Privacy Policy

Last updated: 28 September 2026

This policy explains what personal data is collected when you use the Big Tom Dev website (bigtomdev.fyi), Hearthvale (bigtomdev.fyi/hearthvale) , OmniPrice (bigtomdev.fyi/omniprice), Homebase (bigtomdev.fyi/homebase), Cardhouse (bigtomdev.fyi/cardhouse), Loopline (bigtomdev.fyi/loopline), Pixelforge (bigtomdev.fyi/pixelforge) and Orbit Lab (bigtomdev.fyi/orbitlab), why, and what your rights are. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

The data controller is Big Tom Dev, an independent developer based in the United Kingdom. Contact: hello@bigtomdev.fyi.

Big Tom Dev is a hobby project, not a company. There is no advertising, no analytics and no selling of data.

2. The website

The Big Tom Dev pages (the home page, The Big 7 and these legal pages) have no accounts, no forms, no cookies, no analytics and no third-party trackers. Fonts are hosted on our own site.

Like every website, the servers that deliver these pages see your IP address, browser type and the page requested. Our host, Vercel, processes this to deliver the site and protect it from abuse, and keeps short-term request logs.

If you email us, we receive your email address and message. Email to our address is forwarded by Cloudflare. We use it only to reply, and delete it once the conversation is finished, unless we need it to resolve a dispute.

3. Hearthvale

Hearthvale turns a Discord server into a 3D world. To do that it needs some data from Discord and from you.

3.1 When you log in with Discord

We ask Discord for two permissions (“scopes”): identify and guilds. We do not ask for your email address. We receive:

• Your Discord user ID, username, display name and avatar. These are stored so we can recognise you and show your name and avatar in the world.
• The list of Discord servers you're in. This is used to show which of your servers have Hearthvale. It is kept in memory for a short time and not stored in our database.
• Discord access tokens. These let Hearthvale act on the permissions you granted. They are stored encrypted (AES-256-GCM) and revoked when you log out or delete your data.

3.2 What you create in Hearthvale

• Your character (body, hair, face, colours and accessories) and your settings (voice mode, push-to-talk key, device choices, volumes, brightness and similar). Both are stored so they're there next time.
• Your position and movement in a world. These are shared live with other players in the same world who are nearby, so they can see you. They are held in memory only and never stored.

3.3 Messages

• Messages you send from the world are posted to the real Discord channel under your name and avatar, using a Discord webhook. Once posted, they are on Discord and governed by Discord's Privacy Policy. We store only metadata for 30 days: the message ID, server, channel and time. We use it to attribute messages correctly and to investigate abuse. We never store the text.
• Messages from the Discord channels you can view are shown to you as the notice board inside a house and as speech bubbles. They are fetched from Discord when needed, held in memory for up to 30 seconds (history) or 24 hours (see section 8), and not stored.

3.4 Voice chat

• Voice is optional. Your browser only asks for your microphone when you click “Join voice”, and you can join listen-only.
• Audio is sent in real time through LiveKit, a voice service, to players near you. Voice is never recorded or stored by Hearthvale.
• If you stand in a voice channel's gazebo, the Hearthvale bot relays audio both ways between the world and that Discord voice channel. People in the Discord call can hear you, and you can hear them. The bot is visibly present in the Discord channel while this happens. Nothing is recorded.

3.5 Permissions and moderation checks

Hearthvale checks your Discord roles and permissions (for example, whether you can view a channel, send messages, speak, or are timed out) so it only lets you do what Discord allows. This information is fetched through the bot and kept in memory for up to a minute.

3.6 Cookies

Hearthvale uses two strictly necessary cookies to keep you logged in and to protect the login. See the Cookie Policy.

3.7 Server logs

The Hearthvale server keeps operational logs so problems can be fixed and abuse stopped. These logs include events such as a player joining or leaving a world (Discord username and server name), errors and security events. Logs are kept for no longer than 30 days.

4. OmniPrice

OmniPrice shows published prices and statistics. It has no accounts, no cookies and no analytics, and it does not collect personal data about you.

• How it works: your browser asks our server (a Vercel Function at bigtomdev.fyi/api/omniprice) for data. Our server fetches the figures from the data providers listed in the Terms. Your browser never contacts those providers, so they don't receive your IP address.
• Request logs: Vercel sees your IP address, browser details and the addresses you request, which can include which prices you looked at. It uses these to deliver and secure the service, as described in section 2. We don't link this to you or use it for profiling.
• Comparisons: what you choose to compare is kept only in the page's address (the part after #) while you use it. It is not sent to or stored by our server. If you share a comparison link, the recipient sees the same selection.
• Display currency: if you choose a currency under “Prices in”, your choice (for example GBP) is saved in your browser's local storage on your device, so it's remembered next time. It is sent to our server only as that currency code, to convert the figures. Choose “Original currencies” to remove it.

5. Homebase

Homebase is a start page that runs entirely in your browser. There are no accounts, and we never receive your settings or anything you type into it.

