The short version
- No account to make. The game never asks for your email, phone number or a password. After the first boss it offers to name your army (a nickname, which you can skip), and your Game Center or Google Play Games nickname comes to us too if you're signed in. Signing in to Game Center (iPhone) or Google Play Games (Android) is optional, and Apple or Google handles it.
- No ads or analytics in this version. It contains no advertising or analytics services of its own and never uses your advertising identifier. On Android, Google's Play Games library keeps usage and diagnostic data of its own, for Google. If a later version adds ads or analytics, this policy will say so, and name the company providing them, before that version ships.
- A copy of your save is kept on our server, under a random account ID the game creates for your install. It holds game progress only, and we check it for signs of cheating.
- Leaderboards are optional. If you're signed in to Game Center on iPhone, or Google Play Games on Android, the game sends Apple or Google your three records. That's all the leaderboards get.
- We don't sell your data, and this version doesn't use it for advertising.
- Want your copy deleted? Email admin@hashstore.app.
Who we are
Hely Strike is a mobile game made and published by Osidev (“we”, “us”). This policy covers the game and this website. If you have a question about it, write to admin@hashstore.app.
What leaves your phone
This is the complete list. Anything not on it stays on your device.
| What | Where it goes | Why | How long |
|---|---|---|---|
| A copy of your save | Our server | To keep a copy of your progress off the phone, to deliver what you buy into it, and to spot cheating | Until you ask us to delete it |
| Your account ID and key | Our server, with each sync | So only your install can read or change your copy | As long as the copy. The key itself is never stored, only a hash of it |
| The player name you choose, and your Game Center or Play Games nickname if you're signed in | Our server | To tell players apart, and to find your account when you write to us | As long as the account, and deleted with it |
| A transfer code, only when you use MOVE PROGRESS | Our server | To move your progress to another phone | Until it's used, and never more than 24 hours. Only a hash of it is stored |
| Purchase records | Our server, which checks them with Apple or Google | To deliver each purchase exactly once, and to handle refunds | As long as we need them for refunds and accounting |
| Your account ID, when you buy | Apple or Google, inside the purchase | So a purchase can only be delivered to the account that made it | Held by Apple or Google with the purchase |
| Your IP address | Our server, for the length of a request | To stop scripts from creating accounts in bulk or guessing transfer codes | Not stored by us |
| Update checks | Our server | To download level and game-balance updates | Not linked to your account |
| Your three records | Apple Game Center or Google Play Games, only if you're signed in | Leaderboards | Held by Apple or Google |
| Play Games usage and diagnostics (Android) | Google, from its Play Games library in the game | Google's own: to keep Play Games stable and improve it | Held by Google |
| A picture of your run | Wherever you send it, only when you tap SHARE | Sharing | Never sent to us |
Your account and your save copy
There's nothing to sign up for. The first time Hely Strike connects to the internet, our server creates an account for your install: a random ID and a secret key. The key stays on your phone. Our server keeps only a hash of it, a one-way fingerprint, so even a copy of our database couldn't be used to act as you.
From then on, the game sends a copy of your save when it starts and after your runs. The copy holds:
- the levels you've reached and the stars you've earned
- your gold, cores, weapons, gear, troops and colours, and what you've bought
- your daily rewards, missions, streaks, medals and unlock-road progress
- your best records, for the leaderboards
It doesn't hold your email, contacts, location or device name, and there's nowhere in the game to type any of those. Your settings (music, sound, vibration and screen shake) stay on your phone. Alongside the copy, our server keeps the date your account was created, when it last connected, whether your phone is an iPhone or an Android phone, and your player name if you have one (see Your player name).
Your phone stays in charge of your progress. The server never overwrites your save on its own. Only these things come back down: anything you've bought that hasn't reached the game yet, a refund of something you bought (see Purchases), your player name, a change we make to your progress ourselves (gold or cores to make up for a problem, say, or a reset you asked us for), and your whole copy when you move it to a new phone (see Moving to a new phone). The game plays the same offline. If it can't reach our server, nothing is sent and it tries again later.
