Privacy Policy

Last updated 1 November 2026

The short version

We only collect what the game needs: your hero, your progress, and a username and password if you make an account.
No ads, no tracking, and we never sell your data.
Your IP address is used to stop abuse and is not saved in our database.
Chat is public and deleted after 7 days.
You can delete your account in the game at any time, and your hero and progress go with it.

1. Who we are

Last Light of Hearthhold (“the game”, “we”, “us”) is made and run by Last Light Studio, based in the United Kingdom. We are responsible for the personal data described here (the “controller” under data protection laws such as the UK GDPR and the EU GDPR).

Questions or requests: [email protected].

2. What we collect, why, and for how long

What	Why	How long
Account: your username, your password (stored scrambled with scrypt, so nobody can read it, us included), and when the account was made and last used. Guests have no username or password.	So you can sign in and keep your hero.	Until you delete your account.
Sign-in token: a random code kept on your device, in the app or your browser. We only keep a scrambled copy.	To keep you signed in.	Until you sign out, or 60 days without playing.
Your hero and progress: hero name, class, look, level, floors, items, currencies, pets, quests, mail, guild, Arena results and game settings.	To run the game.	Until you delete your account.
Chat: messages you send in public channels, with your hero name.	Other players read them; we use them to deal with abuse.	7 days.
Reports and moderation: reports you make, reports about you, mutes and bans.	To keep the game safe.	As long as needed to handle them and prevent repeat abuse.
Play statistics: when you connect and disconnect, and once a day your best floor, level and number of Rekindles. No IP address and no device details.	To understand how the game is played and balance it.	Until you delete your account.
IP address: the network address your connection comes from.	To limit sign-in attempts and new guest accounts per network, which stops abuse.	Only in the server's memory while it runs; never saved in our database.
Error logs: technical messages when something goes wrong.	To find and fix problems.	A short time, then deleted automatically.

We don't ask for your real name, email address, phone number, location or contacts, and the game has no in-game purchases today. If we add purchases, we'll update this policy first and explain what changes.

3. What other players can see

Hearthhold is a shared world. Other players can see your hero name, class, level, look and gear, title, guild, power and rankings, Arena results, your hero in town, and the chat messages you send. Your account username and password are never shown to anyone.

4. What we store on your device

The game keeps your sign-in token and its own settings on your device, in the app's storage or your browser's local storage. That's all. The app asks for no permissions beyond the internet and vibration (for the optional haptics). There are no advertising or tracking cookies, and this website (lastlightrpg.com) uses no cookies at all. Uninstalling the app or clearing its data signs you out; a guest who hasn't secured their account can lose their hero that way.

We don't sell or rent your data, show ads, or use analytics or tracking services. Your data is only handled by:

Cloudflare, which carries the traffic to our server and protects it from attacks. It sees connection data such as IP addresses while doing so.
Our hosting provider, which runs the server that stores the game's data.
Google, when you get the app from Google Play. Google handles the download and any reviews under its own privacy policy; we get no personal data from it.
Authorities, only if the law requires it.

6. Our legal reasons

Under the UK GDPR (and the EU GDPR for players in the EEA), we rely on:

Contract: running the game you asked to play, including your account, hero and progress.
Legitimate interests: keeping the game secure and fair, moderating chat, and using play statistics to improve it. You can object; see section 8.
Legal obligation: where the law requires us to keep or share something.

7. Backups

We back up the game's database every day and keep the last 14 days of backups, in case something goes wrong. Anything you delete is gone from the backups within 14 days.

8. Your choices and rights

Delete your account: in the game, open the Menu, then Account, then Delete account. Your hero, progress, mail, sign-in tokens and play statistics are deleted straight away. Chat messages disappear within 7 days. Can't open the game? See lastlightrpg.com/delete-account.
Get a copy, correct or object: email us at [email protected]. We'll answer within 30 days and may ask you to show the hero is yours.
Complain: you can complain to the UK's Information Commissioner's Office (ico.org.uk), or to the data protection authority where you live.

9. Children

The game is not for children under 13, or under the minimum age for online services in your country if that's higher. If you believe a child under that age has an account, email us and we'll delete it.

10. Security

Passwords are scrambled with scrypt, sign-in tokens are stored scrambled, all traffic is encrypted (HTTPS), and access to the server is restricted. No system is perfect, so please use a password you don't use anywhere else.

11. Where your data is

Our server and service providers may be in a different country from you. Where the law requires it, we rely on the safeguards those providers offer for international transfers.

12. Changes

If we change this policy we'll update the date at the top, and for important changes we'll tell players in the game before they apply.

13. Contact

Last Light Studio · [email protected]