This Privacy Policy explains how Brick Hill Rewritten ("we", "us", "our", or "the project") collects, stores, uses, and protects information connected to anyone who visits or registers on bhrewritten.pages.dev, along with any subdomain or associated service we operate (collectively, the "Service"). We wrote it to be read in full, not skimmed — privacy policies have a reputation for being dense legal filler that nobody actually reads, and we'd rather this one actually tell you something useful about what happens to your data while you're here.

Brick Hill Rewritten is a small, independent, non-commercial fan project. We don't have a legal or compliance department, an advertising network, or a data-monetization strategy — what you'll find below reflects how a volunteer-run team actually handles user information in practice, not a corporate template adapted to fit. That said, we still take the responsibility of holding your data seriously, and this document is our attempt to be transparent about exactly what that responsibility involves.

Any questions, concerns, or requests connected to this policy can be sent to bhrewritten@gmail.com (a temporary address while our support infrastructure is finalized). We try to respond to privacy-related emails personally rather than through an automated system, so expect a real reply from someone on the team rather than a form letter.

We may revise this policy at any point, for any reason — to reflect a new feature, to clarify language that turned out to be confusing, or to comply with a legal requirement we weren't previously aware of. Material changes will be reflected in the "Last Updated" date at the bottom of this page, and if a change meaningfully affects how we handle your personal information, we'll try to surface that change somewhere more visible than just this document, such as a site-wide notice.

This policy applies to every visitor to the Service, whether or not you've created an account — anonymous browsing, guest access, and registered accounts are all covered, though the amount of information we're able to collect (and the features available to you) differs depending on which category you fall into.

If you're located in a region with specific data protection laws — for example, the European Union's General Data Protection Regulation (GDPR), the UK's equivalent framework, or various US state-level privacy laws like the California Consumer Privacy Act (CCPA) — those laws may grant you additional rights beyond what's described here. Nothing in this policy is intended to override or diminish any legal right you're entitled to under applicable law; where this document and local law conflict, local law wins.

Brick Hill Rewritten is intended for users who meet the minimum age requirement specified in our Terms of Service. We do not knowingly direct the Service at children below that threshold, and where we are made aware that an account belongs to someone under the age we permit, we apply additional account restrictions as described in our parental controls system, which is covered separately in more detail on our Parents page.

Some parts of the Service — browsing public pages, reading the forum, viewing user profiles — don't require an account at all, and we don't ask anonymous visitors to identify themselves to access that content. That said, certain features (posting, trading, messaging, joining a clan) are gated behind registration, partly because moderating and holding accountable an account-less visitor is practically impossible if something goes wrong.

When you register, we ask for a username, a password, and a date of birth, with an email address being optional at signup but encouraged afterward. The username is public and forms part of your identity on the platform; the password is never visible to us or anyone else in its original form, because it's transformed through a one-way cryptographic hashing process the moment you set it — we genuinely cannot look up or recover your original password even if we wanted to, and neither can anyone who might gain unauthorized access to our systems.

We ask for a date of birth specifically so that we can apply the correct account protections automatically — accounts belonging to younger users receive additional safeguards by default, described further in our Terms and our Parents page. We do not use date of birth for advertising, profiling, or any purpose beyond determining which protections apply to your account.

If you choose to add an email address, it's used to verify that you're a real, reachable person, to help you recover your account if you lose access, and to notify you about important account activity. We do not require an email address to register, though some recovery features will be unavailable without one.

Anything you choose to post publicly — forum messages, profile bios, item descriptions, avatar customizations — is, by its nature, visible to other users and isn't private information in the way your password or raw account data is. Think of anything you type into a public field as something you're choosing to share with the community, not something we're collecting from you privately.

Like virtually every website on the internet, the Service automatically collects certain technical information whenever you visit, regardless of whether you have an account. This typically includes your IP address, the type and version of your browser, your operating system, the pages you request, and the date and time of your visit. None of this, on its own, is intended to personally identify you as an individual — it's the kind of data that exists primarily to keep the site running correctly and to help us catch abuse or technical problems.

We use small pieces of stored data — cookies, local storage, and similar browser-side mechanisms — for a handful of specific purposes: keeping you signed in between visits, remembering interface preferences (like your selected theme), and helping us distinguish genuine traffic from automated or malicious requests. We do not use these mechanisms to build advertising profiles, and we do not sell or rent any data collected this way to outside parties.

For security and moderation purposes, actions taken on the Service — logging in, posting content, initiating a trade, reporting another user — may be logged internally along with the technical details mentioned above (IP address, browser type, timestamp, requested page). These logs exist so that our team can investigate abuse reports, account compromises, or technical incidents after the fact; they are not used for advertising and are not shared publicly.

