=====================================
ONE MILLION HP :: PRIVACY POLICY
=====================================
What this policy covers
This policy explains how the operator of ONE MILLION HP handles information when you visit the game, play, create an account, or submit content. The game is free to play and does not offer real-money purchases. This policy does not cover independently operated sites linked from the game, such as the community wiki.
Information we collect
- Account and login information: a generated player identifier, your chosen username, login-token records, and a salted password hash if you set a password. The game does not ask for an email address to play. Playing as a guest also creates a player record on our server, so guest play is not anonymous to the service.
- Gameplay and community information: inventory, attacks, scores, achievements, trades and other transactions using in-game currency, account settings, share-code referrals, poll votes, chat messages, bug reports and suggestions (tickets), and boss designs you submit. Some features also store when you did something.
- Connection and security information: IP addresses or network identifiers, request and activity records, and information used to detect bots, cheating, abuse, and unauthorized access.
- Messages you send us: your contact details and whatever you include when you ask for help or make a privacy request. Please never send your password or login/save token.
- Browser storage: a login token and preferences, described below.
Why we use information
We use information to save and restore your progress; log you in; run the shared boss fights, leaderboards, trading, chat, and other community features; deliver rewards; fix problems; moderate content; investigate cheating and security incidents; respond to requests; and meet legal obligations. We also use gameplay records to understand and balance the game.
The game does not include analytics, advertising, or tracking scripts. We do not sell personal information and do not share it for targeted advertising.
What other people can see
Your username, badges, level, equipped items, scores, leaderboard positions, whether you are online, and some of your game activity (for example attacks and drops in the feed) can be seen by other players or visitors. Chat messages, tickets, and other public submissions are visible in those features. Boss designs you submit are reviewed by the operator and, if approved, appear in the game credited to your username.
Do not put your real name, contact details, school, address, age, or other sensitive information in your username or anything you post. Other people may copy public content, and removing it from the game cannot remove copies outside our control. The game never displays your password hash or login token to other players.
Cookies and local storage
The game uses your browser's local storage to keep a login token and preferences such as sound, visual effects, selected tabs, and inventory settings. Boss-design drafts may also be saved locally. It also sets a login cookie named omhp_t to help restore access, with a maximum lifetime of 400 days; your browser may shorten that, and it may be refreshed while you play.
You can clear this storage in your browser settings. Doing so may remove your preferences or your access to guest progress; setting a username and password first lets you log back in. Clearing browser storage does not delete your records on our server.
Service providers and other disclosures
The game runs on the operator's own server. Traffic to the game is routed and protected by Cloudflare, which processes connection information to provide that service (see the Cloudflare privacy policy). A copy of the game's web pages is also hosted on GitHub Pages at conradrandy.com, which processes connection information when you visit that copy (see the GitHub privacy statement).
We may disclose information when reasonably necessary to comply with the law or valid legal process, investigate abuse, or protect the rights and safety of players and the service, and we may disclose information at your direction.
How long information is kept
The game cleans up some records automatically:
- Detailed attack and chest-opening records are normally removed after 30 days. Attack records can include IP addresses.
- The public event feed is normally limited to 14 days.
- Records used to limit new accounts per network are normally removed after 7 days.
- Chat keeps roughly the newest 300 messages across the whole game, not a fixed number of days, so messages can stay longer when chat is quiet.
Cleanup runs periodically while the server is running, so these are not exact deadlines. Your account (including the network address it was created from), progress, leaderboard history, moderation records, and submissions are not removed automatically: they are kept while the game is running or until you ask us to remove them. Server backups are kept as a short rolling set and are replaced as newer backups are made.
Your choices and privacy requests
Email [email protected] to ask for a copy of, a correction to, or deletion of information associated with your account, or with any privacy question. Include your username and enough detail to find your account, but never your password or login/save token. We may ask you to show that you control the account (for example by logging in and taking an action we describe) before sharing or changing anything. Deletion is done by hand; copies in backups disappear as those backups are replaced.
The rights available to you depend on the law where you live. If you disagree with how we handled a request, reply to the same address and say you are appealing. You may also contact your privacy regulator. You will never be asked to make a privacy request in public chat.
Age requirement and younger players
You must be at least 13 years old to play. If you are under the age of legal adulthood where you live, a parent or legal guardian should review this policy and the Terms of Service with you.
The game is not intended for children under 13, and we do not knowingly collect their information. If you believe a child under 13 has an account or has shared personal information, email [email protected]. We will look into it and remove the account and its information as required by law.
Security
We use safeguards such as password hashing and access controls to protect information. No service or connection is completely secure. Keep your password and login/save token private, and contact us if you think someone else has accessed your account.
Changes and contact
We may update this policy when the game or our practices change. The effective date above will change, and we will give additional notice in the game when a change is significant or when the law requires it. Questions: Conrad_Randy, [email protected].
See also the Terms of Service.