Privacy Policy

Effective 30 September 2026

This policy explains what information Bulwarkie (“the Game”) collects, why, how long it is kept, and what you can do about it. The Game is operated by High Sloth LLC, a Wyoming limited liability company, 30 N Gould St Ste R, Sheridan, WY 82801 (“we”, “us”), which is responsible for your information. Contact: support@bulwarkie.io.

The short version

• You can play as a guest wherever the Game is open to guests. Logging in with Discord is optional, except to buy anything, to play ranked or read the leaderboards, and — during the closed beta — to play at all.
• We keep a small number of records on our servers, keyed to your Discord account: leaderboard rows, match replays, and your beta application if you sent one. Once purchases open, we will also keep a record of your purchases and of the checkouts you start.
• If you log in, other players can see your Discord user id and avatar — see What other players can see.
• We never see your card details and we don’t store your email address.
• The Game shows ads from Google AdSense in its menus (none during a match) — see Advertising.
• We don’t sell your personal information.

What is stored in your browser

The Game saves its state in your browser’s local storage so it is there next time: your display name, chosen hero and mode, settings (keybinds, camera, sound, graphics and language), your service record (the match statistics on your profile), your friends list and your player id (a random code such as ABCD-1234 that friends use to find you), your measured latency to our server regions, the look you chose for each hero, and — if you log in — your session token, a short code worked out from your Discord user id (not the id itself) so that another account logging in on the same browser doesn’t inherit your choice of looks, and whether your account had Premium when we last checked, so the ads don’t flash up while we check again. It stays on your device and clearing your browser data removes it. Two parts of it are sent to our server every time the Game connects: your player id and your display name, so that friends can see you are online and parties can find you. The rest reaches our servers only when you use the feature that needs it (for example your session token when you log in).

The Game itself sets one cookie, and only while you log in: za_oauth, which lasts at most 10 minutes and protects the Discord login against forgery. Advertising cookies set by Google are described under Advertising.

Playing a match

• To connect you to a match our servers necessarily receive your IP address and the inputs you send (movement, aim, abilities, card picks and pings). This is how any online game works; we use it to run the match.
• Our hosting provider tells us your approximate location (derived from your IP address) so we can place your match on a nearby server. We use it only for that, for as long as you are connected — and, once purchases open, to tell Xsolla which country you are buying from when you start a checkout.
• Chat messages are relayed live to the players in your match and filtered for offensive words. We don’t store them, and they are not part of match replays.
• Your browser reports connection quality (such as ping and jitter) that we only ever look at in aggregate, to keep the servers healthy.
• Friends and parties pass through our server using your player id and display name. Anyone who has your player id can see whether you are online, and whether you are in the menu, a lobby, a match or a search (see What other players can see). Parties and pending friend requests are kept only while they exist; your friends list itself lives in your browser.

Discord login (optional)

If you choose “Login with Discord”, we ask Discord for your identity only — your Discord user id, username and avatar (the identify scope). We do not receive your email address, your friends or the list of servers you are in.

We exchange Discord’s one-time code for your profile, then immediately discard the access token: it is never stored and never sent to your browser. Your login is a signed session token kept in your browser; it carries your Discord user id, display name, avatar and whether you currently have beta or staff access. It lasts 30 days from when it was issued, and playing in the second half of that time replaces it with a fresh 30-day one (a sliding session), so it expires between 15 and 30 days after you last used it. Logging out from the menu removes it from that browser.

Where our Discord bot is set up, we also ask Discord, using the bot’s own access rather than yours, whether your account is in our community server and holds its beta-tester or staff roles, and we re-read your current avatar so the Game shows the one you use now.

Joining our Discord server during the closed beta. This paragraph applies only while the closed beta’s auto-join is switched on — and it is switched on now, for the closed beta. While it is, logging in also asks for Discord’s guilds.join permission, and logging in adds you to our community Discord server — Discord’s consent screen shows this before you agree. The beta list is a role in that server, which is why being a member lets us admit you. The permission lets us add you to that one server and nothing else: we can’t remove you from anywhere, read your other servers, post as you or change your account. You can leave our server at any time, which also gives up beta access. Auto-join will be switched off when the Game launches publicly; from then on, login asks only for your identity, and joining our Discord is a separate, optional choice.

What other players can see

• In a match: your display name, hero, team and score, and the chat you send.
• Anyone who has your player id (the friend code you hand out): whether you are online and, while you are, your display name and where you are (the menu, a lobby, a match or a search); and which skins that player id has liked.
• If you log in, your Discord user id and avatar are visible to other players: to logged-in players reading the leaderboards (each row carries the player’s Discord user id with their name and numbers), to everyone in a ranked match when its ratings are settled (each rated player’s Discord user id, name and rating change), and to anyone who has your player id, even while you are offline. A Discord user id is not a secret on Discord itself, but it does connect what you do in the Game to your Discord account.

