Privacy policy

1. Data controller

The controller is High Conversions S.r.l., [sede legale da completare], VAT no. [P.IVA da completare] (“we”). For any privacy question or to exercise your rights, write to [email protected].

2. What data we process

Battle.net account. You log in with Battle.net (Blizzard): we only receive your BattleTag (e.g. Name#1234) and the numeric ID of your Battle.net account. We don't receive your email or password.

Games. If you link the desktop app, after each game we upload the game log Hearthstone writes on your computer (cards played, turns, result, mode, deck used) and the analyses and reviews we derive from it. Before sending, the app removes your opponent's BattleTag. We only upload ranked games (Standard and Wild).

Desktop app. To link the app to your account we store a device identifier (an encrypted code), the operating system (Mac or Windows), the app version and the date it was last used. We don't store your computer's name. The app also sends us its technical status (Hearthstone found, logging on, number of games read or skipped, last error), so we can tell when something isn't working and help you.

Card collection. If you leave it on in the app (setting “Import my card collection”, on by default), outside matches the app reads from the game which cards you own and how many copies (normal, golden, diamond, signature) and sends them to us. We use them only to show you on the site how much dust each deck still costs you; we keep only the latest version.

Subscription. If you buy Premium, payment is handled by Stripe: we only keep the customer and subscription IDs, the plan and the renewal date. We never see or store your card details.

Coach feedback. If you rate a Coach verdict (thumbs up/down) we store the vote, the reason you picked and the text you write.

Technical data. When you visit the website or the app contacts our servers, our hosting and network providers record your IP address, date and time, the page requested and the browser or app type, for security, abuse prevention and troubleshooting.

Usage statistics. Only if you accept on the banner, Google Analytics collects browsing data (pages viewed, device, approximate country) with anonymised IP. Details in the cookie policy.

3. Why we process it and on what legal basis

Providing the service (account, game upload, tracker, Coach reviews, subscription): performance of a contract, Art. 6(1)(b) GDPR. Without your BattleTag and games the service cannot work.

Security, fraud and abuse prevention, usage limits and technical troubleshooting: legitimate interest in protecting the service, Art. 6(1)(f).

Improving the Coach: we use games and ratings in aggregated, anonymous form (meta statistics, quality of the verdicts). The statistics contain no BattleTag or data that identifies you: legitimate interest in improving the product, Art. 6(1)(f). You can object by writing to us.

Google Analytics statistics: your consent, Art. 6(1)(a), which you can withdraw at any time from “Cookie preferences”.

Legal obligations (tax and accounting for subscriptions): Art. 6(1)(c).

4. Automated reviews with artificial intelligence

Coach reviews are generated by artificial intelligence models from the game data. They only give you gameplay advice: they have no legal effects and do not significantly affect you (this is not automated decision-making under Art. 22 GDPR). The data sent to the models is the game data, without the opponent's BattleTag.

5. Who we share data with

We don't sell your data and don't use it for advertising. It is processed on our behalf, as processors (Art. 28 GDPR), only by the providers the service needs:

Railway Corp. — hosting of the website, database and file storage (servers in the European Union, Netherlands). Cloudflare, Inc. — content delivery network and attack protection. OpenRouter, Inc. and Anthropic, PBC — artificial intelligence models for the reviews. Google Ireland Ltd. — Google Analytics, only with your consent.

Independent controllers, with their own policies: Blizzard Entertainment (Battle.net login) and Stripe Payments Europe Ltd. (payments).

The desktop app downloads card images from HearthstoneJSON (art.hearthstonejson.com): as with any image on the internet, that service sees your IP address.

6. Transfers outside the European Union

Some providers (Cloudflare, OpenRouter, Anthropic, Google, Railway as a company) are based in the United States or may process data there. Transfers rely on the EU–US Data Privacy Framework, for certified companies, or on the standard contractual clauses approved by the European Commission (Art. 46 GDPR).

7. How long we keep it

Account, games, reviews and ratings: as long as you have the account. If you ask us to delete it, we erase this data within 30 days (backups are overwritten within a further 30 days).

Linked devices: as long as the link is active; you can unlink them at any time from the settings.

Card collection: only the latest one sent, as long as you have the account. Switching the setting off in the app stops sending it; write to us to delete the stored one.

Subscription data: for the length of the subscription and then 10 years for tax obligations (Art. 2220 of the Italian Civil Code).

Technical logs with IP address: normally no longer than 30 days.

Google Analytics: 14 months.

Aggregated, anonymous statistics are not personal data and may be kept indefinitely.

8. Your rights

At any time you can ask us to access your data, correct it, erase it, restrict its processing, receive it in a readable format (portability) and object to processing based on legitimate interest; you can withdraw consent to Google Analytics with no effect on the service. Write to [email protected]: we reply within one month.

You also have the right to lodge a complaint with a supervisory authority: in Italy the Garante per la protezione dei dati personali (www.garanteprivacy.it), or the authority of the country where you live or work.

9. Minors

HSMonk is meant for people aged 14 or over (the age of digital consent in Italy; it may differ in your country). If you are younger, you need the consent of the person with parental responsibility.

10. Security

Encrypted connections (HTTPS), restricted access to data, device tokens stored only as cryptographic hashes, no passwords kept by us. The desktop app reads Hearthstone's log file and, if you leave it on, your card collection from the game: read only, outside matches, changing nothing.

11. Changes

If we change this policy we update the date at the top; for significant changes we let you know on the website or in the app.