Privacy, in plain language
Privacy policy
Last updated: 2 September 2026
This policy describes the data practices of HORDE MOWER on the web and, when released, its iOS and Android apps.
1. Scope and quick facts
The game can be opened without signing in. A pseudonymous game account is created when you first use an online feature such as starting a verified run, claiming a reward, upgrading gear, or entering co-op. Google or Apple sign-in is optional and is used to carry progress between devices.
We do not run advertising, sell personal data, or use data for cross-app tracking. The game does not request precise location, contacts, camera, microphone, health data, or an advertising identifier. Payment card details are handled by the app store and are not received by HORDE MOWER.
2. Data we handle
| Category | What it includes | When |
|---|---|---|
| Account and identity | Random player ID, display name and an authentication token stored on your device. If you link Google or Apple: provider type, provider account identifier, and the name or email supplied in the verified identity token. | When an online account is created or voluntarily linked. |
| Game and multiplayer data | Cloud save, coins, gear, defenses, achievements, stages, daily rewards, leaderboard results, co-op room state, run summaries, input replay, enemy and perk statistics, and security-verification results. | When you play, progress, submit a score, or use co-op. |
| Usage and performance | Feature and screen events; coarse device class; operating-system and browser family; rounded screen and viewport size; frame-time statistics; memory/core buckets; connection type; language; time-zone offset; game/client version; random per-page session ID. | To understand balance, reliability and feature use. |
| Diagnostics | Crash messages, stack traces, performance traces, game stage/mode and coarse device context. Authentication headers and request bodies are stripped. HORDE MOWER does not attach your player ID, name or email to client diagnostics. | Only when diagnostic monitoring is configured. |
| Problem reports | The message you write in Settings → Report a problem, the category you pick, and the diagnostic context listed above for the moment you sent it. Reports are linked to your player account so we can rate-limit them and act on them. We do not ask for your email address here, and there is no way for us to reply to an in-game report. | Only when you choose to send a report. |
| Support | Your email address and anything you choose to include in a support or privacy request. | When you contact us. |
| Purchases | Store, product ID, transaction ID, price and currency, purchase time, receipt-validation result, granted coin amount and refund status. Apple, Google and RevenueCat process the checkout and receipt; we do not receive your complete payment-card number. | When you buy or refund a coin package. |
3. Why we use data
We use account and gameplay data to provide cloud progress, verified rewards, rankings, co-op, account recovery, fraud prevention, balancing and support. We use technical and diagnostic data to keep the service secure, find crashes, improve performance and understand whether game systems work as intended.
For people in the EEA or UK, the legal bases are: performance of the service contract for account, game and purchase functions; legitimate interests in security, fraud prevention, service reliability and proportionate first-party analytics; consent where the product specifically asks for it; and legal obligations for tax, accounting, consumer and compliance records.
4. Device storage and sign-in
The game uses local storage for the device authentication token, local progress cache, settings, update state and tutorial state. These are functional storage items, not advertising cookies. The marketing site does not install advertising or marketing cookies. Google or Apple may process information under their own policies when their sign-in option is used or displayed.
5. Service providers and disclosure
We disclose data only where needed to run the game, comply with law, protect players, or complete a transaction you request. We do not sell it.
| Provider | Role | Status |
|---|---|---|
| Cloudflare | Website and game delivery, networking and security. | Used now. |
| OVHcloud | Game server, PostgreSQL, Redis and self-hosted diagnostic monitoring in Warsaw, Poland. | Used now. |
| Cloudflare R2 | Encrypted PostgreSQL backup storage in the European Union jurisdiction, with a configured 14-day retention period. | Used now. |
| Google / Apple | Optional identity verification when you choose that provider. | Used only when configured/chosen. |
| Apple App Store / Google Play / RevenueCat | Store checkout, receipt validation and purchase/refund events. | Used when you purchase a coin package. |
Some providers may process data outside your country or the EEA. Where required, we rely on an adequacy decision, standard contractual clauses or another transfer mechanism permitted by applicable data-protection law. You may contact us for information about the safeguard relevant to your data.
6. Retention and account deletion
- Account, linked identity and cloud progress are kept while the account is active.
- Account-linked analytics are kept while needed to compare releases, balance the game, protect the service and diagnose reliability problems. They are deleted or de-identified when they are no longer useful for those purposes, and the account link is removed when the account is deleted.
- Diagnostics and in-game problem reports are stored in the self-hosted monitoring service on OVHcloud and removed when no longer needed for troubleshooting, security or legal claims. Support emails are removed when no longer needed to resolve the request or establish, exercise or defend legal claims.
- Purchase and refund records are retained for the period required by applicable tax, accounting and consumer law, and where reasonably necessary to prevent fraud or resolve a transaction dispute.
Deleting your account removes the account, display-name link, Google/Apple link, device credential, cloud save and ranking identity. Gameplay balance records, run replays, security observations and analytics may remain only after the player/account reference is removed. These de-identified records are not used to rebuild your account. Database backups age out after 14 days and are not used to restore a deleted identity.
Read the deletion steps and request deletion.
7. Your choices and rights
Depending on where you live, you may have rights to access, correct, erase, restrict, object to processing, or receive a portable copy of personal data, and to withdraw consent where processing relies on consent. You can also complain to your local data-protection authority. We may need to verify that a request belongs to you.
Use Settings → Privacy & account → Delete account & data for immediate in-app deletion, or contact contact@hordemower.com. You may contact the Data Protection Officer at dpo@hordemower.com. You may lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) or the competent authority where you live or work.
8. Children
HORDE MOWER is intended for players aged 13 and over and is not directed to children under 13. We do not knowingly collect personal data from a child under 13. Where local law requires parental or guardian authorisation for a player aged 13 or older to use an online service or consent to data processing, the player must obtain that authorisation. A parent or guardian who believes a child supplied personal data should contact us so it can be reviewed and removed.
9. Security
We use HTTPS, server-side receipt and run verification, hashed device tokens in the database, restricted administrative access, secret filtering in diagnostics, and separation between public game services and operator tools. No system can be guaranteed completely secure.
10. Changes
We will update this page when data practices or providers materially change and will change the “Last updated” date. If a change requires notice or consent under applicable law, we will provide it in the game or through another appropriate channel.
11. Contact
Controller: Bawe Design
Address: ul. Pokoju 44, 42-504 Będzin, Poland
VAT ID: PL6252467634
REGON: 381992360
Email: contact@hordemower.com
Data Protection Officer: dpo@hordemower.com