Privacy Policy

1. Information we collect

We collect information in three ways: information you give us directly, information collected automatically, and information from third parties.

1.1 Information you provide

• Email address — when you join the waitlist, create an account, or subscribe to launch updates. Used to send you product news, account notifications, and updates you opt into.
• In-app preferences — your selected heroes, favourite roles, and draft history that you explicitly save inside the app.
• Support communications — any messages, attachments, or feedback you send to our support team.

1.2 Information collected automatically

• Usage data — features you use, draft queries you run, counter-pick requests, and in-app events (e.g. button taps, session length). This helps us improve the product.
• Device information — device model, operating system version, app version, language and region settings, and a resettable device identifier.
• Log data — crash reports, error logs, timestamps, and IP address. Retained for up to 90 days.
• Session recordings and heatmaps — we use Microsoft Clarity on our website to record anonymised mouse movements, clicks, and scroll behaviour. Clarity may set cookies. You can opt out via your browser's "Do Not Track" setting or a consent management tool.

1.3 Information from third parties

• Steam account binding — when you choose to "Sign in with Steam", we receive your public Steam profile via Steam's OpenID 2.0 protocol and the Steam Web API. We store: your 17-digit SteamID64, the 32-bit account ID derived from it, your public Steam persona name, your avatar image URL, and a flag indicating whether your match history is public or private. We never see, request, or store your Steam password.
• Dota 2 match metadata — if your Steam match history is public, we retrieve up to 50 of your most recent Dota 2 matches and store match ID, start time, and the hero ID you played. We use this only to compute your top-10 hero pool over the last 30 days and to power personalised features (patch impact alerts, matchup tips, draft analysis tuned to your bracket). If your match history is private, we cannot retrieve this data and the dependent features fall back to manual input.
• Bracket / MMR estimate — we resolve your skill bracket (Herald → Immortal) via the OpenDota public API (and, in future, the STRATZ API once their commercial tier is in place). The estimate is stored alongside your Steam profile.
• Steam binding lifecycle — you can unlink your Steam account at any time from Settings. On unlink, the active binding is moved to an archive sub-collection and the dependent features revert to manual input. Account deletion (Settings → Delete Account) recursively deletes the binding, archive, and cached match metadata.
• App store platforms — Apple App Store and Google Play may share anonymised download and purchase data with us per their developer agreements.

2. How we use your information

We use the information collected for the following purposes, each tied to a legal basis:

We do not use your data for automated decision-making that produces legal or similarly significant effects without human review.

3. Data sharing and disclosure

We do not sell your personal data. We share data only in the following limited circumstances:

3.1 Service providers

We use carefully vetted third-party processors to help operate the Service. These processors act only on our instructions and are bound by data protection agreements:

• Vercel — website hosting and edge delivery (United States)
• Microsoft Clarity — website analytics and session recordings (United States)
• Transactional email provider — sending account and notification emails
• Crash reporting tool — diagnosing app errors

3.2 Legal requirements

We may disclose data if required by law, court order, or government authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Hero Edge, our users, or the public.

3.3 Business transfers

If Hero Edge is acquired, merged, or undergoes a change of control, your data may be transferred to the new entity. We will notify you via email or in-app notice before your data is subject to a different privacy policy.

3.4 Aggregated and anonymised data

We may share aggregated, de-identified statistics (e.g. "most-picked heroes this week") that cannot reasonably be used to identify you.

4. Data retention

• Account data — retained for as long as your account is active, plus 30 days after deletion to allow for recovery requests.
• Waitlist email — retained until you unsubscribe or request deletion.
• Usage and analytics data — retained for up to 24 months in identifiable form, then aggregated or deleted.
• Crash logs and IP addresses — retained for 90 days.
• Support messages — retained for 2 years after ticket closure.
• Backups — deleted within 90 days of the primary data deletion.

5. Security

We implement industry-standard technical and organisational measures to protect your data, including:

• TLS encryption for all data in transit
• Encryption at rest for database storage
• Access controls and least-privilege principles for staff
• Regular security reviews and dependency audits

No system is completely secure. If you suspect unauthorised access to your account, please contact us immediately at help.heroedge@gmail.com. In the event of a personal data breach that poses a risk to your rights, we will notify you and relevant authorities as required by applicable law.

6. Your rights

Depending on your location, you may have the following rights regarding your personal data. To exercise any of these rights, email us at help.heroedge@gmail.com with "Privacy Request" in the subject line. We will respond within 30 days.

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion of your personal data, subject to legal retention obligations.
• Restriction — ask us to stop processing your data while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest or for direct marketing (always honoured for marketing).
• Withdraw consent — withdraw any consent you have given at any time without affecting prior lawful processing.

7. GDPR — EU / EEA residents

If you are located in the European Union or European Economic Area, additional protections apply under the General Data Protection Regulation (GDPR 2016/679).

• Data controller: Hero Edge (contact: help.heroedge@gmail.com)
• International transfers: Some processors are located outside the EU/EEA (e.g. the United States). We ensure adequate safeguards are in place through Standard Contractual Clauses (SCCs) or equivalent mechanisms approved by the European Commission.
• Right to lodge a complaint: You may lodge a complaint with your local data protection authority. A list of EU supervisory authorities is available at edpb.europa.eu.

8. CCPA — California residents

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the CPRA grants you additional rights:

• Right to Know — request disclosure of the categories and specific pieces of personal information collected about you in the past 12 months.
• Right to Delete — request deletion of personal information we have collected, subject to exceptions.
• Right to Correct — request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing — we do not sell or share personal information for cross-context behavioural advertising.
• Right to Limit Use of Sensitive Personal Information — we do not collect sensitive personal information as defined by the CPRA.
• Non-Discrimination — we will not discriminate against you for exercising any of your CCPA rights.

To exercise your CCPA rights, email help.heroedge@gmail.com with "CCPA Request" in the subject line. We will respond within 45 days, with one 45-day extension if necessary.

9. Children's privacy

The Service is not directed to children under the age of 13 (or 16 in the EU/EEA). We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy periodically. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send an email notification to registered users at least 14 days before the changes take effect
• Display an in-app notice for significant changes

Continued use of the Service after the effective date constitutes acceptance of the updated Policy. If you do not agree with the changes, you may close your account and request data deletion before the effective date.

11. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out:

We aim to respond to all privacy inquiries within 30 days. For urgent matters (e.g. suspected data breach), please include "URGENT" in the email subject line.