Privacy Policy

Effective: 1 July 2026 · Last updated: 5 July 2026. This explains what personal information Hollowcross ("we", "us") collects, why, and your choices. Hollowcross is operated by Max Andrew Smales (sole trader, Perth, WA, Australia; ABN 27 184 513 885), who is the data controller. Contact us any time at Admin@hollowcross.com or via our Discord.

1. What we collect

• Account: email address, username, and a securely hashed password (we never store your password in plain text).
• Profile / eligibility: date of birth (to confirm you are 15+), country (for region rules), and gender (optional) — used (a) in aggregate to understand our player base, and (b) to select the default voice used for your character's spoken lines in story scenes.
• Security: optional two-factor authentication (2FA) settings — if you enable 2FA we store a secret key used only to verify your authenticator codes — and short-lived email-verification and password-reset codes/tokens, which are used once and then expire.
• Technical: your IP address and a session cookie (hc_session) that keeps you logged in (up to 30 days). We use your IP address to apply regional restrictions and to detect abuse, and we do not use device fingerprinting or cross-site tracking.
• Gameplay: your collection, progress, purchases, match history, arena rank, guild membership, quest progress, and logs of which game modes you play (for aggregate analytics).
• Preferences: your saved audio and accessibility settings (e.g. volume levels and whether spoken dialogue/read-aloud is on), synced to your account so they follow you across devices.
• Social: friend connections and direct messages you send to friends (stored in our database so they can be delivered and moderated). Public tavern chat, and party (group) chat among invited friends, are kept only in a short in-memory buffer and are not permanently stored.
• Moderation: if your account is reported or sanctioned, we may keep related records (such as relevant chat content and mute/ban status) for safety and enforcement.
• Discord integration (optional): if you link your account to Discord, we store your Discord user ID to connect the two. While you use our Discord bot, it processes messages you post in our server to apply automated moderation and stores limited moderation records — such as a running count of warnings and timeouts (it does not keep a copy of every message, though a flagged message that is removed may be recorded in our staff moderation log for enforcement) — plus minigame stats (such as trivia points and your daily-reward streak). Your Discord username may be shown when you or others use profile commands. Linking is voluntary and reversible.
• Steam integration (optional, desktop app): if you play through the Steam desktop app and link your Steam account, we store your 64-bit SteamID to connect it to your Hollowcross account, unlock your Steam achievements, show Rich Presence status, and — if you buy gems or DLC through Steam — record the purchase (order id, item, amount, currency, and status) in our transaction ledger. Linking is voluntary and reversible.

Email, username, password, date of birth, and country are required to create an account; if you don't provide them you can't use the game. Gender is optional, collected only with your consent, used for the purposes in section 2 (aggregate analytics and choosing your character's narration voice), and never shown to other players. Some gender options are considered sensitive (special-category) personal data in the EU/UK. Choosing one is voluntary and is your explicit consent to us storing it; you can withdraw consent at any time by emailing us, and we will delete or de-identify that field. If you withdraw consent, your character's narration voice reverts to the default voice. Withdrawal applies going forward and to records that identify you, but does not reverse statistics we have already aggregated that no longer identify you.

2. Why we use it

• To run your account and the game, and provide support.
• To confirm age and apply region availability (legal compliance).
• To prevent fraud, cheating and abuse, and to moderate chat.
• To understand, in aggregate, how the game is played so we can improve it.
• To choose your character's narration voice in story scenes (from your optional gender).
• To process purchases: web payments are handled by our processor (Stripe) and Steam purchases by Steam. Your payment-card details are entered on the provider's own secure checkout and never reach our servers (see section 6); we receive only confirmation of the purchase.

Where the GDPR applies, our legal bases are performance of our agreement with you, our legitimate interests (security, region compliance, fraud prevention, and improving the game), legal obligations (such as age verification), and consent (optional fields, including your explicit consent for gender where it is special-category data). Automated decisions: we use automated checks (such as IP and country detection) to apply regional restrictions and to detect fraud and abuse; we rely on our legitimate interests (and, where a genuine legal duty applies, legal obligation) for these. A decision with a legal or similarly significant effect on you — such as restricting or suspending your account — is reviewed by a person, and you can ask us to review it, give your point of view, and contest it by contacting us.

