Privacy policy

This policy explains what information HeistBase (heistbase.com) handles when you visit, and what choices you have. In short: the database pages have no accounts and set no cookies, our analytics are anonymous, and ads come from Google AdSense, which asks for your consent where the law requires it. If you play our browser game HEAT at heistbase.com/play, you create an account, and the HEAT section below explains what that involves.

Who is responsible

HeistBase is an independent fan project run by an individual based in Sweden, who is the data controller for this site. You can reach us at contact@heistbase.com.

What we collect

• Nothing that identifies you on the database pages. They have no accounts, comments or forms. Accounts exist only for the HEAT game (below).
• Anonymous analytics. We use Vercel Web Analytics to count page views. It uses no cookies. Each data point holds the page, the referring site, an approximate location (country, region, city), and your browser, operating system and device type. Visits are grouped by a hash of the request that is discarded after 24 hours, so we can't identify you or follow you across other sites.
• How the database is used. We count a few anonymous actions on the database pages: searches (the words searched and how many results came back), crime calculator runs (which crime), hover cards opened, and clicks on “Play HEAT”. These rows hold no IP address, cookie or account, so they can't be tied to you. Don't type personal details into the search box.
• Server logs. The site is hosted by Vercel. Like any web server, it processes your IP address and request details to deliver pages and protect the service from abuse.
• Emails you send us. Mail to contact@heistbase.com is forwarded by ImprovMX to our inbox. We use it only to reply, and we delete it when it's no longer needed.

Fonts and pictures are served from heistbase.com itself, so viewing the site doesn't send requests to font or map companies.

Advertising (Google AdSense)

Ads on HeistBase are provided by Google AdSense. Google and its partners use cookies and similar technologies to show ads, limit how often you see them, measure their performance and, if you allow it, personalise them based on your visits to this and other websites.

• If you visit from the EEA, the UK or Switzerland, Google shows a consent message on your first visit. Personalised ads are only shown if you agree, and you can change your choice at any time using the privacy settings link from that message.
• You can manage or turn off personalised ads from Google at My Ad Center, and from many other ad companies at youronlinechoices.eu.
• Read how Google uses information from sites that use its services.

HEAT game accounts (heistbase.com/play)

HEAT is a free browser game for players aged 18 and over. To play, you create an account. We then handle:

• Your account: username, email address and password, and the date you confirmed you are 18 or older. Sign-up, login, email confirmation and password resets run on Supabase Auth; your password is stored only as a hash.
• Your game: your character (street name, starter and colours) and everything you do in the game: crimes, results, money, cars, jail time, bust-outs and settings. Other players can see your street name, rank and the public events in the 24-hour feed and the Hall of Fame. Hall of Fame entries are kept after a season ends.
• Chat: messages you post in The Flamingo are visible to other players and are kept so we can handle reports. If you report a message, we store who reported it.
• Cookies: the game sets a cookie that remembers you confirmed your age, and Supabase sets cookies that keep you logged in. Both are needed for the game to work. New chat messages reach your browser through Supabase Realtime.
• How the game is used: we log some actions with your character (sessions, store visits and purchases, chat sent, paint orders, bank moves) to see which parts of the game work. Nothing in the game reads them.
• Fair play: we use the game logs to spot cheating, bots and abuse, and may mute or ban accounts that break the rules.

To delete your HEAT account and game data, email contact@heistbase.com from the address you signed up with. Your street name may stay in a past season's Hall of Fame unless you ask us to remove it.

Legal basis

Analytics, hosting logs and replying to email rely on our legitimate interest in running and improving the site. A HEAT account and its game data are needed to provide the game you signed up for (contract). Moderation and fair-play checks rely on our legitimate interest in a safe, fair game. Advertising cookies and personalised ads rely on your consent where it is required.

Who receives data

Only the service providers named above: Vercel (hosting and analytics), Supabase (HEAT accounts, game database and chat delivery), Google (advertising) and ImprovMX (email forwarding). Some of them may process data outside the EU under the safeguards they provide, such as standard contractual clauses. We don't sell personal data.

Your rights

You can ask for access to, correction or deletion of personal data about you, ask us to restrict or stop processing it, and withdraw consent at any time. Email contact@heistbase.com. You can also complain to the Swedish Authority for Privacy Protection (IMY) or your local data protection authority.

Children

HEAT is a game for adults, and HeistBase is not directed at children under 13. We don't knowingly collect information from them. HEAT accounts are for people aged 18 or over only.

Changes

If this policy changes, the new version will be posted here with a new date. See also About and Contact.