Last updated: 2026-10-14
0. Operator Information
Operator: Hogwarz Labs(the operator's name and address will be provided without delay upon request to the contact below)
Contact:
contact@himefuda.com1. Information We Collect
※ Comprehensive list aligned with Google Play Data Safety declarations.
◇ Personal Information
- Email address (at account creation; for authentication only)
- Login provider subject identifier (Google / Apple / Anonymous)
- In-game display name (optional user input)
◇ In-Game Progress Data
- Hime-stone balance, owned cards, deck composition, battle records, gacha history
- Session data including playtime and launch counts
◇ Automatically Collected Information
- IP address (access logs; short-term retention by Vercel / Supabase)
- User agent (device type / OS version)
- HTTP referrer and request timestamps
- Crash / error logs (collected after anonymization)
◇ Information We Do NOT Collect
- Location data (GPS / Wi-Fi positioning)
- Contacts / address book
- Camera / microphone / photos
- SMS / call logs
- Health / fitness data
2. Purpose of Use
- Service operation (authentication / progress saving / multiplayer matchmaking)
- Bug response and fraud prevention (bot detection / RMT monitoring)
- Anonymous statistical analysis for feature improvement (Vercel Analytics)
- Identity verification and inquiry response
- Legal compliance
3. Third-Party Sharing (Data Recipients)
We do not share user personal information with third parties except for legal obligations and the following service vendors.
| Recipient | Purpose | Region |
|---|
| Supabase, Inc. | Auth / DB / Realtime | USA |
| Vercel, Inc. | Hosting / Analytics / Speed Insights | USA |
| Stripe, Inc. | Payment processing (Web only) | USA |
| Google LLC (OAuth) | Google Sign-In | USA |
| Apple Inc. (OAuth) | Sign in with Apple | USA |
| Google AdSense | Ad delivery / interest data via cookies | USA |
| Google LLC (Google Play billing) | In-app purchases in the app (Android) | USA |
| Apple Inc. (App Store billing) | In-app purchases in the app (iOS) | USA |
| RevenueCat, Inc. | Purchase processing and purchase-history verification in the app (current Android edition) | USA |
| Unity Technologies (Unity IAP) | Purchase processing in app editions using Unity IAP, and measurement data about that purchase flow | USA |
| Unity Technologies / ironSource (Unity LevelPlay) and the ad networks it delivers from | Rewarded ads in the app (only in builds with the ad feature enabled) | USA / Israel |
All recipients receive data over TLS 1.2+ encrypted connections, with the minimum necessary data only.
4. Cookies / Similar Technologies / Advertising IDs
- This service uses cookies and localStorage for authentication persistence.
- Vercel Analytics stores anonymous session identifiers in cookies (no personal identification).
- Google AdSense may collect interest information via browser cookies for ad delivery. Opt-out: Google Ad Settings.
- In the app (Unity edition), Hime-stone purchases are processed by Google Play / App Store in-app billing. Card and payment details stay with the store and are never sent to this service. To verify a purchase, the store and the app server handle transaction data such as the order / transaction ID, product and purchase state. The current Android edition uses the RevenueCat SDK for purchase processing: your account ID with this service, purchase information (purchase token, product, purchase state) and basic device and app information (device type, OS, app version) are sent to RevenueCat and used to verify your purchase history. The app starts the RevenueCat SDK initialisation and the sending of your account ID only after the age setting has been confirmed as 13 or older, when you open the shop screen. While the age setting is unanswered or under 13, the app does not start this initialisation. After initialisation, the link to your account ID is released when you sign out, switch to another account or change the age setting (a new account ID is sent only while the shop screen is open). No advertising identifier is sent in this purchase flow. Web purchases are processed by Stripe.
- In editions using Unity IAP (the planned method for the Android / iOS editions), in addition to the transaction data above, Unity's purchasing SDK sends device information (model, OS, language / region, boot time, free storage), the app identifier and version, the purchase contents, a session identifier and, on iOS, the device vendor identifier (IDFV) to Unity Technologies' measurement servers when a purchase starts, is paid, fails or completes. Advertising identifiers (AAID / IDFA) are not included unless you have consented to advertising use of your data, and this app does not ask for that consent.
- Rewarded ads in the app use Unity LevelPlay (the ironSource mediation SDK). An ad starts only when the age setting is 13+, the cross-border data transfer has been accepted, and you choose "Watch an ad". For ad delivery, fraud prevention and measurement the ad SDK may process device information, approximate location (IP-based), ad interaction data and the device advertising identifier (AAID on Android; IDFA on iOS only where tracking permission exists). The app passes "no" for ad-personalization consent to the SDK and does not request iOS tracking permission (ATT). With an under-13 setting, neither ads nor paid purchases are offered.
- Each purchase and ad feature is provided only in app editions where its configuration is enabled. Whether and how each SDK handles data differs by app edition, provider (RevenueCat / Unity IAP / Unity LevelPlay), the enabled configuration and the behaviour of the SDK itself. In app editions that bundle an SDK, parts of that SDK may be initialised at launch by the operating system or by the SDK and may communicate with its provider even under a configuration that does not offer the feature.
5. Notifications
If you opt in to device notifications, the app sends local notifications (e.g., daily reminders). Notification content is generated locally and is never sent to third parties.
6. Data Retention Period
- Account information / in-game progress: while account is active
- Access logs: deleted within 30 days of collection
- Crash reports: deleted within 90 days of collection
- After account deletion: complete erasure within 30 days (including backups)
7. User Rights (Access / Correction / Deletion)
Users may exercise the following rights:
- Account deletion: Available immediately via the "Delete Account" button in Settings.
- Disclosure / correction / deletion of personal data: Email contact@himefuda.com. We respond within 14 business days.
- Suspension of processing: same email contact as above.
Deleted data cannot be recovered. Payment records are retained for the legally mandated period (7 years) for duplicate-charge investigations.
8. Minors and Children
- This service is intended for users aged 12 and older.
- Users under 13 must not create accounts without parental consent.
- If a user under 13 is identified, their account will be deleted.
- This service complies with US COPPA, EU GDPR-K, and other child privacy regulations.
- Minors purchasing in-app must obtain parental consent.
9. Security
- All communication encrypted with TLS 1.2+.
- Passwords are not stored (delegated to OAuth providers).
- Server-side data stored in Supabase encrypted storage.
- Row Level Security (RLS) prevents unauthorized access to other users' data.
10. International Data Transfer
Your data is processed by external services located in the United States (Supabase / Vercel etc.). By using this service, you consent to international data transfers outside Japan. For users in the EEA / UK, transfers are based on the recipient country's adequate level of data protection.
11. Revisions
This policy may be revised without prior notice as needed. For significant changes, we will notify via app launch or at the top of this page. Continued use after revisions constitutes acceptance of the new policy.