Privacy Policy

This is a courtesy translation. The legally binding version of this document is the Portuguese one, at warhuts.com/privacidade; in case of any divergence, it prevails.

Last updated: 23 August 2026.

This policy explains what data War Huts keeps about you, what for, for how long and how you can see it, correct it or delete it. It covers the game in the browser (warhuts.com), the War Huts apps in the stores (Google Play and the App Store) and the pages of this website — it is the same game, the same account and the same server in all of them.

It was written to be read. If anything here is unclear, write to [email protected].

1. Who is responsible

War Huts is developed and operated by Antonio Savio França Silveira, an individual, in Brazil — who, under the Brazilian General Data Protection Law (Law 13,709/2018, the "LGPD"), is the controller of the data described here. The channel for any privacy matter, including exercising the rights in section 8, is the email [email protected].

2. What we keep, and where it comes from

2.1 The account

• If you sign in with Google: your Google account identifier (a number, called sub). It is what tells the server the village is yours when you sign in again, on any device. We do not keep your Google password — we never see it — nor your email address.
• If you created an account with email and password: the email you gave us and a hash of the password (the result of an irreversible function, with its own salt — the password itself is never stored or written to a log). The email is the key to your account and the address the sign-up confirmation link and the reset link go to when you ask for "forgot my password". We also keep the date it was confirmed. We do not use it for anything else — we send no newsletters and no promotions.
• Your Google account name, only at the moment you choose your nickname: it appears as a suggestion and is deleted as soon as you choose. After that the server no longer has it.
• The nickname you chose. It is public: it is your village's name on the map, on the leaderboard, in the chat and in the battle reports of whoever fought you. It cannot be changed, precisely because that is how other players recognise you.
• The moment the account first signed in and where it came from (if you arrived through an ad or campaign link, we keep the campaign name — only that, and only the first one).

2.2 The game

• Everything that is your village: buildings, army, stock, pets, clan, quests, achievements, battle reports, in-game mail, attack presets and whatever else the game needs to carry on from where you left off.
• Chat messages. The world chat keeps the most recent messages, visible to every player; private conversations are kept for the two participants (the most recent of each pair); the clan mail keeps in-game notices about the clan (who joined, an attack on its way), visible to members. Old messages are discarded as each list reaches its limit. We may read messages to look into a report or an abuse — and only for that.
• Purchases, when they exist: the transaction identifier, the product, the amount, the date and any reversals. We neither see nor keep card or bank account details — those are handled by the store or the payment provider (section 5).

2.3 Usage measurement

To know whether the game is getting better, we note which days you played (one line per day, with no timestamp per action), the day the account was born and the campaign it came from. Those lines feed aggregate counts — how many come back the next day, how many found a village — and they are what decides where the game goes.

To count visitors who have not signed in yet, we keep for one day a code derived from your IP address and your browser, with a secret that changes at midnight. It cannot be reversed back to the IP, it does not survive the day and it is not a cookie: it only exists so the same visit is not counted twice on the same day.

2.4 Technical logs

Like every service on the internet, the server logs the requests it receives (IP address, date and time, route requested, response). These logs exist for security, fault diagnosis and to comply with the retention of access logs required by the Brazilian Internet Civil Framework (Law 12,965/2014), and are discarded after the period in section 6.

2.5 What stays on your device

The game keeps in the browser's (or the app's) local storage your session token (so you do not have to sign in on every visit), the local-mode progress (the game that lives only on that device, when you play without signing in) and the campaign origin you arrived through, until it is recorded in the account. None of that is a tracking cookie and none of it is read by third parties. The provider that protects the site against attacks (section 5) may use purely technical security cookies.

2.6 What we do NOT do

• We use no third-party analytics tool (Google Analytics, Meta Pixel or similar) and no tracking cookies.
• We do not sell, rent or hand over data to advertising companies.
• We do not ask for access to contacts, location, camera, microphone or photos.
• We send no marketing emails, no announcements, no news and no newsletter. The only email that leaves here is the password reset link, and only when you ask for it.

