Privacy
Last updated: 2026-10-04. HoyoBuild is a non-commercial fan site. We collect the bare minimum of data, only to run the site: no advertising, no trackers, no data selling, in line with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
1. Data controller
The publisher of hoyobuild.com, a private individual acting on a non-professional basis (see the legal notice). Contact for any question or request about your data: contact@hoyobuild.com.
2. Data, purposes and legal bases
| Data | Why | Legal basis |
|---|---|---|
| Account: username, email address, password (hashed, never stored in clear text), two-factor authentication if you turn it on (encrypted key, hashed recovery codes), avatar, bio, favorite game, language, sign-up and last login dates | Create and manage your account, authenticate you | Performance of the terms of use (art. 6.1.b) |
| Published content: builds (image, texts, optional in-game UID), comments, likes, reports | Community features, moderation | Performance of the terms of use (art. 6.1.b) |
| Service emails: address confirmation, forgotten password, address change, notice before deletion for inactivity | Secure and manage your account (no marketing email) | Performance of the terms of use (art. 6.1.b) |
| News newsletter (optional): games followed, frequency, language, subscription date and date of the last email; sent to your account's email address | Send you the new posts and redeem codes of the games you chose. No tracking in the emails (no tracking pixel, no tracked links) | Consent (art. 6.1.a), withdrawable anytime in one click |
| Anti-abuse: hashed fingerprint of the IP address or account id, attempt counter | Limit login attempts, spam and abuse | Legitimate interest: site security (art. 6.1.f) |
| Daily guess: your guesses, hints used, number of attempts and solving time, tied to your account (or, without an account, to a random session id) | Validate games server-side (anti-cheat), daily stats, player rankings | Performance of the terms of use (art. 6.1.b) |
| "Will you pull?" polls: your choice and goal for each character | Show the community's intentions (only totals are public, never who voted what) | Performance of the terms of use (art. 6.1.b) |
| Tool backup (logged-in members): the state of your tools (simulated pulls, tier lists, teams, planners…) | Get your tools back on all your devices | Performance of the terms of use (art. 6.1.b) |
| Shared tier lists: the content of the tier list you share and, when logged in, your username shown with a link to your profile | Let others see it through the share link | Performance of the terms of use (art. 6.1.b) |
| Technical logs kept by the host: IP address, date, requested page, browser | Security, troubleshooting, host's legal obligations | Legal obligation (art. 6.1.c) and legitimate interest |
We do no profiling, no targeted advertising and no third-party analytics. Data is never sold or rented.
3. What is public
Your username, avatar, bio, favorite game, builds and comments are visible to everyone on the site. Your email address is never shown.
If you play the daily guess while logged in, your username, avatar and results (attempts, time, points) appear in the public rankings. You can opt out at any time in your account settings ("Show me in the rankings").
4. Recipients and hosting
Data is only accessible to the site team (administration and moderation). Our only processor is OVH SAS (website, database and email hosting), whose servers are located in France. No data is transferred outside the European Union: fonts, images and scripts are served from our own servers, with no call to Google, a CDN or a social network.
5. Retention periods
| Data | Period |
|---|---|
| Active account and its content | As long as you use your account. You can delete it at any time. |
| Inactive account | Deleted with its content after 3 years without login, following a warning email sent 30 days before. |
| Account whose address was never confirmed | Deleted automatically after 30 days. |
| Comment you delete | Erased immediately (not merely hidden). |
| Links sent by email | 1 hour (password), 24 hours (address change), 48 hours (confirmation), single use. |
| "Keep me logged in" | 60 days at most, revoked on logout or password change. |
| Anti-abuse data | For the rate-limit window (1 hour at most), then purged. |
| Daily guess games | 90 days (monthly rankings only use the current month). |
| Tool backup, poll votes, shared tier lists | As long as your account exists; deleted with it. Tier lists shared without an account: deleted after a year without views. |
| Newsletter subscription | Until you unsubscribe (link at the bottom of every email, or account settings) or delete your account: the subscription details are then erased. |
| Reports | Kept for moderation history; detached from your account if you delete it. |
| Host technical logs | 1 year (host's legal obligation). |
6. Cookies and local storage
The site only uses strictly necessary cookies. They are exempt from consent (article 82 of the French Data Protection Act), which is why no cookie banner is shown.
| Name | Purpose | Duration |
|---|---|---|
hb_sess | Session: login, form protection (CSRF), messages | End of browsing session |
hb_remember | "Keep me logged in", only if you tick the box | 60 days |
hb_lang | Remembers the chosen language (French / English) | 12 months |
The tools (wish simulator, tier list, planner, daily guess…) save your progress and settings in your browser's local storage (hb:… keys). Without an account, that data stays on your device and is never sent to us. When you are logged in, it is also backed up to your account so it follows you across devices (see the table above); it is part of your data export and deleted with your account.
7. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to set instructions for what happens to your data after your death. Most of them are self-service from your account settings:
- Rectification: edit your profile, email address and password.
- Access and portability: "Download my data" gives a complete copy as JSON.
- Withdrawing consent: unsubscribe from the newsletter in your settings or with the link in every email.
- Erasure: "Delete my account" immediately erases your account, builds (including images), comments and likes.
For any other request, write to contact@hoyobuild.com: we answer within one month at most. If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL, or with your local authority.
8. Security
Encrypted connection (HTTPS), email addresses encrypted in our database (the key is kept separately: a copy of the database alone reveals no address), passwords hashed with a suitable algorithm, email links and login tokens stored as fingerprints only, rate limiting, cross-site request forgery (CSRF) protection. Uploaded images are re-encoded by our servers: their metadata (device, GPS position…) is removed.
9. Minors
Accounts may be created from the age of 15. Below that age, the consent of a holder of parental authority is required. A parent can ask for their child's account to be deleted at the contact address.
10. Changes
This policy may change, for instance when a feature is added. The last update date is shown at the top of the page; members will be informed of any significant change.