This policy explains how Hachirowmaru uses information to operate its free-play social games and account tools for UK adults. We collect information needed for the functions you choose, keep probability profiles private and do not sell personal information.
Information used
Account information includes your email, screen name, date of birth, UK eligibility confirmation, password hash and acceptance of the Terms. Play information includes fictional-credit balances, recorded rounds, allocation requests, route choices, collected game stamps, preferences and confirmed play restrictions. Support messages include the topic, reply email, text, reference and relevant account identifier.
Essential security records include session-token hashes, anti-forgery values, request-limit events and network information. Ordinary web logs may include a path, time, response status, browser information and network address. Recovery tokens are stored as digests with a short expiry; the raw token is carried in your requested recovery link.
Why it is used
These records provide account access, enforce eligibility, keep one consistent fictional balance, restore interrupted requests, show your chosen route and investigate problems. Security records protect sessions and prevent repeated abusive requests. Confirmed breaks and exclusions need authoritative records so the restriction survives a device change.
Support and recovery
Support questions are recorded with a reference. A password reset uses a single-use link that expires after 30 minutes. Completing a reset invalidates earlier recovery tokens and account sessions. Recovery responses do not reveal whether an address belongs to an account. Do not send sensitive documents or passwords through support.
Service providers and choices
Transactional correspondence is designed for Brevo delivery, with ImprovMX forwarding to the monitored contact workflow when that transport is active. These services process addressing and message information needed for delivery. Optional measurement is controlled by Cookie Preferences; the essential service does not depend on accepting it. Independent external help sites apply their own policies once you leave Hachirowmaru.
Retention and protection
Accounts, security restrictions and recorded play are retained while needed to provide the service, enforce safety choices, resolve disputes or investigate misuse. Session cookies last up to 30 days; a guest-continuity cookie may last up to 180 days. Unused recovery tokens expire after 30 minutes. Request a retention explanation or erasure review through the concierge. Removing a login does not automatically cancel a safety restriction.
We use password hashing, restricted storage, encrypted transport where deployed on HTTPS, anti-forgery checks and transactional balance updates. No network service or device can be guaranteed completely secure.
Your rights
You can ask about access, correction, deletion, restriction, objection or portability where applicable, and withdraw optional measurement consent in Cookie Preferences. We may need proportionate evidence that a request concerns your own account. You can raise concerns with the UK Information Commissioner's Office at ico.org.uk. We do not intentionally invite minors to register; report suspected underage use through support.
Google Analytics 4
Google Analytics 4 is provided by Google. Its tag is installed with optional storage denied. Public-page measurement starts only after Analytics consent; private account, recovery and play pages are excluded. Optional _ga / _ga_* cookies can distinguish visits for up to two years. We do not send emails, birth dates, credentials, recovery tokens or game outcomes. Google may process pseudonymous usage information outside the UK under its applicable safeguards. Advertising storage, Signals and ad personalisation remain disabled.
Talk to the concierge
Use the Contact & Support form for a recorded reference, or contact concierge@hachirowmaru.com. Include a game title, approximate time or reference when relevant. Never send passwords, active recovery links, payment details or identity documents.