Your privacy.
Hearthlight Saga is published by Pavle Aleksic. Contact support@lazydevsagency.com about this notice or your information.
Last updated 23 October 2026. This notice covers the Hearthlight Saga game and this website. Features and third-party services operate only when enabled in your app version, account and region; listing a provider here does not mean that its service is active in every build.
Accounts and game progress
We process your player and account identifiers, public player code, chosen name, linked sign-in identifiers and account settings to create and secure an account. Guest sign-in uses a device identifier that is hashed by the server. We process cloud saves, accepted progression and premium-currency grant and spend records to synchronize progress, deliver earned rewards and protect purchases from duplication or abuse.
Single-player simulation runs on your device. Online services receive the saved progress and commands needed for synchronization, verified rewards and online play; we do not send every battle action to the backend.
Online play and content
Guild membership, cooperative participation, gifts, competitive entries, results and rankings are processed to run those features. Public player codes, chosen names, portraits and game results may be visible to other players in the relevant profiles, guilds or leaderboards. Optional profile or guild text and custom portraits are processed when submitted, including moderation decisions.
The current app does not offer player chat, private messaging or voice messaging. The game backend does not receive a stream of gameplay analytics events. Operational request, validation and security diagnostics are separate from gameplay analytics and help us maintain and protect the service.
Sign-in and purchases
When configured and selected, Sign in with Apple, Google sign-in, Game Center or Google Play Games supplies the identity proof and provider account identifier needed to sign you in or link your game account. We do not receive your Apple or Google password. Information received depends on the selected provider and the details you authorize.
Apple App Store and Google Play handle purchase checkout and payment details. Our backend processes store transaction and order identifiers, product, purchase and subscription status, verification results and refund information to grant entitlements, restore purchases, prevent duplicate grants and reconcile refunds. We do not collect payment-card details. A deletion request does not cancel a store subscription; manage it through the store.
See Apple’s privacy notice and Google’s privacy notice for their services.
Advertising and your choices
The supported advertising integration is Unity LevelPlay, with ironSource Ads and Unity Ads as the selected ad networks. When configured and enabled, advertising services may process device or installation identifiers, IP address, device and app information, ad impressions and interactions, and performance information to deliver, measure and secure ads. Reward verification also uses a player-bound placement and reward-event reference so that a completed advertisement grants its reward once.
The app applies its privacy choices before advertising initialization. Contextual or restricted settings pass non-personalization, sale/sharing opt-out and device-identifier opt-out signals to the configured integration. The current iOS integration does not request App Tracking Transparency permission or access IDFA. Contextual advertising still involves data processing; these settings are not a promise that an advertising provider collects no information.
Use the privacy choices offered by the app and your device. Where available, your device also provides advertising-identifier controls. For the networks’ processing and additional privacy controls, read Unity’s Game Player and App User Privacy Policy. Ad availability, consent requirements and rewards depend on the release configuration; this notice does not activate advertising.
Notifications and local storage
When remote notifications are configured and you permit them, Apple Push Notification service on iOS or Firebase Cloud Messaging on Android processes a notification token and delivery information. Our service links the token to the appropriate game account to deliver notifications and route a notification tap. A token is a delivery address, not a gameplay reward. Firebase Messaging does not mean that Firebase Analytics is enabled.
You can deny or revoke notification permission in your device settings. The app also uses device storage for saves, preferences, consent choices and recovery of interrupted actions. Local reminders are scheduled on your device; they are separate from remote push. See Firebase privacy information for the messaging service.
Hosting, support and this website
Cloudflare hosts this website and the game’s online backend, including authentication, saves, guild and competitive records, purchase verification and the premium ledger. Hosting and security services process network and request information such as IP addresses, requested URLs and diagnostic metadata to deliver and protect those services. See Cloudflare’s privacy notice.
This website has no account sign-in, purchase checkout, advertising script, analytics script or embedded third-party media. Fonts and artwork are served from this site. We do not add advertising or analytics cookies to these pages. External policy links load only if you follow them.
If you contact support, we process your email address, correspondence, public player code and any information or attachments you choose to provide to answer the request, investigate an issue or verify account ownership. Our email and infrastructure providers process information needed to deliver that support.
How information is used and disclosed
We use information to provide the game and account services you request, deliver and reconcile purchases and rewards, respond to support, prevent cheating and fraud, maintain security and meet applicable legal obligations. Optional provider features use the permissions and privacy choices applicable to that feature. Where consent is the basis for optional processing, withdrawing it does not affect processing already performed.
Information is disclosed to the service providers described above as needed for their functions, to other players through the online features you use, and where needed to comply with law, protect the service or resolve a transaction or dispute. Provider processing may occur outside your country. Their linked notices describe their own practices and controls; this notice does not replace them.
Retention and account deletion
We retain account and game information while needed to operate the account and its services. Retention also depends on transaction, security, support and legal requirements; there is no single retention period for every record.
Use Settings → Account → Export my data for the game’s connected data-export flow. Export download links expire after 24 hours. Use Delete account to schedule removal of the account and progress in every realm; Delete this realm role affects only that realm role. The confirmation displays the applicable grace period and scheduled date. Signing back in during the grace period cancels the scheduled deletion.
The deletion process removes associated private game data and scrubs or pseudonymizes identity links in records that must remain, such as purchase records or shared event history. Some transaction, dispute, security or legally required records may be retained in minimized form. Deleting the app alone does not request cloud-account deletion.
See full deletion instructions or contact support if you cannot access the app. We verify ownership before responding to a request that affects an account. Do not send a password, session token, verification code or payment-card details.
Your requests and concerns
Depending on applicable law, you may have rights to access, correct, obtain a copy of or delete information, object to or restrict certain processing, withdraw consent, or complain to a data-protection authority. Contact support@lazydevsagency.com to make a request or ask about retained data. We may need information to verify your identity and locate the account.
If you believe a child has supplied personal information without the permission required for that use, contact us so we can investigate. We do not ask you to send identity documents or sensitive information through this website.
Updates to this notice
We update this notice when our services or data practices change. The date above identifies the current version. Material changes that require additional notice or a new permission will be presented through the applicable service or consent flow.