Your player name
After you beat the first boss, the game offers to name your army. It's optional, and you can set or change it later in Settings: the first name is free, and changes after that cost cores. Please pick a nickname rather than your real name. Your player name isn't shown to other players; it's how we tell accounts apart, and how we find yours if you write to us. Settings also shows your player tag (like #4F7A1C9B), which identifies your account exactly.
If you're signed in to Game Center on iPhone or Google Play Games on Android, the game also sends our server the nickname Game Center or Play Games shows for you, with your save copy. It suggests it as your player name, and helps us find your account. We never receive your Game Center or Play Games player ID or your friends list.
We may change or remove a player name that's offensive. Your player name and nickname are kept with your account and deleted with it.
Moving to a new phone
In Settings, MOVE PROGRESS gives you a one-time code on your old phone. Typing it into Hely Strike on your new phone moves your account there, with your progress and your purchases. Our server keeps only a hash of the code, and the code works once, within 24 hours. Anyone who has the code can take your progress, so keep it to yourself.
When the code is used, our server stops accepting your old phone's key, and that phone starts a new game. Your new phone replaces whatever progress it had with the one you moved.
Checking for cheating
To keep the leaderboards fair, our server reads each copy for signs of tampering. It keeps a short summary of what the copy says (your gold, cores, XP, level, wins, stars, best army and endless stage) and compares each new copy with the last. When the numbers are impossible, or jump further than play could explain, it writes a note with those numbers for us to look at.
A note is never a decision. A person looks at it, and only a person can ban an account. If we ban yours, our server stops accepting new copies of your save and the game stops sending your scores to the leaderboards. Your game keeps working, your progress stays on your phone, and anything you buy is still delivered. If you think we got it wrong, email admin@hashstore.app and we'll look again.
Purchases
Payments are handled entirely by Apple on iPhone and by Google Play on Android. We never see your card, your Apple ID or Google account, or your billing address.
On iPhone, the game gives Apple your random account ID with the purchase, and Apple's signed record of the transaction comes back carrying it. The game sends that record to our server. We check that it's genuine and that it belongs to your account, then record Apple's transaction IDs, the product, when it was bought, whether it was a real purchase or a test one, what it gave you, and whether Apple later refunded it.
On Android, the game gives Google Play your random account ID with the purchase, and Google Play hands the game a purchase token. The game sends that token to our server, which asks Google whether the purchase is genuine, paid for and made for your account. We then record Google's order ID, the product, when it was bought, whether it was a real purchase, a test one or a promo code, what it gave you, and whether Google later refunded it. We don't keep the token itself. Only after that does the game tell Google Play the item has been delivered.
That record is what makes sure each purchase is delivered once, and only once, even if the connection drops halfway.
Refunds. If Apple or Google refunds a purchase, our server learns about it: Apple sends it a notice, and for Google it checks Google's list of refunded purchases. We mark the purchase as refunded and note the refund on your account for a person to look at. The next time your game connects, it takes back the gold or cores that purchase gave you, as far as you still have them. It never takes more than you have.
Game updates
When the game starts, it asks our server whether there are updates to levels or game balance, and downloads any that exist. These requests don't carry your account ID.
Leaderboards
Hely Strike has three optional leaderboards: biggest army, furthest level and best endless stage. They run on Apple Game Center on iPhone and on Google Play Games on Android.
On iPhone, if you're signed in to Game Center, the game submits those three numbers to Apple. We receive the nickname Game Center shows for you (see Your player name), but never your Game Center player ID or friends list. Apple runs the rankings, and Apple's privacy policy covers them. To stop submitting scores, sign out of Game Center in your iPhone's Settings.