What we keep on our servers

This is the complete list of records we keep about players today:

• Leaderboards (logged-in players only): your Discord user id, display name, rating or score, best result, games, wins and losses, and when the row last changed. Other logged-in players see your name and numbers on the leaderboard.
• Match replays. We record matches so they can be watched again. A replay holds the inputs each player sent (movement, aim, abilities, card picks) plus the display names, teams and heroes of everyone in it. If you were logged in, your Discord user id is stored beside the replay in our index — never in the replay file itself — so we can list your own matches for you. Logged-in players can find the replays of their own matches and watch any replay they have a link to; our admins can see the whole library.
• Closed-beta roster. If you apply to the beta or arrive through one of our invitation links: your Discord user id, display name, your answers to the application questions, which link brought you, and when you first and last came through it. Applications are also posted, with your Discord user id and answers, to a moderators’ channel in our Discord server so a moderator can review them. When you are admitted, our bot posts a welcome message mentioning your Discord account in a channel of our community server.
• Friend-list faces. After you log in, we remember which Discord account and avatar go with your player id, so your friends’ lists can show your picture even when you are offline. Logging out deletes it. A record that has gone a year without being updated by a login is no longer shown to anyone and is deleted the next time it is looked up; until then it stays in storage, and you can ask us to delete it at any time.
• Skin likes: which skins you have liked, keyed to your player id.
• Purchases (once they open). Your Discord user id, and with it: each look you own — whether you bought it or were given it, when you got it, when you first wore it in a lobby or match (which our support team may take into account when deciding a refund), and whether it was refunded or taken back; every checkout you start, even one you don’t finish — the item, the price we quoted (for a chest, which of its looks it delivers and which you already owned), when you started it and Xsolla’s reference for that checkout; for each payment, when you paid, the order and transaction references from Xsolla, the amount and currency, and any refund or chargeback; for Premium, your subscription’s reference, whether it renews or was cancelled, the date it is paid until and when that last changed, and — after a chargeback — when we asked Xsolla to cancel it, when we last tried and how many times, and when Xsolla confirmed it; how many checkouts you have started recently (to stop abuse), and whether a chargeback has blocked purchases on your account; and a log of the payment notifications Xsolla has sent us, so that none is applied twice. No card or bank details and no email address: payment information is handled by Xsolla, our merchant of record, under its own privacy policy shown at checkout.

Our servers also keep short-lived technical logs, which can include a Discord user id (for example when a beta tester is admitted). Alerts to our team about a purchase that needs attention carry its order, transaction or subscription references.

Advertising

The Game is free to play and is funded in part by advertising. We use Google AdSense to show ads — a pair beside the main menu, and none during a match. To serve and measure those ads, Google and its advertising partners may set and read cookies or similar identifiers on your device, and may use them to show you ads based on your visits to this and other sites (personalised advertising). We never share your Discord identity or in-game activity with advertisers.

You’re in control of personalised advertising and can turn it off at any time:

• Manage or opt out via Google’s My Ad Center and Ads Settings.
• Industry opt-out tools at aboutads.info and, in the EU, youronlinechoices.eu.

How Google uses this data is described in “How Google uses information from sites or apps that use our services”. Where local law requires your consent before advertising cookies are used — such as in the EEA, the UK and Switzerland — that consent will be requested through Google’s certified consent tools before such cookies are set, and we will honour the choice you make. Beyond advertising, we don’t run our own analytics trackers. Once Premium is offered, it removes these ads.

Other companies involved

• Discord — login and our community server, only if you log in. Governed by Discord’s Privacy Policy.
• Google AdSense — the ads described above. Governed by Google’s Privacy Policy.
• Xsolla (USA), Inc. — once purchases open, our merchant of record: it processes your payment and the details you enter at checkout under its own privacy policy. To open a checkout we send Xsolla your Discord user id, your display name and your country (from your approximate location), and the language you play in; where our server can’t tell your country, it may send your IP address instead, so that Xsolla can work out which country you are buying from. To open your Premium subscription page (MANAGE SUBSCRIPTION) we send it your Discord user id and your language. If a chargeback blocks your account while you have a Premium subscription that has not been cancelled, we send Xsolla your Discord user id and that subscription’s reference to cancel it. Xsolla’s notifications back to us can include checkout details such as your email address; we keep only the purchase fields listed under What we keep on our servers.
• Cloudflare — hosts the Game and stores the records above, processing connection data (such as your IP address) on our behalf.

We don’t sell your personal information. Personalised ads served by Google may count as “sharing” or “targeted advertising” under some US state laws; you can opt out of them with the links above.

Why we use it

We use your information to run the Game and the features you ask for (matches, login, friends, leaderboards, replays and, once they open, purchases); to keep play fair and the service secure; to review beta applications you send us; and to meet legal, tax and accounting duties for purchases. Where the law requires a legal basis, these are: providing the service you asked for, our legitimate interest in running a fair and secure game, your consent (for personalised advertising where consent is required), and legal obligations (for purchase records).

How long we keep it

• Your session token: at most 30 days after you last used it, or until you log out.
• Leaderboard rows: for as long as that leaderboard runs.
• Match replays: for as long as they are useful for reviewing play — there is no fixed deletion date yet. Ask us to delete the ones you are in.
• The beta roster: for the closed beta and a reasonable time after it.
• Friend-list faces: until you log out; one not updated by a login for a year stops being used and is deleted when it is next looked up, or sooner if you ask.
• Skin likes: until you un-like them, or ask us to remove them.
• Purchase records, including checkouts you didn’t finish (a payment for one can still arrive later): as long as needed to provide your items and handle refunds and disputes, and then as long as the law requires for tax and accounting.
• Chat: not kept at all.

Your choices and rights

You can clear everything stored in your browser at any time, and log out from the menu to remove your session. Depending on where you live, you may have the right to access, correct, delete or receive a copy of your information, and to object to or restrict how we use it. To make a request, email support@bulwarkie.io; because our records are keyed to your Discord account, we may ask you to show that you control it. We won’t treat you differently for making a request. We may keep purchase records the law requires us to keep. You can also complain to your local data-protection authority.

Where it is processed

We are based in the United States, and our providers operate worldwide, so your information may be processed in the United States and other countries whose data-protection laws differ from yours.

Children

The Game is not directed to children under 13 (or the minimum age of digital consent in your country), and we don’t knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.

Changes

We may update this policy as the Game evolves. Material changes will be posted here with a new effective date.

Contact

Privacy questions or requests: support@bulwarkie.io, or High Sloth LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA.