Privacy Policy

Who we are

This policy covers High Duel — the game and the websites at highduel.com and highnoonremake.com. "We" and "us" mean High Duel.

For any privacy question, or to ask us to delete something, write to [email protected].

Playing without an account

You can play as a guest. There is no form to fill in and we ask for no personal information at all — we hold a randomly generated identifier, which is not worked out from you or from your device, and your progress in the game.

Every guest shares the same in-game name, guests have no friends list and no messages, and a guest is never named on a public board. A guest record is deleted after a period without play. If you later create an account, your progress is carried across to it.

What we collect

Creating an account asks for a player name and a password. An email address is optional.

• Your player name, which other players can see, and any earlier names if you change it.
• Your password, stored in a form that cannot be read back.
• An email address, if you give one, used only for account email you have asked for.
• Your progress and play statistics — coins, level, guns, items, achievements, wins, losses and how far you got.
• Your character, held as a short list of numbers describing a drawn cowboy. There are no photographs and nowhere to upload one.
• Friends and friend requests, and the messages and short notes you send other players.
• Players you follow, and the players who follow you, so that the game can tell you when somebody you follow starts playing.
• Reports — if you report another player, or another player reports you, we record who reported whom, when, and the reason the reporter gave. See Safety records below.
• What you write to other players — messages, the notes sent after a duel, and tavern chat. A record is kept for safety, whether or not your account still exists. See Safety records below.
• A record of the devices signed in to your account, so that you can see them and sign any of them out.
• Sign-in settings — a linked Google account or two-step verification, if you turn them on. Two-step verification details are stored encrypted, and your recovery codes are stored in a form we cannot read.
• Purchases — if you buy Big Bucks in the app: which pack, when, the store's own reference for the transaction, and whether it was a test purchase. Never your payment details. See Buying things below.
• Your country — worked out from the address your connection comes from, and shown as a small flag on your player card. The country only: never the address itself, and nothing finer than the country. You can hide the flag on the account screen, and then it is shown to nobody.

We use this to run the game: to save your progress, to show the leaderboards, to let players duel and message each other, to keep accounts secure, to look into reports, and to answer support email. We do not sell personal information, we do not share it for advertising, and we do not profile you.

Your password

Passwords are stored in a form that cannot be reversed. We cannot read your password and we cannot recover it — a forgotten password can only be reset, never retrieved.

IP addresses

Your IP address reaches our servers with every request, as it does with any website. We use it only to protect the service — to limit abuse, password guessing and spam. IP addresses are not stored against your account, are not used to work out who you are, and are never used for advertising. The one thing read from the address is the country it belongs to, for the flag on your card — see What we collect — and only the country is kept.

Cookies and what is kept on your device

The game sets no cookies of its own. It stores a small amount of data on your device to keep you signed in, to remember your settings, and to draw your character without waiting on the network; signing out clears the data that identifies you. It also keeps a copy of its own files so that it can open offline, with no player information in it. Google's sign-in software, described below, may set cookies of its own on Google's domains rather than on ours.

Notifications

Notifications are off until you turn them on. If you do, we hold a delivery token for that device so that we can send you the alerts you asked for — a message, a friend request, a challenge, or a friend coming online. The token identifies a device to the notification service, not you to us, and it is never used for advertising.

You can turn notifications off again in the game or in your device settings, which removes the token. Apple's and Google's notification services carry the message on its way to your device.

Who else handles your data

We use a small number of established providers, each under its own privacy policy.

• Cloudflare — delivery and protection of our websites. Requests to the game pass through Cloudflare, which therefore handles your IP address and your traffic. Cloudflare may also count basic traffic on its own account, such as page views and countries; that is its measurement rather than ours, and it is not connected to your account or your progress.
• Google — Sign in with Google, if you choose to use it. The sign-in screen includes Google's own sign-in software, so Google receives the ordinary details any web request carries, including your IP address, from anyone who opens that screen, whether or not you use the button. If you do sign in with Google we keep the identifier Google gives us and the email address on your Google account; we never receive your Google password, and you can unlink Google at any time.
• Backup storage — encrypted copies, so that a hardware failure does not take everybody's progress with it. Backups are encrypted before they leave our systems, and whoever stores them holds no readable player information.
• Apple and Google, as notification services, if you turn notifications on. See Notifications above.
• Resend — email delivery. When the game sends you an account email, that provider handles your address and the message. No email address means no email.
• Stripe — payments on the website. When you buy Big Bucks on the website, Stripe's own page takes your card details and holds them; we are told that the payment happened and what it was for, and nothing else. Stripe's privacy policy covers what it keeps.
• Apple and Google, as app stores — if you install the game from one, or buy Big Bucks in it. They take the payment and hold the receipt. See Buying things below. On iPhone the game also asks Apple's App Store, when it starts, which version of High Duel is the newest, so it can tell you when there is an update to install. That request says nothing about you or your account; Apple sees only what any web request carries, such as your IP address.

We may also disclose information where the law requires it, or where it is necessary to protect the service and its players.