3. Cookies

We use an essential session cookie (named hc_session) to keep you logged in; it is HTTP-only and secure and lasts up to 30 days while your account remains active. Our payment or hosting providers may set their own essential cookies (for example during checkout). We do not use advertising or cross-site tracking cookies.

4. Who we share it with

We do not sell your personal information. We share only what's necessary with service providers who help us run the game: our web payment processor (Stripe; may process data in the EU and United States) for website purchases — for which we (not Stripe) are the seller; for Steam purchases, Valve Corporation (Steam) is the merchant of record; our email provider (Google Workspace, United States); and our hosting provider (OVH; servers in Australia). These providers, and our servers, may be located in Australia, the European Union, the United Kingdom, or the United States, so your information may be processed overseas. Where required for cross-border transfers of EU/UK user data, we use appropriate safeguards (such as standard contractual clauses or equivalent mechanisms). Region detection is performed in-house using an offline geolocation database, so we do not send your IP address to a third party for it. We operate an official Discord server and bot for community, support, announcements, moderation, optional account linking, and in-game-linked minigames. Discord Inc. is a third party that independently processes anything you send or do there under its own privacy policy and terms (see discord.com); taking part is voluntary. If you link your account, we share limited data with Discord to grant your roles and rank and to show your profile when you request it, and we store your Discord user ID as described in section 4.2. If the game or our business is sold or reorganised, your information may be transferred to the buyer, who must protect it under terms at least as protective as this policy.

If you use the Steam desktop app, Valve Corporation (Steam), located in the United States, is a recipient of your information: we send your SteamID and purchase details to Steam's Web API to take payment for gems or DLC (Valve is the merchant of record) and verify DLC ownership; your Steam achievements and Rich Presence are set locally through the Steam client on your device. Valve independently processes this under its own Steam Privacy Policy and Steam Subscriber Agreement. We never receive your Steam payment-card details.

4.1 Staff access

Authorised staff and moderators may access account and gameplay information, and in some cases IP addresses, only as needed to provide support, enforce these Terms, and keep the game safe. Staff tools require two-factor authentication.

4.2 Discord integration

Joining our Discord and linking your account are optional. If you link, we store your Discord user ID against your account so the bot can recognise you, grant roles that reflect your in-game level and rank, and let you use account-linked features (such as daily rewards, duels, and opening packs). To keep the community safe, the bot applies automated moderation: it reads messages posted in our server to detect prohibited content, spam, invite or scam links, and raids, and may automatically delete messages, issue warnings, apply timeouts, or (for repeat or serious breaches) bans. We minimise what we keep — we store a running count of warnings and timeouts and the time of the last one; we do not keep a copy of every message, though a message that trips the filters may be recorded in our staff moderation log so we can act on it — and limited minigame stats (such as trivia points and your daily-reward streak). You can unlink at any time with /unlink in Discord (or ask us to unlink it), which removes the link between your Discord ID and your account. Discord Inc. independently processes your activity on its platform under its own policies; our automated moderation is a service we run under our legitimate interest in a safe community, and you can contact us to contest any action. To use account-linked features you must meet our 15+ age requirement.

5. Chat & what other players can see

Public tavern chat is visible to players online in that channel and is kept only in a short rolling buffer (not permanently stored). Direct messages to friends are stored so recipients can read them and so we can moderate abuse. Match chat during a battle is visible only to the participants for that session. Party (group) chat among invited friends is visible only to members of that party for the session and is not permanently stored.

Do not share personal or sensitive information in chat. Your username, level, avatar, rank, guild tag, and chat messages are visible to other players (in chat, profiles, leaderboards, and the arena). Your email, date of birth, exact country, and IP address are never shown to other players. Gender is optional — you can leave it unset.

6. How we protect it

Passwords are hashed with bcrypt; the site is served over HTTPS; payment card details are handled by our payment provider and never touch our servers; access to data is restricted, and two-factor authentication is required for staff accounts. No system is perfectly secure, but we take reasonable steps to protect your information. If a data breach occurs that is likely to result in serious harm to you, we will notify you and the relevant regulator (such as the Office of the Australian Information Commissioner) as required by the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) and any other applicable law. For users in the EU or UK, we will notify the relevant supervisory authority of an eligible breach without undue delay (and, where feasible, within 72 hours of becoming aware of it), and will notify you without undue delay where the breach is likely to result in a high risk to your rights, in line with the GDPR/UK GDPR.

7. How long we keep it

We keep your information while your account is active. You may request account deletion at any time by emailing Admin@hollowcross.com from your registered email address (or otherwise verifying your identity); we aim to delete or de-identify your personal data within 30 days of a verified request (and in any event within the time the law allows, which may be longer for complex requests), except: transaction and payment records, which we may keep for up to 7 years for tax, accounting, and fraud purposes; and limited moderation records (such as chat reported for abuse), which we keep no longer than about 3 years after the last related incident. IP and abuse-detection logs are kept only as long as needed for security and are then deleted or de-identified. If you disable two-factor authentication, or when your account is deleted, we delete the stored 2FA secret. If you link Discord, your Discord user ID and Discord minigame stats are kept while the link is active and are removed when you unlink or delete your account — except where the Discord ID is retained as part of a moderation record (warning/timeout counts), which follows the moderation-record period above. If you link Steam, your SteamID is kept while the link is active and removed when you unlink or delete your account — except where your SteamID appears within a transaction record, which is retained under the 7-year transaction/payment period above; Steam transaction records fall under the transaction/payment retention period above. Per-session play logs used for analytics are retained in identifiable form for no longer than 24 months, after which they are aggregated or de-identified. Direct messages and your friend connections are kept while your account is active and are deleted or de-identified when your account is deleted, unless kept as a moderation record. If your account stays inactive for a long period (for example, two years), we may delete or anonymise it; if it holds an unconsumed paid balance, we will try to give reasonable notice to your registered email first, and dormancy deletion is subject to the retention periods above. For a deletion or data-export request we may also ask you to confirm from within your account (or pass a 2FA check), so that someone who only has access to your inbox cannot delete your account. Where you cannot pass this check — for example, a representative acting for a deceased or incapacitated account holder, or a parent or guardian acting for a minor — we will verify identity and authority by other reasonable means. We destroy or de-identify information when it is no longer needed.

Account deletion is currently handled manually: email the address above from your registered email; we aim to complete verified deletions within 30 days (longer for complex requests).

8. Your rights

You can request access to, correction of, or deletion of your personal information, and withdraw consent where we rely on it (such as the optional gender field). Where the GDPR or UK GDPR applies to you, you can also ask us to export the information you provided (data portability) and to restrict or object to certain processing (including where we rely on legitimate interests). Australian users are protected by the Privacy Act 1988 (Cth) and the Australian Privacy Principles; EU/UK users have rights under the GDPR/UK GDPR. If you are not satisfied with how we handle your information, you can lodge a complaint with a regulator — the Office of the Australian Information Commissioner (OAIC) in Australia, the Information Commissioner's Office (ICO) in the UK, or your local supervisory authority in the EU. To exercise any right, email us at Admin@hollowcross.com (we may need to verify your identity first); for general questions you can also use Discord. We aim to respond within 30 days (or the period required by applicable law, if longer). California residents also have the right to know, correct, delete, opt out of sale, and limit the use of sensitive personal information, and will not be discriminated against for exercising any privacy right. We do not sell or "share" personal information for cross-context behavioural advertising. We use sensitive personal information (such as gender) only for the purposes described in this policy (aggregate analytics and character-voice selection) and never to infer other characteristics about you, so no separate "limit" step is needed; you can still withdraw consent. An authorised agent may submit a request on your behalf, and we may verify their authority.

9. Children

Hollowcross is for ages 15 and over. We do not knowingly collect information from anyone under 15. If we learn an account belongs to someone under 15, we will delete it. Parents/guardians can report such accounts by emailing Admin@hollowcross.com or via Discord.

10. Changes & contact

We may update this policy; the effective date will change and material updates will be posted in-game and on Discord, and where a change materially affects your rights we will take reasonable steps to notify you. Questions or requests: email Admin@hollowcross.com or join our Discord. See also our Terms & Disclaimer.