Privacy Notice
Last updated: November 4, 2026
Mikael Danielsson (Sole proprietorship), Litsvägen 25, 831 42 Östersund, Sweden, is the data controller for personal data processed in Dungeonbound Heroes.
Data we collect and why
- Account data (username, email, password hash) – to create and secure your account (contract).
- Game data (progress, gear, friends, party, chat messages, leaderboard stats) – to provide the game (contract).
- Technical data (IP address, device/browser info, logs) – for security, fraud prevention and fixing bugs (legitimate interest).
- Purchase records (order ID, package, status) – to deliver Diamonds and meet accounting obligations (contract, legal obligation).
Sharing
- Hosting and infrastructure providers that run the game.
- Paddle.com, our Merchant of Record, for sales, payments, tax compliance and invoicing.
- Google (Google Ads), to measure which ads lead to new accounts – only where allowed by your cookie choice.
- Professional advisers (legal, accounting) when needed.
- Authorities where required by law.
International transfers
Some providers may process data outside the EU/EEA. In that case we rely on adequacy decisions or Standard Contractual Clauses.
Retention
Account and game data are kept while your account exists and deleted or anonymised when no longer needed. Purchase records are kept as required by Swedish accounting law (7 years).
Your rights
Under GDPR you have the right to access, rectify, erase, restrict, port and object to processing of your data, and to withdraw consent. We respond within one month. You may complain to the Swedish Authority for Privacy Protection (IMY).
Security
We use appropriate technical and organisational measures such as encryption in transit, hashed passwords and access controls.
Cookies and local storage
We use essential browser storage for login sessions, game saves and settings.
We also use Google Ads cookies and the Google tag to measure when someone creates an account after clicking one of our ads (advertising measurement and ad optimisation). Data sent to Google can include an ad click identifier, device/browser info, IP address and the fact that an account was created – never your email or password. In the EU/EEA, UK, Switzerland and Quebec this only happens if you accept in the cookie banner; we store your choice, when you made it and which notice you saw. Elsewhere it is on by default and you can turn it off here. Learn how Google uses data at business.safety.google/privacy.