On Android, Google Play Games may sign you in automatically when the game starts. If it doesn't, the game asks only when you tap SIGN IN. While you're signed in, the game submits the same three numbers to Google. We receive the nickname Play Games shows for you (see Your player name), but never your Play Games player ID or friends list. Google runs the rankings, and Google's privacy policy covers them. Google's Play Games library in the game also collects usage and diagnostic data of its own, which Google uses to keep Play Games stable and improve it. None of it comes to us.
To remove scores already posted, contact Apple or Google, or write to us and we'll help you ask.
If an account is banned for cheating (see Checking for cheating), the game stops submitting its scores.
Sharing a run
On iPhone, when you tap SHARE, the game makes a picture of your run and opens your iPhone's share sheet. You choose where it goes, and we never see it.
If you choose Save Image, iOS asks your permission to add the picture to your photos. That permission lets the game add pictures; it can't see your photo library.
On Android, SHARE opens Android's share sheet with the same picture and line. You choose the app; Android tells the game only which app you picked, so it can give the share reward, and we never see the picture. To hand it over, the game keeps a copy of the picture in its own temporary storage on your phone.
What this version doesn't do
- No advertising. It shows no ads, never uses your advertising identifier, and never asks to track you.
- No analytics or crash reporting. It doesn't report how you play. The save copy is the only record we have. (On Android, Google's Play Games library keeps diagnostics of its own, for Google; see Leaderboards.)
- No access to your location, contacts, camera or microphone, and no reading of your photos.
- No chat, and no way for other players to contact you.
- No selling or sharing of your data for advertising.
Who runs our server
Our server runs on Cloudflare (Workers and D1). Cloudflare processes requests for us, and may do it in data centres outside your country; Cloudflare's privacy policy describes how. We don't use any other company to store or process your data. Our server also asks Google to check Android purchases and to list refunded ones (see Purchases).
How long we keep it
- Your save copy and account: until you ask us to delete them.
- The summary of your copy, notes about possible cheating, and bans: as long as the account, and deleted with it.
- Your player name, the names you've had, and your Game Center or Play Games nickname: as long as the account, and deleted with it.
- Purchase records: as long as we need them for refunds, accounting and the law.
- Transfer codes: until they're used, and never more than 24 hours.
- IP addresses: we don't store them.
Deleting your data
On your phone: deleting Hely Strike deletes your save and your account key.
On our server: once the key is gone, your copy can't be linked to your phone, and only your player name or Game Center / Play Games nickname, if it has one, could link it to you. To have it erased, email admin@hashstore.app with your player tag or player name, both in Settings. If you no longer have the game, we'll ask about your progress (your level, your gold and roughly when you last played) to find the right account. We'll delete it within 30 days.
Children
Hely Strike is made for a general audience. It doesn't ask anyone for their age or contact details, and it has no chat. It offers a player name, asks for a nickname rather than a real name, and never shows that name to other players. If you're a parent and want your child's save copy or player name deleted, email us and we will.
Your rights
Depending on where you live, laws such as the GDPR and the CCPA give you the right to see, correct, delete or get a copy of the personal data we hold about you, and to object to how we use it. Email us to use any of them; we answer within 30 days.
If you're in the EEA or the UK: we keep your save copy and purchase records to provide the game you're playing (performance of a contract), check copies for cheating to keep the leaderboards fair for every player (our legitimate interest), keep your player name and Game Center or Play Games nickname to tell accounts apart and help you when you write to us (our legitimate interest), and use IP addresses briefly to protect our server from abuse (our legitimate interest). You can also complain to your local data protection authority.
This version doesn't sell or share personal information, as California law defines those terms.
This website
This site sets no cookies, runs no analytics and loads nothing from other companies. Like any web server, ours keeps standard access logs: your IP address, the page you asked for and when.
Changes to this policy
If the game starts collecting anything new, we'll update this policy before that version ships and change the date at the top. If we ever add analytics, they'll be off until you turn them on.
Contact
Osidev · admin@hashstore.app