The short version
- Public tools do not require a player account, deposit or payment details.
- Seeds entered in the demo and verifiers are processed in your browser, not sent in our analytics. Do not put confidential seeds in an email.
- We collect limited usage and outbound-click records using a random per-tab identifier. These records are pseudonymous, not a promise of complete anonymity.
- We do not store IP addresses in our analytics tables. Infrastructure providers process network information to deliver and protect the service.
1. Scope and contact
This policy covers the public ProvablyHero website at provablyhero.com and its content and analytics API at api.provablyhero.com. The project operator is responsible for the processing described here. Contact hey@provablyhero.com for privacy questions or requests. The restricted administrative service is not a public player-account system.
2. Usage and click records
Usage events can include event name, time, page, game, operator, selected non-secret settings, language, approximate country, device category and a random per-tab session identifier. Outbound-click records can also include the button position, redirect outcome and referring hostname. We use these records to understand tool use, maintain the service and measure affiliate referrals. We do not include entered server seeds, client seeds, account passwords or payment details in those event records.
Raw usage events are retained for 90 days and outbound-click records for 24 months under the scheduled cleanup process. Daily aggregate counts can remain after raw records expire. Cleanup depends on scheduled maintenance running successfully; backups and provider logs can follow separate retention periods.
3. Browser storage and shared URLs
The demo saves its virtual balance, generated demo seeds, nonce, settings and recent history in localStorage so the demo can resume. This storage can persist after closing the browser. Clear the site’s stored data in your browser to remove it. Resetting the demo replaces its state; it is not a request to delete server-side analytics.
sessionStorage holds the random per-tab analytics identifier and the regional eligibility response. It normally lasts for the page session and can be restored when a browser restores a tab. We do not intentionally use it as a cross-site advertising identifier.
Some tools put their reproducible configuration and statistical simulation seed in the URL. URLs you share can be read by their recipients, stored in browser history and processed in infrastructure request logs. A simulation seed is not a casino server seed. Do not put confidential information in a shared URL.
4. Correspondence
If you email us, we receive your address, message and any attachments. We use them to answer your request and handle corrections, privacy enquiries or partnerships. Correspondence is retained while needed for that purpose or applicable obligations and reviewed for deletion when no longer needed. Closed operator-contact records stored in the project database are subject to a 36-month cleanup rule.
5. Infrastructure and service providers
Cloudflare provides hosting, content delivery, file storage and security. It processes IP addresses and other request metadata at the network edge, including for location checks, abuse controls and service telemetry. Supabase hosts site content and application records. Our email service processes messages you choose to send. We do not claim that network addresses are never processed outside our application database.
Providers can process data in countries other than yours. Applicable safeguards and retention depend on the provider, service configuration and relevant law. We restrict access to application records and use the hosting providers’ access controls. No system can guarantee complete security.
6. Cookies and similar technologies
Our application uses browser storage as described above and does not set advertising cookies. Infrastructure or third-party websites may use their own cookies, including security cookies. Visiting an external operator is governed by that operator’s privacy and cookie notices. A lack of application cookies does not mean no data is processed.
7. Affiliate links
An active Visit link passes through our /go/ route, which checks regional eligibility again before redirecting. We can send non-secret attribution values identifying the page, button and interaction to the affiliate platform. Our random tab identifier is used in our own click records, not deliberately passed as an affiliate tracking identifier. The destination receives normal network information and may set attribution cookies. See the affiliate disclosure.
8. Purposes, legal basis and rights
We process limited operational records to run, secure and improve the website, measure referrals and respond to requests. Where applicable law permits legitimate interests as a basis, we rely on those interests after considering the limited data and the impact on visitors. Other obligations or your request may apply to correspondence. This statement does not remove any consent requirements imposed by applicable law.
Depending on applicable law, you may have rights to access, correct or erase personal data, object to processing, restrict processing or complain to a supervisory authority. Contact hey@provablyhero.com. We may need enough information to identify the relevant record and verify a request. Without a matching identifier, we may be unable to associate an event record with you; email correspondence is normally easier to identify.
9. Adults and policy changes
The site is intended for adults and is not directed at children. We update this policy when the described processing changes. The effective date appears at the top of the page.