What other players can see

Your player name, your character, your wins and losses, roughly when you were last playing, and how far you got if you survive a night in the siege. Your level and your coins are public too: the leaderboards rank players by wins, by experience and by coins, and anyone can read them without signing in.

Your duel history and your achievements are public as well. Anyone can open another player's card and page back through the duels recorded there — when each one was, who it was against and who won — along with the running tally between those two players, and the badges that player has earned.

So is what you are doing right now. While you are playing, the game shows other players that you are online and roughly where you are in it — in a duel, in the store, facing a boss — and how long you have been playing. Some of that can be read without signing in at all.

Nothing else is public — not your email address, not your messages, not your friends list, not who you follow, not your device list, and not any previous name you have used.

What we do not collect

• No advertising network and no advertising identifier — see Adverts below.
• No analytics, telemetry or crash reporting of our own, beyond Cloudflare's traffic count described above.
• No cookies of our own, no tracking pixels and no fingerprinting.
• No location beyond the country your connection appears to be in, and nothing in the game reads GPS.
• No real name, date of birth, phone number or postal address — there is nowhere to enter one.
• No contacts, photos, camera or microphone. The game never asks for those permissions.
• No card numbers, bank details or billing addresses.

Safety records

If you report another player, or another player reports you, we keep a record of it — who reported whom, when, and the reason the reporter wrote. The reason is read by us and is never shown to the player it is about.

We keep a record of what players write to each other in the game — private messages, the short notes sent after a duel, and what is said in the tavern. It is written down as it is sent and kept for a limited period, then deleted. Records of reports are kept for longer.

These records are kept even if the account that wrote them is deleted. Closing an account is often the first thing that happens after somebody sends something they should not have, so deleting it would otherwise destroy the only account of what was said.

They are held apart from the game and no player can see them. They are used to look into harassment, threats and anything unlawful, and to answer a lawful request from the authorities — and for nothing else. Not for advertising, not for profiling, and not to build a picture of you.

How long we keep things

Deleting your account

Open the account screen and choose DELETE THIS ACCOUNT, confirming with your name and your password. Then:

• Every device is signed out straight away, including the one you are using.
• There is a grace period in which you can change your mind. Sign back in during that window and tap RESTORE MY ACCOUNT. Signing in on its own does not stop the clock.
• After that the account is permanently deleted, along with your progress, statistics, friends, messages and notes, including the copies held on other players' records.
• Your player name becomes available again once deletion completes. Everything addressed to you is removed from other players' records first, so a later holder of the name inherits none of your history, messages or friendships.
• Any virtual currency balance is lost and is not refundable.
• Any purchase records we are required to keep, for refunds, chargebacks and tax, remain with nothing left in them that points at you.
• Safety records are kept — reports made by you or about you, and the record of what you wrote to other players. They are removed from the game itself, but the safety record remains. See Safety records above.
• Encrypted backups taken beforehand may still exist for a limited period. They are never used to restore one person, and they are deleted automatically.

Guests need do nothing: stop playing and the record is deleted in due course. You can also write to [email protected] and ask us to delete your account, or to send you a copy of what we hold about you.

Adverts

There are no adverts in High Duel at present. We plan to add optional ones you can choose to watch in exchange for something in the game. Watching would always be a choice, and nothing would be shown to you unasked. An advert provider would collect its own information, including an advertising identifier, and would count what you watched. This page will name that provider and say what it collects before the first advert appears, and we will give notice in the game.

Buying things

Big Bucks are sold in the app, through the Apple App Store on iPhone and Google Play on Android, and on the website through Stripe. Whichever you buy from takes the payment, holds the receipt and handles any refund. No card number, bank detail or billing address reaches our servers. What reaches us is that provider's own proof that the purchase happened, which we check with them before anything is added to your balance. On the website the payment page is Stripe's, not ours.

We keep a record of each purchase — which pack, when, the store's reference for the transaction, and an internal account reference rather than your name — for refunds, chargebacks, fraud and tax. That record is kept even if the account is later closed, because a refund or a chargeback can arrive afterwards; once the account is gone, nothing in it points at you. Test purchases made by the stores' reviewers and testers are recorded the same way and marked as tests. The terms of sale are in the Terms of Service, and what happens to a balance when an account goes is on Delete Your Account.

Links out of the game

The game links to other services, such as Discord and the payment apps used for tips. Following one takes you to that company's own site, under its own privacy policy, and we send them nothing about you.

Children

High Duel is not intended for young children. You must be 13 or older to play or to create an account, and we do not knowingly collect information from anyone younger. If you believe a child under 13 has an account, write to [email protected] and it will be deleted.

Your choices

• Play as a guest and give us nothing at all.
• Create an account without an email address — it is optional and it will stay optional.
• From the account screen: remove your email address, unlink Google, turn two-step verification off, sign out any device, or delete your account and everything in it.
• Ask us by email for a copy of your data, or for it to be corrected or deleted.

Changes to this policy

If what we collect changes, this page changes with it and the date at the top moves. For anything significant — a new provider, a new kind of data, advertising, or anything to do with payment — we will also give notice in the game.