Privacy Policy.

Effective from October 11, 2026.

This is a translation. In case of any discrepancy, the Ukrainian version prevails.

HUC (Heroic United Community) is a Ukrainian community of Heroes of Might and Magic 3 and Warcraft 3 players. The website runs on the huc.com.ua domain. Learn more about us on the “About us” page.

Questions about the processing of personal data can be sent via the “Feedback” page.

Account data (provided by you when signing up):

• —Email. Used for login, password recovery and email change. Not shown publicly.
• —Nickname. Unique, shown publicly.
• —Password. Stored only as a cryptographic hash (bcrypt). No one, including the administration, can read it.

Profile data (optional):

• —Avatar, “about me” text, links to social networks (Twitch, YouTube, Discord, Telegram, Instagram, Facebook), auto-avatar color.

Game profile data (for the Player role):

• —Lobby name (your nickname in the HotA lobby) — public information, synchronized with hotameta.com.
• —Cached statistics and match history: rating, number of games, wins, win rate, recent matches, opponents. Used on the rating, profile and player comparison pages, as well as in the comparison block on tournament event pages (the comparison is visible only to registered users).

Applications:

• —Player application: the lobby name and proof (text or a screenshot) that it belongs to you.
• —Organizer application: a free-form description of the tournament and your experience.
• —The moderator’s decision and their comment on the application.

Tournaments and events:

• —Tournament registration — your nickname is added to the public list of participants and the bracket.
• —Match results, scores, technical defeats and their reasons, links to recordings (VODs) and save files added by participants or the organizer.
• —For organizers — Telegram/Discord contacts, if you have provided them in the tournament card (shown publicly).
• —Events — match broadcasts and show matches: if you are listed as a player or caster of an event, your nickname and avatar are shown publicly on the event page, in the events calendar and on the home page.

Activity data:

• —News and templates you publish (for the relevant roles).
• —Comments, replies, reactions to news and comments.
• —Ratings of other users (karma). We store who rated whom to prevent repeated votes; only the total is visible publicly.
• —Notifications: replies, mentions, decisions on applications, tournament events.

Feedback:

• —The name, contact and message text from the “Feedback” form; if you are logged in, also your nickname. Messages are delivered to a private Telegram chat of the administration and are not stored in the website’s database.

Technical data:

• —Authorization cookies (an httpOnly refresh token and a session indicator) — see the section below.
• —A counter of failed login attempts and the time of a temporary login lock — protection against password brute-forcing.
• —IP address — kept only in the server’s memory to rate-limit requests (login, sign-up, password reset, contact form). It is not written to the database.
• —Standard access logs of our hosting (IP, user agent), kept by the provider for a limited time.
• —Anonymous analytics data from Vercel Analytics (page views, without identifying the user).

• —Authorization (cookie refreshToken, httpOnly, up to 90 days). Lets you stay logged in without entering your password again.
• —Session state (cookie hasSession, up to 90 days). An indicator that you are logged in, without any sensitive data.
• —Site language (cookie NEXT_LOCALE, up to 1 year). Remembers the language you picked in the switcher (Ukrainian, English or Polish) so the site opens in it next time. Only the language code is stored, nothing about you.
• —Overlay settings (localStorage, key overlay-configurator). The configurator on the “Overlay” page remembers the lobby nickname you entered and the banner settings, so you don’t have to enter them every time. This data stays only in your browser, is not sent to the server and is erased together with the site data in your browser settings.
• —Color theme (localStorage, key huc-theme). Remembers the theme you picked in the switcher in the header or in the mobile menu (“Graphite”, “Flame”, “Cobalt” or “Emerald”), so the site opens in it even after a reload. Only the theme name is stored, without any data about you. It stays only in your browser, is not sent to the server and is erased together with the site data in your browser settings; without it, the site shows the default theme.

We do not use advertising or tracking cookies of third-party networks and do not show a cookie banner, since all cookies are strictly technical.

