HOK Global1. Who is responsible
The data controller is Karma, France. You can write to karmaisafool69@gmail.com for anything about your data.
2. What we keep, and why
If you only read the public pages, we keep no profile of you: there is no account, no advertising, no analytics and no tracking. Our server answers your request and our systems count requests for a few minutes to stop abuse (limits per network address, kept in memory).
If you create or use an account, we keep:
- Your account: pseudo, a unique tag, email address (to sign in; we never send mail), the password as a salted hash only, your authenticator secret (encrypted), your recovery codes (as hashes), your avatar. Basis: the contract (the account you asked for).
- If you sign in with Google: the email address, name and picture Google sends us. Google also asks for your authenticator code afterwards. Basis: the contract.
- If you link Discord (optional): your Discord identifier, user name, avatar and the notification choices you made. Basis: your consent, which you withdraw by unlinking.
- Your sessions: a hash of the sign-in token, its dates and its expiry. Basis: the contract and our legitimate interest in security.
- What you create: series and drafts, teams and their members, tier lists, notes and scenarios, guides, training results, your personal space and its links, agenda events, messages, posts, requests and reports of the community, and the API keys you make (stored as hashes). Basis: the contract.
- Security data: failed sign-in counts and the temporary lock that goes with them, and a journal of the security events of your account (sign-in, sign-out, password or authenticator change) with their date and the network address they came from. Basis: our legitimate interest in protecting accounts.
- What you send us through the contact form: name, email address and message. Basis: our legitimate interest in answering you.
Without an account, a random identifier can be kept in a cookie as soon as you save something (a series, for example), so that you find it again. It holds nothing about who you are.
Other people see what you choose to share: your pseudo and tag, the teams you belong to, what you post in the community, and what you share with a link. Anyone with a shared link can read what it points to.
3. Who receives it
- Our host, Hetzner Online GmbH, which stores the site and its database (Industriestr. 25, 91710 Gunzenhausen, Germany).
- Google, if you sign in with it, and Discord, if you link it: they receive what the sign-in or the link needs.
- Tencent / TiMi servers: the pictures, artwork and videos of the heroes and of the game are loaded by your browser straight from their addresses (camp.honorofkings.com, res.sgameglobal.com), so they see your network address and your browser, as for any site that loads their pictures.
- A translation service: the texts written by our staff (names and descriptions of items and so on) are sent to translate them into the languages of the site. No personal data is in them.
- Authorities, when the law requires it.
We do not sell your data and we do not use it for advertising or for profiling.
4. Transfers outside the European Union
Google, Discord and Tencent can process data outside the European Union, including in the United States and in China. When you use them, their own policies and transfer safeguards apply. Our own data is stored with Hetzner Online GmbH.
5. How long we keep it
- Account data: until you delete your account.
- Sessions: 14 days without use, 30 days at most for an account; 180 days without use, 365 days at most for a visitor without an account.
- Security journal: 180 days.
- Contact messages: as long as it takes to answer, then at most 12 months.
- What you published in a team belongs to that team's history: if you leave or delete your account, your name is removed from it where the data model allows it, and what depends only on you is deleted.
- Deleted data can remain for a limited time in backups, until they are overwritten.
6. Your rights
You may ask for access to your data, to have it corrected or erased, to limit or object to its use, to receive it in a portable form, and to withdraw a consent at any time. In your account page you can download your data and delete your account yourself. For the rest, write to karmaisafool69@gmail.com; we answer within one month. We may ask you to prove who you are.
If you think we do not respect your rights, you can complain to the CNIL (cnil.fr) or to the data protection authority of the country you live in.
7. How we protect it
Passwords are stored only as salted hashes; two-factor authentication is mandatory; the connection is encrypted; the site refuses to run scripts or styles that it does not control (a strict content security policy); and access to the database is limited to the site's own account. No system is perfect: if a breach put your rights at risk, we would tell you and the authority as the law requires.
8. Cookies
The site only uses the cookies and the local storage it needs to work and to remember your choices. They are listed in the cookies page. They do not need a consent banner, and we use none.
9. Children
The site is not meant for people under 15. If you think a younger person gave us data, write to us and we will delete it.
10. Changes
We may change this policy; the date at the bottom is the last change. A change that matters to you is announced on the site.
Last updated: Oct 30, 2026