Privacy Policy

1. Who we are

Heist Fall is made by [LEGAL ENTITY NAME], LLC, a limited liability company organized in [STATE] ("Undead Island", "we", "us"). We are responsible for the personal data described here (in GDPR terms, we are the "controller"). This policy covers the game, this website and related services. You can reach us at support@undeadisland.gg [SUPPORT EMAIL] or by post at [MAILING ADDRESS].

2. What we collect

Your account

• Username and password. Your password is handled by our sign-in provider and stored only in hashed form. We never see it in plain text.
• An internal sign-in address. Our sign-in system needs an email-style address, so we make one from your username (for example yourname@players.undeadisland.gg). It is not a real mailbox, and we never ask for your real email.
• Invite details. The invite key you signed up with, and, if you used a friend's invite link, which player invited you (see "Invites" below).
• Age confirmation. That you confirmed you are 18 or older at sign-up. We don't keep your birth month or year.
• Account records such as when you joined, when you were last online, and whether the account is suspended.

Your game

• Your saved progress: cars, gear, stash, Dead Coin, Rank, Hideout and settings, and a short history of earlier versions of your save (so we can undo a lost or broken save).
• Raid results, such as kills and whether you got out.
• Market listings, trades, in-game mail and rewards.
• Chat messages you send, with your username and the time.
• Reports and blocks you make or receive, and the outcome of any review.
• Leaderboard scores, your public criminal profile and Horde Night replays.
• Purchases, when they are available (see "Payments" below).

How you play (gameplay telemetry)

The game sends us events about how it's being played. When you're signed in they are linked to your account. Before you sign in they are sent without an account.

• Session info when the game starts: your browser's user agent (browser, version and operating system), screen and window size, pixel density, whether it has a touch screen, your browser language, whether the game was opened as an installed app, and the page that linked you to the game (the referrer). Each session gets a random ID that isn't kept on your device.
• Screens and taps: which screens you open and which buttons you tap (the button's label and name).
• Play time and visits: a short "still playing" signal once a minute while the game is on screen and you're using it, and one record for each page you open on this website (the page, and whether the visit came from a link, a search or another site). To tell first visits from repeat ones and remember where you first came from, your browser keeps two small values on your device: a yes/no "visited before" flag and the name of the site or campaign that first sent you (for example "direct" or a site's name). Neither is an ID. We add these up into daily totals (players, play time, visits, sign-ups and how many players come back) to see how the game is growing. The daily totals are kept after the raw events are deleted, without your username.
• Raid telemetry from the game: where you dropped and landed, your car's position on the island map every 10 seconds (with health, speed, heat and fuel), and where you looted, fought, got wrecked or got out. The game server also records every raid in much more detail: see "What raids record" below. These are positions on the game's map, not your real-world location.
• Economy and progress: trades, upgrades, crafting, repairs, level-ups, crate openings and settings changes.
• Errors: error messages and technical details (such as which file and line failed) when something breaks.
• Performance: frame rate, loading times and graphics-quality adjustments.
• The length of chat messages you send (the text itself is stored with the chat, as above).

Security and abuse prevention

• Sign-up protection. When someone tries to create an account, we record the IP address and whether it worked, to block mass sign-ups. We keep these records for 30 days.
• Rate limits. To stop floods, we briefly count requests per IP address: for telemetry sent before sign-in (kept about an hour) and for connections to the game server (held in memory only, not stored).
• Fair-play checks. The game server records rule violations it detects in a raid.

Horde Night reminders (optional)

If you turn on reminders, your browser gives us a push subscription: a web address at your browser's push service and the keys to encrypt messages to it, plus your platform. We use it only to remind you about Horde Night (30 minutes before, and when it starts). You can turn it off in the game's Settings or in your browser. We delete a subscription when you turn it off, or after repeated failed deliveries.

Invites

If you open the game from a friend's invite link (one ending in ?ref=theirname), the game keeps their username in your browser until you sign up. We then record that they invited you. Invites don't pay out Dead Coin or items. Nothing else about you is shared with them, apart from counting you among the friends who joined.

Invite requests

If you ask for an invite on this website or on the game's Sign up tab, we store the email address you type, where you asked (website or game) and when. We use it only to send you an invite key and anything about your request. We delete it 180 days after the request, or 30 days after we send the invite, whichever comes first. Email support@undeadisland.gg to have it removed sooner.

