Privacy policy

Harem Master applies a strict data-minimisation principle: we only collect what is essential for the game to work.

Data controller contact: [email protected]

Data processed

• Account: email, identifier and data needed for login and account security, dates of acceptance of the terms of use and of the age attestation.
• Game: username, preferences, progress, collections, coins, listings, showcase, game statistics and activities related to the service, including the showcases of other players you view (counted for quests and achievements: a player only sees how many players have viewed their showcase, never who).
• Payments: plan, amount, status, provider reference (no banking data).
• Discord (optional): if you link your Discord account, its ID and username, to add you to our Discord server and give you the roles matching your account. No access token is kept. You can unlink your account at any time from the My account page.
• Reports: content of the report and optional email.
• Push notifications: if you enable notifications, a subscription identifier for your browser or device is stored to send you alerts. Delivery goes through your browser's notification service.
• Security: server logs, session identifiers, limited security and debugging information, technical logs (IP address) kept for up to 12 months.
• Origin of your visit: when you arrive through one of our campaign links (an ad, a post on a social network, a partner), the campaign concerned, the referring site, the country deduced from the IP address (the address itself is not stored), the type of device (mobile, tablet or computer) and the date, linked to your account if you sign up within 30 days. A random visitor identifier, used only to count unique visitors, is deleted after 13 months. This data is only used for aggregated statistics on our campaigns and is never shared.

What the data is used for

We use this data to:

• provide, secure and improve the Service;
• manage your account and the contractual relationship;
• enable social features;
• process payments and in-app purchases;
• send notifications if you consent;
• comply with our legal obligations and enforce our terms.

Age verification

Verification is carried out by an independent third-party provider under the “double anonymity” principle: the provider does not know which site you are visiting, and we only receive a result (“adult” or not). We collect no ID document, photo or date of birth.

Sensitive nature

Visiting an adult website may reveal information about one's sex life. That is why we use no advertising trackers without your consent and no third-party audience measurement (the only measurement, of visits from our campaign links, is carried out by us, in aggregated form: see Cookies), sell no data and share nothing with third parties other than strictly necessary processors (host, content delivery and site protection network, payment provider, email delivery, technical error monitoring), bound by contract under article 28 GDPR.

Processors and recipients

We use providers who process data on our behalf, including:

• Payment service provider: NOWPayments;
• Advertising networks: those listed on the Cookies page;
• Age verification provider (see Age verification);
• Host: see the legal notice;
• Content delivery network and protection of the site against attacks and bots: Cloudflare, through which requests to the Service pass (including the IP address) and which stores the illustrations;
• Technical error monitoring: Sentry, which receives error reports from which the IP address, cookies, email addresses and form contents are removed before sending.

These providers may process data outside your country or the European Economic Area, in particular in the United States. Such transfers are covered by appropriate safeguards (standard contractual clauses, supplementary measures) in accordance with the GDPR.

Retention periods

Account data is kept for as long as the account is active, then deleted or anonymised according to legal and operational time limits. An account inactive for 3 years is deleted after notice. Payment records are kept for 10 years in anonymised form. The visitor identifier of campaign links is deleted after 13 months; the rest of a visit's origin is then kept for statistics only, without identifier. When an account is deleted, it is detached from the visit that brought it and its visitor identifier is erased.

Your rights

Where the GDPR applies, you have the rights of access, rectification, erasure, restriction, objection and portability. Export and deletion are available self-service in your settings. For any other request: [email protected]. You may lodge a complaint with a data protection authority.

Minors

The Service is reserved for people aged at least 18 and of legal age in their country of residence. This condition is confirmed at sign-up. We do not knowingly collect data about minors; if we find that an account belongs to a person under 18, it will be deleted.

Changes

We may update this policy to reflect changes to the Service or to the law. The “last updated” date at the top of the page will be changed accordingly. We invite you to check this page regularly.