Privacy Policy

Updated 2026-06-18

This policy explains what personal data is processed by XHeroes (hereinafter — the "Game", website xheroes.agency) and what rights players have. We process only as much data as is needed for the game to work.

1. Who we are

XHeroes is an independent online game. You can raise questions related to data processing through our Discord server or by email at pagalba@xheroes.agency.

2. What data we collect

Account data: email address and password (stored only as a cryptographic hash).
Sign-in via Google or Discord: if you sign in through them — account ID, name, avatar and email.
Game data: your agency, heroes, progress, decisions and statistics.
Community content: chat messages, suggestions and bug reports. This content is synced to our public Discord server and is visible there to others.
Technical data: IP address, session cookie and basic browser information — necessary for security and sign-in.

3. Why we process it (legal basis)

To run your account and the game — performance of a contract (our terms).
For the community and Discord integration — your action (when you post or link Discord) and our legitimate interest in maintaining the community.
For security (protection against abuse, fraud) — legitimate interest.

4. Who we share it with

We do not sell your data. Data may only be accessed by service providers necessary for the game:

Google and Discord — if you sign in through them (identity verification).
Discord — when you post in the community or send a suggestion, the content is published on our server (Discord's terms apply).
Server hosting provider — for data storage.

5. How long we store it

We store data for as long as you have an account. When you delete your account (you can do this yourself in Settings), your account and agency are removed. Community content already published on Discord may remain there under Discord's terms.

6. Your rights (GDPR)

You have the right to: access your data, rectify it, erase it, restrict or object to its processing, as well as receive a copy of your data. You can delete your account and data yourself in Settings or by writing to us. If you believe your rights have been violated, you may contact the State Data Protection Inspectorate of Lithuania (VDAI).

7. Cookies

We use only a necessary session cookie to make sign-in work. We do not use advertising or tracking cookies, or analytics.

8. Age

The game is intended for people aged 14 and over. Younger users may play only with the consent of a parent or guardian.

9. Changes

We may update this policy. We will announce significant changes in the game or on Discord. The date at the top shows the last update.