3. What we use each thing for

• To make the game work: recognising you, storing the village, resolving battles, delivering messages, showing the leaderboard. Legal basis: performance of the contract (the Terms of Use).
• To keep the game fair and safe: detecting cheating, tampered clients, chat abuse and attacks on the server; looking into reports. Legal basis: legitimate interest.
• To measure and improve the game: the aggregate counts in section 2.3. Legal basis: legitimate interest, with data reduced to a minimum (one day per line, no content).
• To process purchases and legal obligations: recording the transaction, handling reversals, keeping what tax law and the Consumer Protection Code require. Legal basis: performance of the contract and compliance with a legal obligation.
• To talk to you inside the game — update notices, an attack on its way, changes to these documents — through the in-game Mail.

We do not use the data for any automated decision with legal effect on you, nor to profile you outside the game.

4. What is public inside the game

A single-world game is, by its nature, a place where others see you. Visible to any player: your nickname, your village (position on the map, colour, Centre level, achievement banners), your leaderboard position, your clan and your rank in it, the messages you send in the world chat, and the battle reports that whoever fought you receives (what you sent, what survived). The leaderboard can also be seen on the public page of the website. Your village's army and stock are not shown to other players — only what a battle reveals.

5. Who the data passes through

We do not sell data. It passes through those who need to handle it for the game to exist:

• Google (Google LLC) — the sign-in. When you sign in, Google confirms to us who you are; whatever it keeps about that use follows Google's own privacy policy.
• Cloudflare (Cloudflare, Inc.) — the layer that delivers the site and protects it against attacks. Every access goes through it, and it sees the IP address and the requests, like any network provider.
• The hosting provider of the game server, where the world and the data are stored.
• Resend (Resend, Inc.) — the service that delivers the password reset email. It sees the destination address and the content of the message, and is used only for that.
• The stores and payment providers — Google Play, the Apple App Store and, for direct payment, the Pix processor — which handle the purchase data under their own policies. From them we receive only the confirmation of the transaction (section 2.2).
• Authorities, when a court order or the law requires it — and only to the extent required.

Some of these providers operate outside Brazil. Where there is an international transfer, it relies on the safeguards set out in the LGPD (article 33) — the providers' own contracts and adequate protection standards.

6. For how long

• Account and game: for as long as the account exists. Once the account is deleted, what identifies it is removed within 15 days (backups are overwritten in their normal cycle, within 30 days).
• Chat messages: until they fall off each list's limit, or until the account is deleted.
• Technical access logs: 6 months, as the Brazilian Internet Civil Framework requires.
• Purchase records: 5 years, under tax and Consumer Protection Code periods — even after the account is deleted, with no link to the nickname.
• Usage measurement: the "day played" lines are kept in a form that does not identify a person (an account code and a day); the unidentified visitor code lasts one day.

7. Children and teenagers

War Huts is made for people over 13 years old. Under-18s should only play with their guardians' knowledge, and in-game purchases may only be made by people over 18 or with a guardian's authorisation. We do not knowingly collect data from children under 13; if you are responsible for a child and believe they have created an account, write to the email above and we will delete it.

8. Your rights

The LGPD gives you, and we honour by email, the right to:

• Know whether we hold data about you and access it (we send a copy of what your account holds);
• Correct anything that is wrong;
• Delete the account and everything that identifies it — the village becomes a free hut on the map again, the nickname is released and whatever the law requires us to keep (section 6) is left with no link to you. You can ask inside the game itself (⚙️ Settings → Delete account): deletion has a 4-day grace period, and within it you can cancel in the same place — once the period is over, it happens on its own and is permanent;
• Take the data with you (portability), in a machine-readable format;
• Know who the data has been shared with (section 5) and object to processing based on legitimate interest;
• Complain to the Brazilian National Data Protection Authority (ANPD), if you think we did not respond as we should have.

To make a request, write to [email protected] from the Google account email you play with, or from the email registered in your password account (that is how we know it is you), giving your village nickname. We answer within 15 days. Deletion requests can also be made through this channel from the store apps.

9. Security

The session is a signed token only the server can generate; all access is over HTTPS; the server only accepts moves that the game rules validate; access to the server is restricted and backups are regular. No system is proof against everything: if an incident puts your data at risk, we will notify you and the ANPD within the legal deadlines.

10. Changes to this policy

When we change anything significant, the date at the top changes and you get a notice through the in-game Mail. Changes that widen the use of data only apply after the notice. The version in force is always the one on this page.

11. Contact

[email protected] — for questions, requests about your data and reports of abuse.

▶ Back to the game