Who runs this service
HeroBeacon is operated by an individual. The contact address for every request below is privacy@herobeacon.live. On request to that address, the controller's full identity and country of residence will be supplied to a data subject or a supervisory authority within 30 days
What we process
This policy describes what HeroBeacon processes, why, how long it is kept, and what you can do about it
| Category | Purpose | Retention | Legal basis |
|---|---|---|---|
| Account identity | Sign-in and account management | Life of the account | Contract (Art. 6(1)(b)) |
| Session credential | Keeps you signed in | Until session ends or sign-out | Contract (Art. 6(1)(b)) |
| Session diagnostics | IP address and user agent | Until session ends or sign-out | Legitimate interests (Art. 6(1)(f)) — security and abuse prevention |
| Capture credential | iOS Shortcut / Android automation auth | Life of the account | Contract (Art. 6(1)(b)) |
| Scan log | Outcome, versions, timings, recognised heroes per analysis | Life of the account | Contract (Art. 6(1)(b)) |
| Screenshots (default) | Decoded in memory for the response — never stored | Not retained | Contract (Art. 6(1)(b)) — transient processing |
| Screenshots (opt-in contribution) | Full frames and derived hero-portrait crops when contribution toggle is on | Full frames: 14 days or account deletion, whichever comes first. Derived crops: indefinitely in the recognition dataset | Consent (Art. 6(1)(a)) |
| Preferences | Language, theme, hero pool, contribution flag | Life of the account; cookies per their lifetime | Contract (Art. 6(1)(b)) |
| Device / anti-abuse | Per-device id and referral attribution | Device id 2 years; referral life of account | Legitimate interests (Art. 6(1)(f)) — fraud prevention |
| Billing | Top-ups, credit ledger, entitlements, settlement refs | Pseudonymised on deletion; kept while service runs | Contract (Art. 6(1)(b)); after deletion legitimate interests (Art. 6(1)(f)) — reconciliation |
| First-party telemetry | Per-request metrics by request and account id — no images | Cloudflare Analytics Engine window | Legitimate interests (Art. 6(1)(f)) — operating the service |
| Error monitoring (Sentry) | Errors: URL, browser, IP, release, optional account id — no screenshots | 30 days | Legitimate interests (Art. 6(1)(f)) — service integrity |
| Operator monitoring | Worker health: status, latency, edge — not pageviews | Operator stack window | Legitimate interests (Art. 6(1)(f)) — keeping the service up |
| Acquisition & funnel measurement | Traffic source, campaign, locale, country, and pre-account funnel steps (landing visit, signup started) against the device cookie | Indefinitely — not tied to an account or deleted with one | Legitimate interests (Art. 6(1)(f)) — first-party audience measurement |
Screenshots
By default each screenshot is decoded in memory to produce a recommendation and is not written to storage. If you turn on data contribution, full frames are kept for 14 days and derived hero-portrait crops may enter the recognition dataset
Sub-processors
Sub-processors: Cloudflare (hosting, D1, KV, R2, Analytics Engine), Resend (transactional email including change announcements), Google (Sign in with Google when you choose it), Sentry (error reports), the operator monitoring stack, and the crypto settlement processor when you top up
International transfer and location
Processing uses Cloudflare's global edge; error reports are stored by Sentry in the EU (Germany); data is not stored in Russia
HeroBeacon does not claim compliance with Russian data-localisation law. Every user receives the same rights described here regardless of location
Your rights
You may access, correct, withdraw consent for contribution or analytics cookies, and delete your account from settings
Account deletion in settings erases personal data as described in the survivors section. For other requests write to the contact address
What survives deletion
After deletion, anonymised payment records in the credit ledger, purchases, checkout sessions and settlement exceptions remain while the service operates so settlement can still be reconciled. They are not keyed to your account id
Minimum age
You must be at least 13 to use HeroBeacon (the threshold Mobile Legends sets). Where local law requires 16 for digital consent, that higher age applies
Contact and complaints
Data-access and other rights requests: email privacy@herobeacon.live — answered within 30 days
Underage accounts: report to privacy@herobeacon.live — answered within 30 days
Trademark or content complaints: privacy@herobeacon.live — answered within 30 days
For cookie names, lifetimes and the analytics choice, see the cookie policy
Contact
Write to privacy@herobeacon.live. Every request named in these documents is answered at that address within 30 days
Changes to this document
Material changes are announced by email to the address on your account no later than the day they take effect. If you do not have an account, the effective date at the top of this page shows when the current text binds