My Hero TellerPrivacy policy
Version of 15 October 2026
This page explains which personal data the My Hero Teller app and the my-hero-teller.com website process, why, for how long, and how to exercise your rights. This is a translation: the French version prevails.
1. Data controller
The data controller is GKUENY CONSEIL, a French limited liability company (SARL) with a share capital of €1,000, registered under SIREN number 983 270 182, whose registered office is at Villa 1, 239 rue des Sycomores, 34170 Castelnau-le-Lez, France.
For any question about your data: contact@my-hero-teller.com.
2. Data processed, purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Create and manage your player account, sign you in | Email address; password, stored as a hash; if you sign in with Google or Apple, the identifier the provider gives you and the verified email address it sends (with Apple, a token used to revoke the authorisation when the account is deleted); app language; creation, update and last sign-in dates; sign-in tokens of each device | Performance of the contract (terms of use) |
| Manage invitation-only early access | Invited email address, invitation code, date the code was used, books the invitation opens | Performance of the contract |
| Back up your games and sync them between your devices | Progress in the books, characters and hero names, notebook notes, drawn maps, game settings, name of the device that wrote the backup (for example "Camille's iPhone") | Performance of the contract |
| Send you the service emails (welcome, password reset) | Email address, language | Performance of the contract |
| Check that these emails are delivered | Recipient, subject and content of the email sent (the reset link is masked), delivery statuses | Legitimate interest: making sure the emails the account needs are delivered |
| Beta reading of a book in progress | Nickname you choose, feedback you write, scene concerned | Performance of the contract |
| Audience measurement and session recording, to understand how the app is used and improve it | Account identifier and email address, installation identifier, platform, app version, language; screens viewed, game actions and taps; session recordings (replay of what is shown on screen, personal fields masked) and technical logs of the app | Consent |
| Detect and fix crashes and errors | Technical error reports: error message, device model, operating system, app version, screens visited. No account identifier is attached | Legitimate interest: keeping the app working |
| Offer app updates | Device operating system, random tokens that tell whether an update was downloaded | Legitimate interest: delivering fixes |
| Protect the service against abuse (repeated sign-in attempts, mass sign-ups) | IP address, used as a temporary counter | Legitimate interest: securing the service |
| Manage the accounts of authors and reviewers of the writing Studio (invitation only) | Email address, nickname, role, language, password (hash), creation and last sign-in dates, use of the writing assistant | Performance of the contract |
3. Required data
Only the email address, with a password or a Google or Apple sign-in, is needed to create an account. Without it, the account cannot be created. The other data come from your use of the app.
4. Recipients
The data are processed by the authorised staff of GKUENY CONSEIL. Studio administrators can see the sync status of an account: email address, device names, a summary of each game (book, hero name, progress, ending reached) and storage used, never the content of the backups. Beta-reading feedback is read by the author of the book and the reviewers they invite.
The following providers process data on our behalf:
- OVH SAS (France): hosting of the server and database.
- Resend (United States): sending emails.
- PostHog (European instance, hosted in Frankfurt, Germany): audience measurement and session recording.
- Sentry (Functional Software, Inc., United States): error reports.
- Expo (650 Industries, Inc., United States): delivery of app updates.
If you choose to sign in with Google or Apple, the sign-in goes through their service, under their own privacy policy; we only receive the identifier and email address described above.
Your data are neither sold nor used for advertising.
5. Retention periods
- Player account and saved games: until the account is deleted, and at most 2 years after your last sign-in.
- Older versions of a backup, set aside during a sync: 5 days.
- Sign-in tokens of a device: 30 days, renewed on each use; deleted when the device signs out.
- Password reset link: 1 hour.
- Tracking of sent emails: 90 days.
- Audience measurement and session recordings: until the account is deleted, which erases them at PostHog.
- Beta-reading nickname and feedback: as long as the book concerned exists. They are not linked to your account.
- IP address used against abuse: for the counting window, 15 minutes at most.
- Studio accounts: as long as the account exists.
6. Transfers outside the European Union
Resend, Sentry and Expo are based in the United States. These companies are certified under the EU-U.S. Data Privacy Framework, found adequate by the European Commission decision of 10 July 2023. The other providers process data within the European Union.
7. Security
Exchanges between the app and the server are encrypted (HTTPS). Passwords are never stored in clear text, only their hash, and the reset link is only kept as a hash. Automatic backup of the app by the Android system is disabled.
8. Data kept on your device
The app keeps on your device your games, the books downloaded to play offline, your preferences (language, theme) and your session cookie. When the account is deleted, it erases these data, except the language and theme. The app asks for no access to the camera, location or contacts, and does no advertising tracking.
9. Your rights
Under the French Data Protection Act (loi n° 78-17 du 6 janvier 1978) and Regulation (EU) 2016/679 (GDPR), in particular its Articles 15 and following, you have, depending on the case, the rights of access, rectification, erasure and portability of your data, and the rights to restriction and objection. You can withdraw your consent to audience measurement at any time. You can also set instructions on what happens to your data after your death.
To exercise these rights, write to contact@my-hero-teller.com.
Delete your account
In the app: Account, then Delete my account, with your password or a new Google or Apple sign-in. You can also request it by email at contact@my-hero-teller.com, from the account's address.
Deletion is immediate and final: account, synced games, sign-in tokens of all your devices, invitation access, audience measurement data and session recordings. An Apple sign-in has its authorisation revoked. Only beta-reading feedback, which is not linked to the account, and the tracking of emails already sent, erased after 90 days, remain.
Minors
Under Article 45 of the French Data Protection Act, a minor under 15 cannot consent alone to audience measurement: consent must be given jointly by the minor and the holder or holders of parental authority.
10. Complaints
You can at any time contact the Commission nationale de l'informatique et des libertés (CNIL), the French supervisory authority, and lodge a complaint by writing to CNIL – 3 place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07, France, or online at www.cnil.fr/plaintes.
11. Changes
This policy may change with the app. The date of the current version is shown at the top of the page.