Privacy policy

Heel & Steel: Walking RPG Last updated: 14 November 2026

This policy explains what Heel & Steel keeps about you, why, who else handles it, and what you can do about it. It is written to be read, not skimmed past. If anything is unclear, write to support@heelandsteel.com.

Who is responsible

Heel & Steel is made by Albert Teiml, a sole trader in the Czech Republic (IČO 23781955, Ke Kapličce 523, 252 41 Dolní Břežany, Czech Republic). In this policy “we” means them. We are the data controller: the one responsible for your data under the EU’s General Data Protection Regulation (GDPR).

Contact for anything about your data: support@heelandsteel.com.

The short version

  • The game needs an account, your hero, and your step counts. That is most of what we keep.
  • Steps come from Apple Health and your iPhone’s motion sensor, only with your permission (the iPhone asks), and only the step count. We read nothing else from Apple Health, and we write nothing to it.
  • No ads, no tracking, no selling or sharing data for marketing. Ever.
  • You can download everything we keep (Settings > Download my data) and delete your account (Settings > Delete my hero and account) at any time.

What we keep, and why

Your account

  • What: an account ID made when you first open the game. If you save your hero with Apple or Google: the email address they give us (with Apple’s “Hide My Email”, that is a private relay address, not your real one) and which service you used. When you signed up and last signed in.
  • Why: to keep your hero yours, and to let you play it on a new phone.
  • Legal basis: running the game you asked to play (GDPR Article 6(1)(b), a contract).

We do not keep the name Apple or Google might share. You never give us a password.

Your hero and progress

  • What: your hero’s name, class, look, level, gold, items, quests, Cellar progress, Renown and brawl results.
  • Why: this is the game.
  • Legal basis: contract (Article 6(1)(b)).

Your steps

  • What: the number of steps you walk, as counted by Apple Health (from every source: your iPhone, a watch, fitness apps; steps you type in by hand are left out) and by the iPhone’s motion sensor. We keep: today’s total, the steps on your current quest, your weekly total for your pub table, and the steps you have walked on quests in all.
  • What we do not keep: where you walked, your route, your location, your heart rate, or any other Apple Health data. The game never asks for your location.
  • Why: steps are how the game is played. They complete quests, fill the brawl bank and count toward your table’s weekly round. We also check that step counts are humanly possible, so nobody can cheat their way up the leaderboard.
  • Legal basis: running the game you asked to play (contract, GDPR Article 6(1)(b)): the game is played by walking, so it cannot work without step counts. We use step counts only as game numbers and never draw conclusions from them about your health or fitness.

  • Your control: the iPhone asks your permission before the game can read any steps, and you can take it back at any time in Settings > Health > Data Access & Devices > Heel & Steel, and Settings > Privacy & Security > Motion & Fitness. Without it the game cannot count your steps.

  • Live view: when you start a walk with live view, the game runs an Apple Health workout session so it can follow your steps on the lock screen. The walk is not saved to Apple Health.

Apple Health data is never used for advertising or marketing, never sold, and never stored in iCloud.

Playing with others

  • What: your pub table, your role there, requests and invitations, chat messages, brawls you fought, your inbox, players you blocked, and reports you sent or that were made about you.
  • Why: to run the multiplayer parts of the game, and to keep the chat safe.
  • Legal basis: contract (Article 6(1)(b)) for playing together; our legitimate interest in a safe, fair game (Article 6(1)(f)) for reports, blocks and moderation.

What other players see: your hero’s name, look, level, class, gear, Renown, rank and pub table. Your steps are shown only to you and your tablemates. Chat messages are seen by the members of that table.

Technical data

  • What: when the app talks to our server, the server’s provider briefly logs the request, including your IP address and the app version.
  • Why: to keep the game running, find bugs and stop abuse.
  • Legal basis: legitimate interest (Article 6(1)(f)).

Notifications

  • What: if you allow notifications, your phone’s push address (made by Apple, passed on by Expo) and which notifications you switched on in Settings.
  • Why: so the server can tell you about join requests, invitations, your table’s weekly round and brawls, only the ones you switched on. Quest complete, brawl ready and “a new day” are sent by your phone itself and need nothing from the server.
  • Legal basis: contract (Article 6(1)(b)). Switch them off in Settings > Notifications, or for the whole game in the iPhone’s Settings.

On your phone only

Your settings, a copy of your game (so it works offline), which tips you have seen, and the numbers the home-screen widget shows (today’s steps and your quest) are stored on your iPhone and never leave it, except the game copy, which is the same as on the server.

What we do not do

  • No advertising, no ad networks, no tracking across apps or websites, no selling data.
  • No profiling and no decisions about you that have legal or similar effects. Matching brawl opponents by level and Renown and the step plausibility check are part of the game, nothing more.

Who else handles your data

We use a few companies to run the game. They handle data only on our instructions, under data processing agreements.

Who What for Where
Supabase Inc. The game server and database Servers in Frankfurt, Germany (EU)
Apple The App Store, TestFlight, Sign in with Apple, notifications Apple’s own policy applies
Google Sign in with Google Google’s own policy applies
Expo (650 Industries, Inc.) Building the app, delivering app updates and passing on push notifications United States
GitHub, Inc. Hosting this website United States

Some of these companies are based in the United States. Where your data leaves the EU, the transfer is covered by the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

How long we keep it

  • Your account, hero and progress: until you delete your account, or until nobody has played the hero for 2 years: then the account and everything in it are deleted.
  • Chat messages: while the pub table exists. Deleting your account deletes your messages; a table’s messages go when the table closes.
  • Reports: up to 12 months after they are handled, so repeated problems can be spotted.
  • Server logs: a few days, as the provider keeps them.
  • Backups: the server’s backups are kept for up to 7 days, so deleted data is fully gone within 7 days.

Your rights

You can, at any time:

  • Get a copy of everything we keep about you: Settings > Download my data, or write to us.
  • Correct something that is wrong: write to us. (A hero’s name or look can be changed only through support.)
  • Delete your account and data: Settings > Delete my hero and account. If you no longer have the app, write to us from the email address your account uses, or tell us your hero’s name.
  • Stop the game reading steps, in the iPhone’s settings (see “Your steps”).
  • Object to what we do on the basis of legitimate interest, or ask us to restrict it.
  • Take your data elsewhere: Download my data gives you a standard, machine-readable file.

We answer within one month. It is free.

You can also complain to a data protection authority. In the Czech Republic that is the Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz. You can also go to the authority where you live. We would rather hear from you first, though, and try to fix it.

Children

Heel & Steel is for players aged 13 and over. We do not knowingly keep data about children under 13; if you think one is playing, write to us and we will delete the account. If you are a parent and have questions about your child’s account, write to us.

Security

Data travels encrypted, the server lets each player touch only their own game, and only we can reach the database. No system is perfect: if a breach ever puts your data at risk, we will tell you and the authorities as the law requires.

Changes

If this policy changes in a way that matters, we will say so in the game before the change applies. The date at the top shows the latest version.