• —Authorization and operation of your account.
• —Showing your profile, statistics and content to other members, including in the site search: your profile can be found by nickname, lobby name and Twitch nickname, and tournaments by the nickname of the organizer or a participant.
• —Running tournaments: participant lists, brackets, results, notifications to organizers and players.
• —Transactional emails: password reset, email change confirmation. We do not send marketing emails.
• —Moderation and security (request rate limiting, protection against password brute-forcing, detection of malicious activity).
• —Replying to requests sent via the feedback form.
• —Aggregated traffic analytics, without personal data.

Each provider receives only the data required for a specific function:

• —Vercel — website hosting, access logs, anonymous analytics.
• —Neon — the PostgreSQL database where accounts and content are stored.
• —Cloudinary — image storage: avatars, screenshots for applications, covers of news, events, tournaments and templates.
• —Resend — delivery of transactional emails (the recipient’s email and nickname).
• —Telegram — messages from the feedback form are delivered to a private chat of the administration via the Telegram Bot API.
• —hotameta.com — player statistics; only the lobby nickname is sent for synchronization. On the “Overlay” page (the preview in the configurator and the OBS widget itself), your browser connects to hotameta.com directly, so hotameta sees your IP address just like any website you visit.
• —Twitch API — the team’s list of streamers, stream statuses, clips, public channel statistics (stored for the “Numbers” page). No data of the website’s users is sent there.
• —YouTube / Google — videos embedded in news and on tournament pages (the standard YouTube player may set its own cookies), public RSS feeds of channels, as well as a public Google Sheet with New Heroes tournament data (read-only).
• —flagcdn.com — flag images on the “Numbers” page; like any CDN, it sees the IP address when the image is loaded.
• —Monobank — we read the balance and statement of the official HUC jar to show the fundraiser progress and the top donors. Names are taken from the statement and shown in shortened form (first name and the first letter of the last name) together with the amount. Anonymous donations remain anonymous. If you have donated and don’t want your name shown on the site, write to us and we will hide it.

We do not sell your data to third parties and do not use it for advertising.

Some information on the site concerns people without an account: public profiles and statistics of the team’s streamers from Twitch, player nicknames from hotameta.com, as well as “ghost” participants — records with a nickname and lobby name that members with the Player role can create to add a person without a HUC account to a tournament. This is public game information without contact details. If this is about you and you want to link such a record to your account, correct it or remove it, write to us.

• —Passwords are stored only as a bcrypt hash.
• —Connections are protected by HTTPS with enforced encryption (HSTS).
• —Sensitive operations are rate-limited; after a series of failed login attempts, logging in to the account is temporarily blocked.
• —Email is not shown on public profiles and is not returned to other users via the API.
• —Access tokens live in the browser’s memory and are not written to localStorage.

• —Account data — as long as your profile exists.
• —Authorization tokens — up to 90 days; password reset and email change tokens are single-use and short-lived.
• —Deleted comments are hidden, but the text remains in the database for moderation purposes (for example, reviewing complaints).
• —Tournament results and match history are kept as the community archive.
• —Data of blocked accounts is kept in case an appeal is reviewed.
• —Messages from the feedback form are kept only in the administration’s Telegram chat.

• —Access and editing. View and change your data in your profile settings.
• —Changing email and password. Via the account settings, with confirmation.
• —Requesting a copy of your data. Contact us and we will provide your data in a machine-readable format.
• —Account deletion. There is no self-deletion button yet — write to us via the feedback form from your account or from the email it is registered with, and we will delete the account. Comments and results of tournaments you took part in may remain in anonymized form so as not to break discussions and brackets.
• —Objection. Ask us to remove your name from the top donors or to correct a “ghost” record about you.

The site is intended for users aged 13 and over. We do not collect dates of birth and rely on your confirmation when signing up. If you find out that an account was created by a younger child, write to us and we will delete it.

We may change this policy — for example, when we add new features or switch to a new data processor. The current version is always here, with the effective date at the top of the page. We will announce significant changes on the site.

All questions about the processing of personal data go through the “Feedback” page. We reply within a reasonable time.