We do not attempt to determine your precise geographic location through device sensors, GPS, or similar means. If a future feature were ever to request your location directly, that request would be clearly optional, explained in context, and never required to use the core Service.

In broad terms, we use the information described above to run the Service, keep it reasonably secure, and improve it over time. More specifically, that includes: authenticating you when you log in, applying the correct account protections based on age, displaying your public profile and content to other users, investigating reports of abuse or rule violations, communicating with you about your account when necessary, and understanding in a general, aggregate sense how the Service is being used so we can prioritize what to build or fix next.

We do not use your personal information to serve targeted advertising, and we do not operate any advertising network on the Service. We also do not sell, rent, or otherwise monetize your personal data — Brick Hill Rewritten does not generate revenue, and your information has never been, and will never be, a part of any business model, because there isn't one.

Where we rely on automated processes (such as spam filters or rate-limiting systems) to make decisions about your account — for example, temporarily restricting an account that's behaving in a way associated with abuse — those systems exist to protect the community as a whole, and any meaningful enforcement action (like a suspension) is reviewed by an actual staff member rather than left entirely to automation.

We retain account information for as long as your account remains active and for as long as we reasonably need it to keep providing you the Service. If you request deletion of your account, we will remove the personally identifiable information associated with it from active use, though certain limited records may be retained where necessary to comply with a legal obligation, resolve an active dispute, enforce our agreements, or prevent fraud and abuse — for example, we may keep a record that a particular username was previously suspended for cause, even after the underlying account data has otherwise been removed.

Technical logs described in the section above are not kept indefinitely; they are retained for a limited period sufficient to investigate recent incidents and are periodically purged as part of normal system maintenance.

If your account is inactive for an extended period, we reserve the right to archive or reclaim it as described in our Terms of Service, which covers account dormancy in more detail.

We do not sell personal information to third parties, and we do not share it for marketing or advertising purposes belonging to anyone outside the project. Any sharing of personal information that does occur is limited to the circumstances described in this policy.

We may disclose personally identifiable information where we are legally required to do so — for example, in response to a valid court order, subpoena, or similar legal process, or where we believe in good faith that disclosure is necessary to comply with applicable law.

To the extent permitted by law, we may also share relevant information with law enforcement or another appropriate authority where we reasonably believe that withholding it could put a person's safety, or the safety and integrity of the Service itself, at meaningful risk. We don't take that kind of disclosure lightly, and it is not something we do as a matter of routine — it's reserved for situations where genuine harm appears to be at stake.

The Service may rely on third-party infrastructure providers — for example, our database host and our hosting/CDN provider — purely to operate technically. These providers process data on our behalf under their own security practices and are not given access to use your information for their own independent purposes; they function as infrastructure, not as separate recipients of your data in any meaningful sense.

Passwords are never stored in their original, readable form. They are passed through a one-way cryptographic hashing function before being saved, meaning that even with direct access to our database, your actual password cannot be reconstructed or read by anyone — including us. If you ever forget your password, we cannot "look it up" for you; the only path forward is a password reset.

We apply reasonable technical and organizational safeguards intended to protect the information we hold from unauthorized access, alteration, or loss — including transport encryption between your browser and our servers, and access restrictions on our internal systems limiting who on our team can view sensitive account data and under what circumstances. That said, no system connected to the internet can ever be guaranteed to be perfectly secure, and we cannot promise that a breach will never occur — what we can promise is that if one ever does, we will take it seriously, investigate it honestly, and notify affected users as required by applicable law.

You also play a role in keeping your account secure: choosing a password that isn't easily guessed, not reusing a password from another service, and not sharing your login credentials with anyone else — including friends, since account-sharing is also prohibited under our Terms of Service for reasons of accountability, not just security.

You can review and update most of the personal information tied to your account directly through your account settings page at any time. Where a particular change isn't available through the interface, you can request it by emailing bhrewritten@gmail.com, and we'll handle it manually.

You may request deletion of your account and the personally identifiable information associated with it at any time, either through your settings or by emailing us directly. As described elsewhere in this policy and in our Terms of Service, account deletion is permanent and cannot be undone once processed, and certain limited records may be retained where legally necessary even after deletion.

Depending on where you live, you may also have a legal right to request a copy of the personal data we hold about you, to object to certain uses of it, or to lodge a complaint with a relevant data protection authority if you believe we've mishandled your information. We'll do our best to honor reasonable requests of this nature even where local law doesn't strictly require it of a project our size, simply because we think it's the right way to operate.