This policy explains what data God and Heroes collects when you use our website, chat, community, theatre, bookings, and any mobile app packaged from them — how we use it, who we share it with, how long we keep it, and the rights you have over it. God and Heroes is built on the genondemand platform; some processing is handled by our platform operator on our behalf.
God and Heroes ("we", "us", "our") operates the website at godandheroes.com and any mobile applications packaged from it. God and Heroes is built and hosted by Gen On Demand LLC, which acts as our data processor for hosting, database, and packaging services.
Data controller for God and Heroes: contactable at apps@genondemand.com until we publish a brand-specific address. For platform-level questions email us — see section 27.
This policy applies to:
godandheroes.com and any subdomains we operateIt does not apply to third-party sites we link to (section 23), payment processors that show you their own checkout, or third-party stores you download our app from.
localStorage, device identifier in the app (persistent per install)We do not intentionally collect sensitive personal information (race, religion, health, biometrics, precise geolocation, sexual orientation, government IDs). If you voluntarily include this in content you post, it becomes part of that content and is governed by our normal use + retention rules.
| Purpose | What it means |
|---|---|
| Deliver the service | Show you the pages, chat rooms, videos, bookings, and features you request. Sync your favorites, votes, and progress across devices. |
| Authenticate you | Log you in, keep you logged in, protect your account, prevent takeover. |
| Personalize | Show your name, your color, your favorites; surface content relevant to lobbies you joined. |
| Communicate with you | Transactional emails (welcome, receipts, password reset), support replies, in-app notifications you opted into. |
| Improve the platform | Understand which features are used, where errors occur, how long pages render, and use that to fix bugs. |
| Security + integrity | Detect spam, abuse, fraud, bot activity, account takeover, and enforce Terms of Service. |
| Legal + compliance | Respond to lawful requests, defend or bring legal claims, and comply with tax, export, and consumer-protection laws. |
| Business operations | Aggregate usage data (never identifying you individually) to inform product decisions and platform capacity planning. |
We do not use your personal information to train third-party AI models. We do not sell your personal information (section 18). We do not use your content for advertising outside God and Heroes.
For users in the EEA, UK, or Switzerland, we rely on the following bases under GDPR / UK-GDPR / Swiss FADP:
| Basis | When we use it |
|---|---|
| Contract (Art. 6(1)(b)) | Providing the service — accounts, chat, bookings, media playback. |
| Legitimate interest (Art. 6(1)(f)) | Fraud + abuse detection, product analytics, security logging, service-related emails. |
| Consent (Art. 6(1)(a)) | Non-essential cookies, marketing emails, push notifications, precise location if asked. |
| Legal obligation (Art. 6(1)(c)) | Tax records, responding to lawful requests, retention obligations. |
| Vital interest (Art. 6(1)(d)) | Rare — protecting life or safety in emergencies. |
You can withdraw consent at any time (section 27); doing so does not affect the lawfulness of processing before withdrawal.
| Category | Provider(s) | What they process |
|---|---|---|
| Hosting + CDN | Hetzner / Contabo / OVH / Cloudflare | All page and API traffic |
| Database | Airtable | Accounts, chat, tiers, bookings, favorites, shares |
| Workflow automation | n8n (self-hosted) | Business logic between endpoints + Airtable |
| Auth (optional) | Google / Apple / Facebook (OAuth) | Login identity verification |
| Payments | Stripe / Apple / Google Play Billing | Payment tokens, transaction records |
| Email delivery | Zoho / SendGrid / Postmark | Transactional + password-reset emails |
| Push notifications | FCM / APNS | Device tokens + notification payloads |
| Video playback | YouTube (embed) | Video ID + playback events (YouTube's own policy applies) |
| App analytics | Play Console + App Store Connect built-in only | Install / crash / retention aggregates |
| Category | Retention |
|---|---|
| Account records | While your account is active. Deleted within 30 days of account deletion, except records legally required. |
| Chat + community posts | While the community is live, unless you delete earlier. Anonymized on account deletion. |
| Bookings + payments | 7 years (tax + consumer-protection). |
| Server access logs | 90 days. |
| Crash + diagnostic logs | 30 days. |
| Marketing consent records | 3 years after last activity. |
| Support tickets | 2 years after resolution. |
Aggregated / de-identified data (that can no longer identify you) may be retained indefinitely.
No perfect security No online service can guarantee absolute security. If we ever suffer a security incident affecting your data, we will notify you and the relevant authorities as required by law (typically within 72 hours for EU / UK residents under GDPR).
Our servers are located in the European Union and the United States. If you access from another region, your data will be transferred to and processed in those locations. Where the transfer is from EEA / UK / Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs) or the UK International Data Transfer Addendum.
Request a copy of the transfer safeguards at apps@genondemand.com.
US-state residents with comprehensive privacy laws have the right to:
How to exercise: email apps@genondemand.com from the email on your account, or use the in-app "Delete my account" flow (Settings → Privacy). We respond within 45 days (extendable once by 45 days).
California Shine the Light (Civ. Code § 1798.83): we do not disclose personal information to third parties for their direct marketing purposes.
Exercise these at apps@genondemand.com. We respond within 30 days (extendable by 60 days for complex requests).
God and Heroes is not directed to children under 13 (or under 16 in some jurisdictions). We do not knowingly collect personal information from children under those ages. If we learn we have, we delete it promptly.
Parents / guardians who believe we have collected data from a child, contact apps@genondemand.com.
We respect the Global Privacy Control (GPC) signal in jurisdictions where it is legally recognized (California, Colorado, Connecticut) and treat it as an opt-out of sale + sharing — though we do neither anyway.
Because there is no industry consensus on Do Not Track (DNT), we do not currently respond to DNT signals differently.
No sale We do not sell your personal information for money. We do not "share" it for cross-context behavioral advertising as defined under California law. We do not rent, trade, or barter personal information.
God and Heroes does not show third-party advertisements or use tracking pixels or advertising SDKs from Meta, Google Ads, TikTok, or similar networks. Any sponsored content displayed will be clearly labeled.
We use only first-party analytics (usage counts + performance metrics stored in our own database) and the built-in aggregate analytics from Google Play Console + Apple App Store Connect. We do not use Google Analytics, Meta Pixel, Mixpanel, or similar third-party services.
If you enable notifications, we may send:
Turn off notifications from your device Settings or in-app Settings → Notifications. Transactional notifications required to deliver a service you requested will still be sent.
Content you post in public lobbies, threads, or profile pages is visible to other God and Heroes users. Do not post anything you wouldn't want public. You are responsible for the content you upload; see our Terms of Service for detail.
Delete your own content at any time. Deleted content is removed from public view immediately and purged from backups within 30 days, except where retention is legally required.
God and Heroes links to third-party websites (YouTube, social media, brand-partner sites). We are not responsible for their content or privacy practices. Their policies apply once you leave God and Heroes.
We do not use automated decision-making that produces legal or similarly significant effects on you. We do use automated systems to:
You can request human review of any account action taken against you (section 25).
First: email apps@genondemand.com. We take complaints seriously and try to resolve them promptly.
If you are not satisfied with our response, contact your local privacy regulator:
apps@genondemand.comsupport@genondemand.comFor EU / UK data-protection requests, mark your message "GDPR Request" and we will route it accordingly.
Response times: 30 days for GDPR (extendable by 60 days), 45 days for US state requests (extendable once by 45 days).