Payments (planned)

We do not sell Dead Coin. If purchases of cosmetics or convenience features become available, payments will be handled by the provider displayed at checkout. They collect your payment details directly. We receive a record of the purchase (what was bought, the amount, the date and a transaction ID), never your full card number.

3. What raids record

Every raid runs on our game server, and the server records it so that we can stop cheating, investigate reports, fix bugs, balance the game and show replays to our team. For every car in the raid, players and AI drivers alike, it records:

• A 1-second track: where the car is on the island map, its health, speed and fuel, and what it is doing, once every second for the whole raid.
• Events: kills and who made them, damage taken, loot picked up, containers opened, buildings destroyed, extracts used, how the raid ended for each car, disconnects, cars stuck in one spot and movement checks that failed.
• Performance: your game's frame rate and worst frame, and your ping to the server, once a second.

Each record carries your account ID and username. Replays (the full 1-second record) are kept for 30 days and then deleted. Raid summaries (one row per car with its result, kills, loot and damage, plus the notable events) are kept for 180 days and then deleted. Raid recordings are visible only to our team. They are positions on the game's map, never your real-world location.

4. What we don't collect

We don't ask for your real name, phone number or address, and we only have an email address if you give us one to request an invite or to contact us. When you create an account we ask for your birth month and year only to confirm you're 18 or older; we don't store it (we keep only the answer that you're old enough). We don't access your precise location, contacts, camera, microphone or photos. We don't use advertising IDs, and we don't have ads, advertising trackers or third-party analytics in the game.

5. How we use it

• To run the game: sign you in, save your progress, run raids, the market, mail and chat.
• To keep it fair and safe: detect cheating and exploits, prevent spam and mass sign-ups, protect accounts, and review reports.
• To fix and improve it: find bugs and crashes, balance loot and difficulty, and understand which features people use.
• To send reminders you asked for, and to send invite keys you asked for.
• To answer you when you contact us, and to meet legal obligations.

For players in the EEA and UK, our legal bases are: performing our contract with you (running the game and your account); our legitimate interests in keeping the game secure, fair and working well (telemetry, security records, moderation); your consent (push reminders, which you can withdraw at any time); and legal obligations.

We don't sell your personal data, and we don't share it for targeted advertising.

6. Who can see it

• Other players can see your username, your chat messages, market listings, leaderboard scores, your public criminal profile (Rank, reputation and recognition), Horde Night replays, and the car you drive in a raid. If you share a raid result card, anyone you share it with can see it.
• Our team can see account and game data, and telemetry, to run the game, moderate and help you.
• Service providers that host and run the game for us (next section).
• Authorities, if the law requires it, or if it's needed to protect someone's safety or our rights.
• A new owner, if the company is ever sold or merged. This policy would continue to protect your data.

7. Service providers

These companies process data for us, only to provide their service:

• Supabase: our database, sign-in system and server functions. It stores your account, game data, chat, mail, market, telemetry and push subscriptions.
• Vercel: hosts this website and the game files.
• Fly.io: runs the real-time game server your car connects to during a raid.
• Stripe: will process card payments on the web once purchases launch.
• Google Fonts and jsDelivr: content delivery networks. Your browser downloads the game's fonts from Google and some code libraries (such as the 3D engine) from jsDelivr. Like any website you visit, they receive your IP address and browser details when your browser fetches those files.
• Browser push services (run by your browser's maker, such as Google, Apple, Mozilla or Microsoft) deliver Horde Night reminders if you turned them on.

8. Cookies and browser storage

We don't use cookies. The game uses your browser's local storage to keep you signed in, remember your settings, hold a pending invite code, remember that this device passed (or failed) the sign-up age check, and keep offline saves and a small offline event log. Clearing your browser's site data removes these. It signs you out, and it deletes offline-only saves.

9. How long we keep it

• Gameplay telemetry: 180 days, then deleted automatically.
• Raid replays (1-second tracks): 30 days, then deleted automatically.
• Raid summaries and raid events: 180 days, then deleted automatically.
• Chat messages: 90 days, then deleted automatically.
• In-game mail: 180 days after you claim it (unclaimed mail stays in your mailbox).
• Market listings: active listings until they sell, expire or you cancel them; closed listings 180 days after they close.
• Save history: your last 20 save versions, plus one per day for 7 days.
• Invite requests: 180 days after the request, or 30 days after we send the invite.
• Sign-up IP records: 30 days, then deleted automatically.
• Rate-limit counters: about an hour.
• Account and game data: for as long as your account exists, then as described under deletion below.
• Push subscriptions: until you turn reminders off or deliveries keep failing.
• Purchase records: as long as tax and accounting laws require.

