Privacy Policy

This policy explains, in plain language, what personal data HeroesWorld collects and how we look after it. We are a non-commercial fan community and we keep data collection to a minimum.

Effective 2026-08-09. Last updated 2026-08-09.

Who we are

HeroesWorld is a non-commercial fan community for Heroes of Might and Magic, King's Bounty, and Heroes of Might and Magic: Olden Era, run by the HeroesWorld Administration team. You can write to us in English or Russian:

• privacy@heroesworld.net — privacy and data questions, and to exercise your rights.
• report@heroesworld.net — to report illegal content, or for copyright/trademark notices.

What we collect

• Account — your username, email, and a one-way-hashed password.
• Profile — anything optional you choose to add (bio, location, birthday, links).
• What you post — your topics, posts, signatures, and uploads.
• Technical — your IP address appears in server logs (kept 30 days) and in short-lived anti-abuse counters (held in memory, cleared on restart). The IP a post is made from is kept for 90 days, then erased.

We use only strictly-necessary cookies (see below), show no advertising and no cross-site tracking, and never sell or share your data with brokers; the global (.net) site uses no analytics at all, while the domain with Russian-language content (.ru) additionally uses Yandex Metrica, described below. Spam filtering runs entirely on our own servers, and we do not make automated decisions that significantly affect you — spam filters only flag content for a person to review.

Why we are allowed to use it

We use your data to run the forum and sign you in (to provide the service you asked for); to keep the optional details you chose to share (with your consent, which you can withdraw at any time); and to keep the site secure and spam-free (our legitimate interest, which you can object to).

Who we share it with

We never sell your data. We share the minimum needed with a couple of providers:

• Cloudflare (US) — security and content delivery; it sees your IP and request details. Covered by Standard Contractual Clauses and the EU–US Data Privacy Framework.
• Yandex 360 (Russia) — sends account and notification email; it sees the recipient address, subject, and message. Its servers are in Russia, so this email is processed outside the EU — we rely on it being necessary to deliver the account and security mail you requested.
• OpenRouter (US) — powers our automatic translation; it receives the public content being translated (posts, news, wiki). It is configured so your content is not stored or used to train AI models. Private messages are never sent.

Posts and our media library can embed videos from platforms such as YouTube, Twitch, Vimeo, RuTube, VK, and Coub. Nothing loads from a platform until you click the video — your click loads the player and starts playback, and from that moment the platform handles your data under its own policy. For YouTube we use its privacy-enhanced (no-cookie) player.

Automatic translation

So members who speak different languages can read each other, we automatically translate public content — forum posts, news, and wiki pages — into other languages. Private messages are not auto-translated. Translation is done by the third-party AI provider listed above (OpenRouter), which is configured not to store your content or use it to train AI models, and machine translations are clearly labelled. You stay in control: you can turn automatic translation off for your content and provide your own translation, which we use instead.

How long we keep it

• Your account — for as long as it exists, plus 30 days of backups after deletion.
• Inactive accounts — deleted after 10 years without sign-in. We email three warnings in the final six months so you can keep your account.
• Server logs — 30 days. Post IP addresses — 90 days. Anti-abuse counters — cleared on restart.

Deleting your account

You can delete your account anytime from your settings. When you do, your personal data (email, password, profile, IP history, login times) is erased. Your public posts are kept but detached from you and reassigned to a shared "Former Member" account, so old discussions still make sense — once reassigned, that text is no longer linked to you. Deletion is permanent and cannot be undone.

Accounts that already existed on 2026-08-09 are not auto-deleted retroactively — their 10-year inactivity clock starts on that date.

Your rights

You can get a copy of your data, correct it, delete your account, limit or object to how we use it, take your data elsewhere in a machine-readable file, and withdraw consent at any time. Most of this is self-service — download or delete your data from your account's Data & privacy page. For anything else, email privacy@heroesworld.net; we reply within a month, free of charge.

If you think we have mishandled your data, you can complain to your national data-protection authority (the EU/EEA list is at edpb.europa.eu).

Children

The site is not meant for children under 16 (or the lower age of digital consent in your country, down to 13). You confirm you meet the age limit when you register. If we learn we have collected a child's data without a parent's consent, we delete it.

Cookies

We use only five strictly-necessary cookies — to keep you signed in, protect forms, carry brief status messages, and remember your interface language and which game section you're browsing. None of them are advertising cookies and none needs a consent banner; the only consent prompt is the optional Yandex Metrica analytics on the domain with Russian-language content (see below). The full list is on our Cookies page.

Changes

If we make important changes to this policy, we will let you know on the site before they take effect.

Moderation data

When content is moderated we store the report(s), the decision and who made it, any removed original content (so that a successful appeal can restore it), and any appeals you lodge.

Retention: removed original content is kept for about seven months — long enough for the six-month appeal window to close — and is then purged. IP addresses on moderation records are deleted after 90 days. The remaining audit record is minimised over time.

Your rights: you can download the moderation data concerning you from Account → Moderation, appeal decisions about your content, and request erasure (your content is anonymised to "Former Member").