• Stored on your device only: your theme and layout choices, widgets and everything in them (notes, to-dos, links, countdowns, your name for greetings) are kept in your browser's local storage. Photos you add are kept in its IndexedDB storage. Weather forecasts are cached for 20 minutes. Remove it all with Customise → Data → Reset everything, or by clearing this site's data in your browser.
• Services your browser contacts directly, only when you use the matching feature:
  • Open-Meteo (weather widget): receives the place you type, or its coordinates, and your IP address, to return the forecast.
  • DuckDuckGo's icon service (for the icons on quick links): receives the web addresses of your quick links and your IP address. It's on by default. Turn off “Show website icons on quick links” in Customise → General to stop it.
  • Your chosen search engine: when you search, your query goes to that engine under its own privacy policy.
  • OmniPrice (currency and market widgets): our own data server, described in section 4.
• Backups you download are files on your device. We never see them.

6. Cardhouse

Cardhouse is a card room that needs no account. It uses the least data it can to run a table:

• Your nickname, chip count, cards and actions are held in our server's memory only while your table is running, and shown to the other players at that table. Nothing is written to a database. A seat you leave, or lose connection from for more than two minutes, is deleted between hands, and a whole table is deleted once everyone has gone. A server restart ends all tables.
• A random seat token is kept in your browser's session storage so you can rejoin your seat after a refresh or a dropped connection. It's deleted when you close the tab or leave the table.
• Your IP address is used briefly in memory to limit how many tables one connection can create, which protects the service from abuse. It isn't stored.
• There's no chat, so there's nothing you write to other players apart from your nickname. Please don't use your real name or anything personal as your nickname.

Cardhouse runs on the same server and hosting as Hearthvale (sections 10 and 11), and the same server logs apply.

7. Loopline, Pixelforge and Orbit Lab

These three tools run entirely in your browser. There are no accounts, and nothing you make is sent to us.

• Loopline keeps your latest beat in your browser's local storage so it's there next time. When you share a beat, the whole pattern goes in the part of the link after the #, which browsers don't send to websites, so the link carries your beat without us receiving it. Anyone you give the link to can hear it.
• Pixelforge keeps your drawing and its frames in your browser's local storage. Exported images are saved straight to your device.
• Orbit Lab stores nothing at all.
• Clear any of this by clearing this site's data in your browser.

Like every page on the site, loading these tools leaves a normal request in our hosting provider's logs (section 2).

8. People who don't use Hearthvale

When a Discord server adds the Hearthvale bot, some data about that server's members is shown in its world, only to other members of the same server who can see the relevant channel:

• If you recently posted in a channel, you may appear as a translucent “away” character by that channel's house, with your Discord display name, avatar and recent message. This is kept in memory for up to 24 hours and not stored.
• If you're in a Discord voice channel, you appear seated in its gazebo. If a Hearthvale player joins that gazebo, the bot joins the call and your voice is relayed to them live (see 3.4).

This is information those members could already see in Discord. Server administrators choose to add the bot and should tell their members. If you'd like to be excluded, contact us or ask your server's administrators.

9. Why we're allowed to use it (lawful bases)

10. Who we share it with

We don't sell or rent personal data. We use these service providers, who process data on our behalf or as needed to run the service:

We may also disclose data if the law requires it, or to protect people from harm.

11. International transfers

The providers above are based in the United States. Where personal data leaves the UK, it is protected by the UK Extension to the EU–US Data Privacy Framework, or by the UK International Data Transfer Addendum and standard contractual clauses, as provided in each provider's data protection terms.

12. How long we keep it

13. Your rights

Under UK GDPR you can ask to access, correct, delete or receive a copy of your data, and to restrict or object to how we use it. You can do the main ones yourself in Hearthvale, under Settings → Account:

• Download my data gives you a copy of everything Hearthvale stores about you, as a JSON file.
• Delete my data permanently erases your profile, character, settings, sessions and message metadata, logs you out everywhere and revokes Hearthvale's access to your Discord account.

You can also remove Hearthvale's access at any time in Discord under User Settings → Authorised Apps. For anything else, email hello@bigtomdev.fyi. We'll reply within one month.

If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk. We'd appreciate the chance to sort it out first.

14. Children

Hearthvale and Cardhouse are for people aged 13 or over, the minimum age to use Discord, or older where local law requires it. We don't knowingly collect data from younger children. If you believe we have, contact us and we'll delete it.

15. Security

All connections use HTTPS. Discord tokens are encrypted at rest. Session cookies are stored only as one-way hashes. Every action is re-checked against Discord's own permissions on the server. No system is perfectly secure, but we take reasonable care to protect your data, and we'll tell you and the ICO if a breach puts you at risk.

16. Changes and contact

If this policy changes, we'll update the date at the top. For significant changes, we'll also say so in Hearthvale. Questions? Email hello@bigtomdev.fyi.