Privacy Policy

Last updated: October 5, 2026

Hellruler is operated by Betsdom Ltd, a company registered in Bulgaria under company number 208493508, trading as Hellruler (the Company, we, us and our). We are the data controller for the personal data described below.

This Privacy Policy explains what we collect when you use our website, game and services, why we collect it, who we share it with, how long we keep it, and the rights you have over it. If anything here is unclear, write to us at support@hellruler.com.

1. Information We Collect

Account information. Accounts are created and authenticated through Clerk, our identity provider. We receive your email address and an account identifier, and, if you sign in through a third-party provider, the basic profile information that provider releases to us. We never see or store your password.

Game data. Your character name, progress and depth reached, inventory and equipment, gear score, arena rating, your saved game and a rolling history of recent saves, records of recent fights, your guild membership and any guild you create or apply to join.

Guest play. If you play without an account, we create a temporary guest account on our servers. It is identified by a random identifier kept in your browser and holds the same game data as an account, but no email address.

Your agreements. Before your first fight we record which versions of these Terms and this Policy you agreed to, that you confirmed the photosensitivity notice, the guest rule and your age, whether you asked us to email you news, events and gifts, and when. This record is how we show that you agreed. We send such emails only if you asked for them and only once you have an account with an email address; our legal basis is your consent, Article 6(1)(a), which you may withdraw at any time from any email or by writing to us.

Purchase data. A record of what you own — subscription status and dates, extra build slots, cosmetics — together with a payment-processor customer identifier and the identifiers of payment events we have processed. Card details are entered on our payment processor's own checkout pages and are never sent to or stored by us.

Technical data. Ordinary server logs, which include your IP address, the type of browser and device you are using, and the time of a request. We use these to operate the service and to investigate faults and abuse.

Data kept on your device. The game stores your settings, an offline copy of your save and your session information in your browser's local storage. This stays on your device, and reaches us only as part of a normal save to your account.

We do not ask for special category data (such as health, biometric, political or religious information), and we ask that you do not send any to us.

2. How We Use It, and Our Legal Bases

To create and operate your account, save and sync your progress, and run the guild, arena and leaderboard features — performance of our contract with you, GDPR Article 6(1)(b).
To process purchases and subscriptions and to keep records of them — performance of our contract, and compliance with a legal obligation, Article 6(1)(b) and (c).
To send you account, security and transactional messages — performance of our contract.
To keep the game fair: detecting cheating, tampering, exploits and abuse, and enforcing our Terms — our legitimate interests in protecting the service and the people playing it, Article 6(1)(f).
To understand in aggregate how the site and game are used, so we can improve them — our legitimate interests, using the analytics described in section 3, and your consent where section 3 says a tool depends on it, Article 6(1)(f) and (a).
To keep accounting and tax records and to respond to lawful requests — compliance with a legal obligation, Article 6(1)(c).

We do not use your data for advertising, we do not build advertising profiles, and we do not sell your personal data. There is no automated decision-making that produces legal or similarly significant effects for you; automated anti-cheat checks may restrict an account, and you can always ask a person to review that decision.

3. Analytics

We use Plausible Analytics, an open-source, privacy-focused analytics service provided by Plausible Insights OU (Estonia), with data stored on servers inside the European Union.

Plausible sets no cookies, stores no persistent or cross-site identifier, and does not follow people between websites or over time. For each page view it records the page address, the referring source, the browser, operating system and device type, and a country derived from the IP address. The IP address itself is not stored: it is used only to produce a salted hash for counting unique visits within a single day, and the salt is discarded daily so that the hash cannot be traced back to you.

What we receive is aggregate, non-identifying traffic statistics. We do not send Plausible your email address, your account identifier, or anything else that identifies you. Our legal basis is our legitimate interest in understanding how the service is used. Because nothing is stored on or read from your device for this purpose, Plausible needs no consent.

Gameplay analytics, from our servers. To see where players get stuck and whether they come back, our game servers record a small number of gameplay events as they happen — a play session starting and ending, a first fight, a new deepest depth, a Rite attempted, an arena series, joining or founding a guild, opening the store, starting a purchase and completing one — and send them to PostHog, a product-analytics service provided by PostHog, Inc. (United States), on servers it operates inside the European Union. Each event carries your account identifier (or your guest identifier) and your in-game name, so that we can count one player once, together with a few gameplay numbers such as the depth reached. Nothing is loaded into your browser for this: no PostHog script, no cookie and no local storage. Your IP address, email address and device details are not sent — the events leave from our servers, not from your device. Our legal basis is our legitimate interest in improving the game, Article 6(1)(f); you may object at any time (section 9), and we will stop recording these events for your account and delete the ones we hold.

