Privacy Policy

Last updated: October 8, 2026 · Contact: service@zzgamez.com

Who we are

Hearthrealm Idle ("the game") is published by ITZyla LLC, also known as Zzgamez ("we"). This policy covers the game on Android, iOS, PC and the web (playhearthrealm.com) and this website, and explains what is collected and why.

What the game stores on your device

Your progress — heroes, levels, skills, bank, gold, settings and activity log — is saved on your device (on the web: in your browser's storage for playhearthrealm.com; clearing your browser's site data deletes it). No sign-up or login is required to play: you can play as a guest, and a guest's progress stays on that device. A playtest log of in-game events (which screens you used, which activities you ran) is also kept on your device only; you can export it yourself from Settings to share with us, and it never leaves the device otherwise.

What leaves your device

• If you play as a guest: nothing. Your progress stays on your device.
• If you create an account or sign in: your e-mail address and password are handled by Google Firebase Authentication to sign you in (we never see your password), and the account gets a random user ID. Your game progress is backed up under that user ID (Google Firebase Cloud Firestore) so you can continue on another device, together with a random ID for each of your installs and its platform name (for example "iOS"), used only so one device plays at a time. Your contributions to the weekly Realm Goals are counted against your account.
• If you buy something in the apps: the payment is handled entirely by Apple (App Store) or Google (Google Play); we never see your card or payment details. The game receives the product you bought and the store's transaction ID or purchase token. That purchase record is kept with your account — in your cloud save and in a server record (Google Firebase) — so the purchase can be checked with the store, restored on your other devices, and kept to the one account it was bought for. Purchases are tagged with a one-way hash of your account's random user ID, never with your e-mail. Gems you buy and spend are part of your game progress.
• If you buy something on the web: the payment is handled by Paddle.com, our reseller and Merchant of Record. Paddle collects your payment details, e-mail address, country and postal code (for sales tax) under Paddle's privacy policy; we never see your card details. Paddle shares the order with us (order number, product, price, country and the e-mail address given at checkout) so we can deliver the purchase to your game account, keep it to that one account, handle refunds and answer support requests.
• When you visit playhearthrealm.com: the site is served by Google Firebase Hosting, which processes your IP address and browser details in its server logs to deliver the pages. The site uses no cookies of its own and no advertising or analytics trackers.
• Crash and performance data reported by Apple (App Store) or Google Play, under their own policies and your device settings.

We use this data only to run the game's features (sign-in, cloud save, Realm Goals, delivering and restoring purchases). We do not sell it, use it for advertising, or track you across other companies' apps or websites. Analytics is built into the game but switched off in this release; this policy will be updated before it is switched on.

What we do NOT collect

No name (beyond the e-mail address you choose to sign in with), phone number, contacts, photos, precise location, microphone or camera data. The game contains no chat, no social features and no user-generated content. The game does not currently show ads; if that changes in a future update, this policy will be updated first. Optional purchases are sold through the App Store, Google Play and, on the web, Paddle.

Children

The game is not directed at children under 13, and in the European Economic Area and the UK not at children under 16 without the consent of a parent or guardian. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us and we will delete it.

Your choices

• Play offline. The whole game is playable without a network connection.
• Delete your data. Uninstalling the game (or clearing the site data for playhearthrealm.com in your browser) removes everything it stored on your device. In the game, Settings → Delete my data deletes your cloud save and your account straight away. You can also ask by email (below).

How to delete your data (account deletion)

In the game (fastest): sign in, open Settings, go to Danger zone, tap Delete my account & data and confirm twice. Your account and its cloud save are deleted straight away; the game then returns to the sign-in screen.

What is deleted: your account (e-mail sign-in and user ID), your cloud save and its history, and your server purchase record. What is kept: the stores' own receipts (Apple, Google and Paddle keep your purchase history under their policies, so purchases can still be restored from the store), and a minimal anti-fraud log of each purchase (product and store transaction ID, no e-mail and no user ID) so one receipt cannot be paid out twice. Your local save on the device stays until you wipe it in Settings or uninstall.

By email: write to service@zzgamez.com and say you want your Hearthrealm Idle data deleted. Tell us roughly when you played and on what device so we can locate any account; if you linked a sign-in to it, tell us which.

Data retention

Local data lives until you delete it or uninstall. Cloud saves and accounts are kept until you request deletion or after 12 months of inactivity.

Processors we use

Apple App Store and Google Play (distribution, app purchases, crash reports). Paddle.com (web purchases, as Merchant of Record). Google Firebase (authentication, cloud save and website hosting). Their handling of data is governed by Apple's, Google's and Paddle's own privacy policies.

Your rights (GDPR / UK GDPR / CCPA)

Who is responsible (controller): ITZyla LLC (also known as Zzgamez), 14015 Obenhoff Rd, Atlantic Mine, MI 49905, USA. Contact: service@zzgamez.com.

What we use, why, and on what legal basis:

• E-mail address and user ID — to create your account and sign you in. Basis: performing our contract with you (Art. 6(1)(b) GDPR).
• Cloud save (your game progress) — to keep your progress and let you play on several devices. Basis: contract.
• Install ID and platform name — so one device plays your account at a time. Basis: contract.
• Purchase records (product, store transaction ID or order number, the account it belongs to) — to deliver and restore purchases, keep each purchase to one account, handle refunds and keep accounting records. Basis: contract, legal obligations (tax and accounting), and our legitimate interest in preventing fraud (Art. 6(1)(c) and (f)).

We do not use your data for profiling or automated decisions, do not show advertising, and do not sell your personal information.

Who processes it for us: Google Firebase (Authentication, Cloud Firestore, Cloud Functions and Hosting) as our processor. Apple (App Store) and Google (Google Play) handle app purchases and distribution. Paddle.com is the merchant of record for web purchases and acts as an independent controller for the payment data it collects.

International transfers: these providers store data in the United States and elsewhere. Transfers from the EEA, the UK and Switzerland rely on the providers' Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions).

How long we keep it: your account and cloud save until you delete them, or after 12 months of inactivity. A minimal anti-fraud purchase log (product and store transaction ID or order number, without your user ID or e-mail) is kept after deletion so one receipt cannot be paid out twice. Apple, Google and Paddle keep their own receipts under their own policies.

Your rights (EEA / UK GDPR): you can ask for

• access to the personal data we hold about you;
• rectification of inaccurate data;
• erasure — in the game: Settings → Danger zone → Delete my account & data, or by e-mail;
• restriction of processing;
• portability — a copy of your account data and cloud save in a machine-readable format (JSON), by e-mail request;
• objection to processing based on our legitimate interests;
• and you can withdraw consent at any time where we rely on it.

Write to service@zzgamez.com from the e-mail address of your account. We answer within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

California (CCPA / CPRA): we do not sell or share your personal information (as those terms are defined by California law), and we do not use it for cross-context behavioural advertising. You have the right to know what personal information we collect and how we use it, and to have it deleted, by the same means as above. We will not discriminate against you for exercising these rights.

Changes

We will update this page and change the date above when this policy changes.