Effective date: 2026-10-22 Version: v1.0 Last updated: 2026-10-22
This policy explains what data Pinball Hero collects while it runs, what we use it for, where it is stored, how long we keep it, and how you can exercise your rights over it.
We have written down what we actually do rather than filling in a template. Judgements about which laws apply are outside the scope of this document.
We may update this policy as the game changes. When something material changes, we will update this page and say so in the game.
1. Who handles your data
- Controller: luke6b (an independent game developer)
- Contact email:
chanxiuming123@gmail.com - The game is developed and published by one person. There is no parent company, no advertising partner, and no data broker involved.
2. The short version
The game collects anonymous match and startup data, used for two things: balancing the game and finding out how many people are still playing after an update. We do not collect Steam accounts, chat content, friend lists, or cloud saves, and we do not use any advertising or third-party data SDK.
3. What is collected, item by item
3.1 The part you will actually see a prompt for: balance and retention telemetry
On first launch the game asks you in a dialog, and you can choose to agree, decline, or decide later. You can turn it off at any time under Settings → Game → Send anonymous balance data. If you decline, not a single byte is collected or uploaded.
| Category | What it contains |
|---|---|
| Install identifier | A randomly generated 32-character hexadecimal ID. It comes from a cryptographically secure random number generator, and is not derived from a hardware serial number, MAC address, computer name, username, or Steam ID |
| Device environment | Operating system name (such as Windows), interface language, game version and build identifier |
| Startup | Time of each launch, how long it ran, whether it was the first launch, and how many days since the first launch |
| Matches | The class you picked, difficulty, each character's level, skills and talents (including the level and time at which they were gained), win or loss, which act and room it ended in, kill count, gold, damage dealt, and duration |
| Talent offers | Which options were offered for each talent roll, their weights, which one you picked, and the size of the candidate pool |
| Progress | One record per room entered (which act, which room, what kind of room) |
| Crash fallback | If the game terminates unexpectedly, the next launch backfills the previous run's progress (marked as crash) |
Offers and progress exist to tell apart "this talent is too weak" from "this talent never reached the player at all". Without them every balance conclusion would be wrong. That is why they are collected.
3.2 The part that does not need consent but still goes out: crash reports and startup heartbeats
The game uses Sentry, an error monitoring service. It sends two kinds of data:
| Kind | Contents | Why it is not covered by the consent switch |
|---|---|---|
| Crashes / errors | Error stack traces, game version, engine version, and a short excerpt of the local log (user://logs/game.log, which records scenes and flow and contains no personal information) |
Crash reporting has to work before consent is given, otherwise "it installs and won't open" problems could never be diagnosed |
| Startup heartbeat | Game version, engine version, operating system name, the rendering driver actually in use (such as d3d12 or vulkan), rendering method, interface language, whether the previous run exited abnormally, and startup duration |
Same reason: a startup failure happens before any script runs, and this is the only way to confirm how many machines actually got a window open |
This heartbeat deliberately carries only non-identifying information: we removed the install identifier, GPU model, GPU vendor, and screen resolution, and we do not send the system version number. On its own or in combination, it cannot point to a specific person or a specific machine.
3.3 Feedback you send yourself
This only happens if you press "Report bug" and then send it:
- In mainland China (Simplified Chinese system): it goes to a Feishu group bot. The body is the description you wrote + four dropdown choices + game version / system / current scene / recent log. An attached screenshot is really uploaded (through the open platform app channel).
- Elsewhere: it goes to Sentry. Same body; the screenshot is uploaded as an attachment.
- Both channels let you send without a screenshot.
4. What we do not collect
- No Steam accounts, Steam IDs, friend lists, or inventories
- No chat or voice content, no input method content, no clipboard content (screenshots excepted, and only when you send feedback yourself)
- No ad targeting, no cross-app tracking, no third-party analytics SDK
- We do not use Steam Cloud saves
- No real names, email addresses, phone numbers, or postal addresses (unless you put them in feedback yourself)
5. Where the data lives and how long we keep it
- On your machine:
%APPDATA%\Godot\app_userdata\hero_pinball\telemetry\(runs.jsonlandcurrent.json).
Turning the switch off deletes the locally collected data immediately.
- Install identifier: even after you turn collection off, the random ID in
user://install_id.txtstays on your machine
(so that turning it back on later does not make you look like a brand new install in the statistics). It contains no personal information, and deleting the whole user:// directory removes it too.
- On our servers: deleted after 24 months.
- Third-party processors:
| Processor | Purpose | Location |
|---|---|---|
| Sentry (Functional Software, Inc.) | Crash reports and startup heartbeats | United States (ingest.us.sentry.io) |
| Feishu / Lark (ByteDance) | Feedback voluntarily submitted by players in mainland China | Mainland China |
| Cloudflare, Inc. (Workers + D1) | Telemetry upload and storage | South Korea (APAC / ICN) |
Transport encryption: all uploads use HTTPS (TLS 1.2+), against the endpoint https://pinball-telemetry.chanxiuming123.workers.dev/ingest. Plain HTTP is not accepted.
Cross-border transfers: the data is used only for the purposes listed in the table above, and the recipients are limited to the processors listed there (United States: Sentry; South Korea: Cloudflare D1; mainland China: Feishu). The data transfer arrangements we have in place with those processors are available on request from the email address above.
6. Your rights
- Withdraw consent at any time: Settings → Game → Send anonymous balance data → off. Withdrawing stops collection immediately and deletes the local data.
- Delete data that has already been uploaded: email the address above. Note that records already uploaded cannot be pulled back out of "the statistics that have already been produced"
(we do aggregated statistics and keep no profile that could single out an individual).
- Access / correct / export / restrict processing: contact the same email address. We reply within 30 days.
- Legal basis: consent (GDPR Art. 6(1)(a)). You can play the whole game without giving consent, and nothing about the game changes.
7. Minors
The game contains no in-app purchases, no advertising, and no social features, and it has no age gate. If you are under 14, please use it with a guardian's consent.
8. Languages and versions
This policy is available in Chinese and English; use the switch in the top right of the page. Other language versions have not been translated yet. If you need one, email the address above and we will send you the file.