Privacy, in plain language
Privacy Policy
Effective September 22, 2026 · Last updated September 22, 2026
1. Introduction
Build Heartopia is a fan-made guide, item database, and community resource for Heartopia. It is not affiliated with, endorsed, sponsored, or specifically approved by XD Entertainment Co., Ltd. This policy applies to build-heartopia.com.
2. Information visitors provide
You can browse without an account. The feedback form accepts a report type, title, details, and optional bug or error steps. It does not request a name or email address. Do not include sensitive personal information in free text.
3. Bug reports, feedback, and suggestions
Submitting the form creates a private ticket containing your text, a random submission key, page or catalog context, and available browser and device diagnostics. Diagnostics include browser, platform, languages, timezone, device and screen details, connection state, accessibility preferences, cookie-capability status, and a same-site source page. The form has no file upload and cannot send a reply.
4. Information collected automatically
Web-server and hosting infrastructure may receive routine request data such as IP address, time, requested URL, status, referrer, and user-agent. When feedback is submitted, the application converts the request IP address to a keyed one-way hash for abuse controls.
Build Heartopia uses first-party aggregate statistics to improve its content and features. The browser sends fixed counters for page views, settled searches, search-result selections, filters, sorting, and supported feature actions. Counters may include the public page, item, or collection involved and a result-count or position range. Search text is sent only when its normalized form exactly matches a vocabulary generated from public catalog names; other search text is omitted, while the search and its result-count range can still be counted. The vocabulary is not learned from visitors' searches.
These statistics do not create visitor, device, or session identifiers, store individual event histories, or connect activity into a person's browsing history. The service increments daily totals rather than saving individual events. It does not estimate unique or returning visitors. The server necessarily receives network information to handle requests; separate hosting and security logs may have different contents.
Ordinary requests needed to deliver the site also contribute daily counts by known public page or content category, response status, response-time and response-size ranges. Standard request headers are reduced to broad source, device, browser, operating-system, and traffic categories; the statistics log does not retain the original headers, IP addresses, full URLs, query strings, cookies, or request bodies. These request totals can include automation, retries, prefetching, and downloads. A browser-like category is not proof of a human visit.
Build Heartopia does not use advertising pixels, session replay, cross-site tracking, fingerprinting, or individual visitor profiles. Scroll-depth tracking, engagement timers, and browser performance measurements are not enabled in this analytics design. Statistics are used to improve this website, not to advertise to individuals. Catalog data and images are fetched from the same Build Heartopia origin.
5. Browser storage, favorites, and collection checklists
Favorites are item IDs stored in localStorage under build-heartopia:guest-favorites:v1. Collection-checklist progress is stored under build-heartopia:collection-checklists:v1 as collection keys and checked item IDs. The saved lists and checklist progress stay on your device and are not uploaded. Supported actions on a public item can increment aggregate counters without an identifier or saved-list contents. Checklist images are created in your browser and are shared or downloaded only when you choose those actions. Search and filter state is not kept as saved search history.
7. How information is used
Information is used to deliver the site, save favorites and collection-checklist progress locally, review feedback, diagnose problems, understand which public content, searches and features are used, identify unsuccessful searches, and diagnose errors or slow responses using aggregate counts, limit abusive submissions, and protect and improve Build Heartopia.
8. Third-party service providers
Build Heartopia is operated by an individual in Ohio, United States, as a general English-language fan site. Statistics are first-party and are not sent to an analytics vendor. Hosting infrastructure delivers the website and operates its private feedback and statistics services; hosting providers may process routine network information separately.
Quicksand loads from Google Fonts, so your browser sends Google normal HTTP request metadata. Google states that Google Fonts requests are unauthenticated, do not set or log cookies, and do not log IP addresses. No active CAPTCHA, email, upload, advertising, social-widget, or embedded-video provider was found.
9. Data retention
Favorites and checklist progress remain until removed or browser data is cleared. The feedback service has no automatic deletion schedule for tickets, diagnostics, submission keys, or the IP-derived hash stored with a ticket; those records remain until manually removed. Separate rate-limit attempts are pruned after 48 hours as later submissions are processed. New statistics are stored as daily aggregate counts. Earlier analytics records, if retained, contain rotating pseudonymous identifiers and are kept separate; this change does not delete them. The statistics software supports an explicitly selected retention cutoff, but its presence does not establish a running deletion schedule. Server-log, historical-record, and backup retention depend on the deployed operating configuration. Server-log and backup retention is not confirmed.
10. Data sharing
Feedback tickets and statistics reports are private. Information is handled by the site operator and infrastructure needed to host and secure Build Heartopia. Reports require authenticated access. Google receives ordinary request metadata when it serves the site's font; submitted feedback and analytics events are not sent to Google.
Information may be disclosed when reasonably necessary to comply with law, protect people or the site, investigate abuse, or complete a service transfer.
11. Sale and targeted advertising
Build Heartopia does not sell or rent personal information, use submitted feedback for targeted advertising, show ads, build advertising profiles, or track visitors across unrelated websites.
12. Data security
Build Heartopia uses HTTPS, validated same-origin submissions, request-size limits, authenticated private reports, and restricted server-side databases outside the public web root. New statistics store aggregate counts without IP-derived identifiers. Feedback abuse controls and any historical analytics have separate protections. No method of transmission or storage is completely secure.
13. Children’s privacy
Build Heartopia is a general fan resource and is not intended to knowingly collect personal information from children under 13. Children under 13 should not submit the feedback form.
14. International visitors
If you submit feedback from another jurisdiction, it is processed where the site’s infrastructure operates and may be subject to different laws. Global availability alone does not make every regional privacy law applicable.
15. Privacy choices and deletion requests
You may remove favorites or checklist marks or clear site data, browse without an account, and choose not to submit feedback. To request deletion of a feedback ticket, use the feedback form and include the BH-###### ticket reference.
Usage statistics choices
You can turn aggregate statistics off below. The site also respects Global Privacy Control and Do Not Track for these counters. This does not disable the network handling or security controls needed to serve and protect the website.
The interactive statistics switch is available when JavaScript loads. You can also use Global Privacy Control or Do Not Track in a supporting browser, or contact us using the privacy request details on this page.
16. External links
Other websites have their own privacy practices. Review their policies before providing information.
17. Changes to this policy
Updates will be posted here with a revised Last updated date.
18. Contact information
A dedicated reply-capable privacy email is not yet configured. Until one is supplied, use the feedback form, select General feedback, and begin the title with Privacy request. The form provides a ticket reference but cannot send a reply.
19. Effective date
This policy is effective September 22, 2026 and was last updated September 22, 2026.