10. Downloading and deleting your data

• Download my data: in the game, open Settings and choose Download my data to get a copy of your account and game data as a JSON file. Raid recordings aren't in that file yet: email support@undeadisland.gg with your username and we'll send you the raid records we hold about you.
• Delete account: in Settings, choose Delete account. It takes effect immediately: your account is disabled and hidden from other players.
• Changed your mind? For 60 days you can sign in again and choose Restore to get everything back.
• After 60 days the account and its data are permanently erased. Telemetry, raid recordings, chat, mail and market records are deleted on their normal schedules (section 9). We keep only what the law requires us to keep, such as purchase records.

Can't get into the game? Email support@undeadisland.gg from any address, tell us your username, and we'll help. We may ask you to prove the account is yours, for example by signing in.

11. Children and minors

Heist Fall is a game for adults. It is not intended for anyone under 18, and it is not directed to children. Sign-up asks for a birth month and year and requires confirming you are 18 or older; if the answer is under 18 we refuse the account and this device can't try again with a different date. We don't knowingly collect personal data from anyone under 18, and in particular from children under 13. If we learn that a player is under 18, we will delete their account and data. If you think someone under 18 is playing, please contact us at support@undeadisland.gg.

12. US state privacy rights (including California)

Depending on where you live (for example California, under the CCPA as amended by the CPRA), you have rights over your personal information. Here's what they mean for Heist Fall, in plain language.

What we collect, by legal category: identifiers (username, internal sign-in address, IP address, random session and device IDs, and an email address if you request an invite); internet or other electronic activity (gameplay telemetry, raid recordings, errors, performance); commercial information (purchases, once available); and your in-game content (chat, listings). We don't collect precise geolocation, and we don't use sensitive personal information to infer things about you. Sections 2 and 3 describe the sources (you, your device and the game), section 5 the purposes, sections 6 and 7 who receives it, and section 9 how long we keep it.

Your rights:

• Know and access: ask what we have about you and get a copy. "Download my data" in Settings does this instantly.
• Delete: ask us to delete it. "Delete account" in Settings does this.
• Correct: ask us to fix anything that's wrong.
• Opt out of "sale" or "sharing": we don't sell personal information, and we don't share it for cross-context behavioral advertising, so there is nothing to opt out of. We don't knowingly collect, sell or share the data of anyone under 18.
• No discrimination: using these rights won't get you treated differently in the game.

To make a request, use Settings or email support@undeadisland.gg. We'll confirm the account is yours first, for example by asking you to sign in. You can use an authorized agent, but we may ask for proof that they act for you. If we turn down a request, you can reply and ask us to reconsider.

13. EEA and UK privacy rights

If you're in the European Economic Area or the United Kingdom, you have the right to:

• access your personal data and get a copy of it;
• have it corrected if it's wrong;
• have it erased;
• restrict or object to how we use it, including processing based on our legitimate interests;
• receive it in a portable format ("Download my data" gives you a JSON file);
• withdraw consent at any time, for example by turning off push reminders. This doesn't affect anything we did before;
• complain to your local data protection authority. We'd appreciate the chance to sort it out first.

Use Settings, or email support@undeadisland.gg. We reply within one month.

14. Where your data is stored

We are based in the United States, and our service providers may process data in the United States and other countries. When personal data from the EEA or UK is transferred, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses in our providers' data processing terms.

15. Security

Data travels over encrypted connections. Passwords are stored only as hashes. Database access rules keep each player's private data to that player and our team. No system is perfectly secure, so please use a password you don't use anywhere else. If a breach affects your data, we will tell you and the authorities as the law requires.

16. Changes

We will update this policy when the game or the law changes. We'll post the new version here and change the date at the top. If a change is significant, we'll also tell players in the game.

17. Contact

[LEGAL ENTITY NAME], LLC, [MAILING ADDRESS]. Email: support@undeadisland.gg [SUPPORT EMAIL: confirm the support@ mailbox receives mail]. Please include your username so we can find your account.