Where you came from, and telling the advertiser. If you arrive through one of our advertisements, the link carries the campaign's tags (the usual utm_ parameters) and, for a Reddit advertisement, a click identifier that Reddit adds to the link. Your browser keeps these in local storage for ninety days, and the game sends them to our servers with your first connection, so that we know which advertisement brought a player and can stop the ones that bring none. If you then create an account or make a purchase, our servers tell Reddit's Conversions API, a measurement service provided by Reddit, Inc. (United States), that the click with that identifier led to a sign-up or to a purchase of a given amount. Nothing else is sent: no email address, no account identifier, no IP address, no device details, and no script of Reddit's is loaded into your browser. Reddit can tie the identifier to the advertisement it served and, if you were signed in to Reddit when you clicked, to your Reddit account; its own handling of this data is described in its privacy policy. Our legal basis is our legitimate interest in measuring our advertising, Article 6(1)(f); you may object at any time (section 9), and if you clear your browser's local storage the identifier is gone before it is ever sent.

Google Analytics. Our pages at hellruler.com, including the game at /play, load Google Analytics 4, a measurement service provided by Google Ireland Limited (Ireland). It records page views and the events Google calls enhanced measurement — the page address, the referring source, your approximate location derived from your IP address, your browser, operating system and device type, and how far you scroll or where you leave. We do not send Google your email address, your Hellruler account identifier or anything from your game data, and we have turned off the advertising features of the product: Google Analytics is not used here to build advertising audiences or to personalise ads.

The tag runs in Google's consent mode. Until you choose Allow in the notice described below, and permanently if you choose Decline, it runs in its cookieless state: it sets no _ga cookie, reads nothing from your device and cannot recognise you on a later visit, so each visit is counted separately and no identifier persists. Because nothing is stored on or read from your device in that state, it needs no consent, and our legal basis for it is our legitimate interest in understanding how the service is used, Article 6(1)(f). If you choose Allow, the same tag begins setting the cookies described in the next section so that repeat visits can be recognised; our legal basis for that is your consent, Article 6(1)(a), which you can withdraw at any time through Cookie settings in the footer of any public page. Google's own handling of this data is described in its privacy policy and in how Google uses data from sites that use its services.

Advertising measurement, only with your consent. Our pages at hellruler.com can load the Meta Pixel, a measurement tool provided by Meta Platforms Ireland Limited (Ireland). It tells us whether a visit came from one of our Facebook or Instagram advertisements and records a page view. To do that it sets cookies on your device (see the next section) and sends Meta the page address, the referring source, your browser details and your IP address, which Meta may match to a Facebook or Instagram account it already knows. We do not send Meta your Hellruler account identifier, your email address or anything from your game data.

The pixel loads only after you choose Allow in the notice shown on your first visit; until then, and if you choose Decline, nothing from Meta is loaded and no Meta cookie is set. Our legal basis is your consent, which you can withdraw at any time: use Cookie settings in the footer of any public page of the site to change your choice, or delete the hr_consent cookie. The game itself, at /play, loads no pixel and shows no notice; the Google Analytics tag described above does run there, and it follows whatever choice you made on the way in. Meta's own handling of this data is described in its privacy policy, and you can control ads-related data in your Meta ad preferences.

4. Cookies and Local Storage

We use no tracking cookies of our own. The only third-party tracking cookies on our pages are Google Analytics' and the Meta Pixel's, and neither is set unless you have chosen Allow in the notice (section 3).

Strictly necessary cookies set by our identity provider keep you signed in.
A strictly necessary cookie of ours, hr_consent, remembers your answer to the advertising-measurement notice for one year.
Our payment processor sets its own cookies on its checkout pages, for payment and fraud prevention.
If you allowed it, Google Analytics sets analytics cookies (_ga and _ga_9VYR62B74Y) that recognise a returning visitor, for up to two years. Until then it sets none.
If you allowed it, the Meta Pixel sets advertising measurement cookies (such as _fbp) on hellruler.com pages.
Local storage on your device holds your settings and an offline copy of your save, so the game runs and does not lose progress.

Plausible analytics, as described above, uses no cookies at all.

