact hello@hearthbanner.com.
Personal data we process
Website data: IP address, requested URL, request time, browser or user-agent information, referrer where supplied, and security or error information. This is collected from your device and network connection when you use the website.
Account and game data: account and player identifiers, guest-account identifiers, authentication and account-link status, session and access records, Support ID, game progress and state, actions and results, build information and relevant event times. This is collected from you, your device and the services used to authenticate your account.
Google sign-in data: if you choose Google sign-in or account linking, the identifiers and other account information made available under the permissions shown by Google during sign-in. We do not receive your Google password.
Diagnostics: crash and unresponsive-app reports, error information, stack traces, filtered diagnostic logs and breadcrumbs, device and operating-system information, build and diagnostic identifiers, session-health information and a limited Atlas loading-time metric. Diagnostic reports may be cached temporarily on the device before transmission.
Support data: contact details, messages, Support ID and any relevant files or device information you provide when contacting us.
Purposes and lawful bases
We process website, account, game and diagnostic data where necessary for our legitimate interests in operating, securing, testing and improving Hearth & Banner, maintaining player progress, preventing misuse and resolving faults. We process ordinary support correspondence for our legitimate interests in responding to enquiries and administering the service.
We process personal data where necessary to comply with legal obligations, including responding to applicable data-protection rights. Where consent is required by law for a particular use of device storage, access or optional processing, consent must be obtained separately; this notice does not itself obtain consent.
Recipients and service providers
We disclose personal data only as necessary to categories of recipients that support the relevant service, including website hosting and security providers, account and authentication providers, optional sign-in providers, diagnostics providers, communications providers, professional advisers and public authorities where disclosure is required by law.
Current principal providers include Cloudflare for website delivery and security, Microsoft PlayFab for player identity and authentication, Google when you choose Google sign-in, and Sentry for diagnostics.
Cookies and device storage
We do not use advertising or behavioural-analytics cookies on the website. Cloudflare security features may use strictly necessary cookies when required to provide a security function. The game may store information on your device for account recovery, local operation and temporary diagnostic caching. Where non-essential storage or access requires consent under applicable law, it must be presented separately.
International transfers
Our service providers may process personal data outside the UK. Where a transfer is restricted under UK data-protection law, we use an applicable adequacy regulation or appropriate safeguards, such as approved contractual safeguards, as required. Contact us for information about the safeguard relevant to your personal data and how to obtain a copy.
Retention
We retain personal data only for as long as necessary for the purpose for which it is processed. Account and progress data is retained while required to provide or preserve the relevant test account and progress, subject to deletion requests and lawful retention requirements. Security and diagnostic records are retained while reasonably required to investigate incidents, identify recurring faults and verify fixes. Support correspondence is retained while required to handle the enquiry and any related legal or dispute requirement. Provider and backup copies may expire under their applicable retention schedules.
Your rights
Depending on the circumstances and lawful basis, you may have rights to access, rectify or erase your personal data, restrict processing, receive portable data and withdraw consent where processing is based on consent.
You have the right to object to processing based on legitimate interests.
To exercise a right, email hello@hearthbanner.com or use your existing verified tester contact channel. We may request proportionate information to verify your identity. Our account deletion guidance explains deletion requests. We normally respond within one calendar month, subject to any lawful extension.
You may complain to the UK's Information Commissioner's Office.
Automated decision-making
We do not currently use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects.
Changes to this notice
We will update this notice when our processing materially changes and will update the date above.