5. Who We Share It With

We do not sell, rent or trade your personal data. We share it only with the providers we need in order to run Hellruler, each bound by a contract that limits them to processing on our instructions:

Clerk — accounts, sign-in and authentication email (United States).
Stripe — payment processing and subscription billing (Stripe Payments Europe, Ltd., Ireland, and its affiliates).
Fly.io — application and database hosting; our servers and database run in Frankfurt, Germany (provider incorporated in the United States).
Plausible Insights OU — aggregate website analytics (Estonia; data stored in the European Union).
PostHog, Inc. — gameplay analytics sent from our servers (United States; data stored in the European Union).
Google Ireland Limited — website and game analytics through Google Analytics (Ireland; Google may transfer data to the United States under its own safeguards).
Meta Platforms Ireland Limited — advertising measurement through the Meta Pixel (Ireland; Meta may transfer data to the United States under its own safeguards).
Reddit, Inc. — advertising measurement through Reddit's Conversions API: a click identifier from a Reddit advertisement and whether it led to a sign-up or a purchase, sent from our servers (United States).

We may also disclose data where the law requires it, where it is necessary to establish, exercise or defend legal claims, or where it is necessary to protect the rights and safety of our players. If our business or its assets are transferred to someone else, data may transfer with it; we will tell you before that happens.

6. What Other Players Can See

Your character name, the depth you have reached, your gear score and your arena rating are visible to other players through arena matchmaking, guild rosters and leaderboards. Guild names, tags and descriptions are visible to everyone in the game. Please do not put anything in these fields that you would not want other people to read. Your email address is never shown to other players.

7. International Transfers

Our servers and database are hosted in the European Union. Some of our providers are established outside the EEA, or may access data from outside it. Where that happens we rely on an adequacy decision of the European Commission, or on the Commission's Standard Contractual Clauses together with any further safeguards required, so that your data keeps an equivalent level of protection. You may ask us for a copy of the safeguards we rely on.

8. How Long We Keep It

Account and game data — for as long as your account exists. If an account is inactive for 24 months we may delete it, after writing to the email address on the account.
Guest accounts — deleted, with all their game data, after 30 days without play. Creating an account before then moves the guest's progress to it.
Your agreements — for as long as your account exists, and deleted with it.
Save history and fight records — kept on a rolling basis and overwritten as newer ones are recorded.
Purchase, invoice and accounting records — for the period Bulgarian accounting and tax law requires, currently up to 10 years, even after you delete your account. These are kept only for legal compliance and are not used for anything else.
Server logs — normally no longer than 30 days, and longer only where a specific security investigation requires it.
Analytics — Plausible holds aggregate statistics only, with no personal data to retain. Google Analytics keeps event data for 14 months, the shortest retention the product offers, after which it survives only inside aggregate reports. The gameplay events sent to PostHog are kept while your account exists and deleted with it, or earlier on request.

9. Your Rights

Under the GDPR you have the right to obtain a copy of your personal data; to have it corrected if it is wrong; to have it erased; to restrict or object to how we process it, including any processing based on our legitimate interests; to receive it in a portable, machine-readable form; and to withdraw any consent you have given, without affecting anything done before you withdrew it.

To exercise any of these, email support@hellruler.com from the address on your account. We will reply within one month, and will tell you if a complex request needs longer. Exercising your rights costs nothing.

You can delete your account yourself in the game: Settings → Account → Delete account (see hellruler.com/delete-account), or ask us by email. Deleting your account removes your account, your progress, your saves, your fight records, your guild membership and your place in the Hall of Fame. It cancels an active subscription at once. It does not remove the purchase and accounting records we are required by law to keep, and it does not refund past purchases or the days left on a subscription.

If you think we have handled your data wrongly, please tell us first so that we can put it right. You also have the right to complain to the Bulgarian Commission for Personal Data Protection (Komisia za zashtita na lichnite danni), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, cpdp.bg, or to the supervisory authority in the country where you live.

10. Security

Traffic between you and our servers is encrypted in transit. Access to production data is limited to the people who need it. Passwords are handled entirely by our identity provider and never reach us, and card details are handled entirely by our payment processor and never reach us. We take backups of game data. No system can be perfectly secure, and we do not promise that ours is; where a breach is likely to affect you, we will notify you and the supervisory authority as the law requires.

11. Children

Hellruler is not intended for young children. You must be at least 14 years old to create an account, or older if the age of digital consent in your country is higher. If we learn that we hold data belonging to a child below that age, we will delete it. If you are a parent or guardian and believe your child has created an account, write to support@hellruler.com and we will remove it.

12. Changes to This Policy

We will post any change on this page and update the date at the top. Where a change materially affects your rights, we will give you notice by email or in the game before it takes effect.

13. Contact Us

Betsdom Ltd, Bulgaria, company number 208493508 — support@hellruler.com.