Privacy Policy

Last updated: September 26, 2026

This policy explains what information Thig.io, LLC (“Thig.io”, “we”, “us”) collects when you use easteregg.fun, play Ultimate Fantasy Battle (“UFB”), or buy UFB products, and what we do with it. We have written it to match what the site actually does. If you spot anything missing, tell us at support@thig.io.

The short version:

We collect only what we need to run the game, sell figurines and see how the game is played.
We don't sell your information.
We don't show ads.
We don't use third-party analytics or tracking cookies.

1. Who is responsible

Thig.io, LLC, 2802 Wetmore Avenue, Everett, WA 98201, USA, is the controller of the personal information described here. Contact us at support@thig.io.

2. What we collect

Playing as a guest

You can play without an account. Your browser stores a random player ID, the display name you type and your last chosen hero and map (see section 5). Our server keeps your solo game saves and your match records under that random ID. We never ask guests for an email or any other contact details.

If you create an account

For an account, we collect:

your email address;
your display name;
your password, which we store only as a salted bcrypt hash and never in readable form.

We then store your game progress: gold, heroes and their levels, elements and skill trees, win/loss and other game totals, and your saved games.

Figurines you claim

When you claim a figurine, we record:

which figurine it was, by the serial number printed on the box;
when you claimed it;
the chip's own serial number (UID), if you tapped its NFC chip.

Claim codes are stored only as one-way hashes, so we can check a code but can't read it back.

If you buy from us

For an order, we keep:

your name and email;
your shipping address;
what you bought and what you paid;
your order number;
which figurine serial numbers were shipped to you, so we can link your purchase to the heroes you claim.

Card and other payment details go straight to our payment processor. We never see or store your full card number.

How the game is played

To balance and improve UFB, our game server records what happens in each match. This includes:

the map and heroes;
turns taken;
moves, items and skills used;
damage, kills and gold earned;
how the match ended and how long it took.

These records are linked to your account or guest ID. We use them for statistics about the game, never to profile you for marketing.

Language choice

If you pick a language from the language menu, we save it in your browser. We also send our server a small event: the language you chose, the one you switched from, the page you were on, and a random visitor ID generated in your browser. The event contains no name, email or IP address.

Once a day, your browser also tells us which language you are reading the site in, with the same random ID and your browser's language setting.

This lets us count how many people use each language. The visitor ID is used only so that one person isn't counted twice.

Server logs

Like almost every website, our web server logs each request. A log entry contains:

your IP address;
the date and time;
the page or file requested;
the referring page;
your browser's user-agent string.

Our own dashboard reads these logs to count visits, tell people from bots, and spot attacks. It works out your country and network provider from your IP address using a database stored on our own server, so your IP address is not sent to any outside service for this.

When you contact us

If you email us, or sign up for our newsletter, we get your email address and whatever you choose to tell us.

3. How we use it

We use this information:

to run the game, including your account, your progress, your figurine claims and your saved games (legal basis: to perform our contract with you);
to take, ship and support orders, and to handle returns and refunds (legal basis: contract);
to balance and improve the game and the site, using match statistics, language counts and visit counts (legal basis: our legitimate interest in making a better game);
to keep the service secure, including preventing cheating, claim-code guessing, fraud and abuse (legal basis: legitimate interests);
to answer you, and to send important notices about your account or these policies (legal basis: contract and legitimate interests);
to send the newsletter, only if you signed up for it, and you can unsubscribe from any email (legal basis: consent);
to keep records and comply with the law, such as tax records for sales (legal basis: legal obligation).

We don't use automated decision-making that has legal or similarly significant effects on you.

4. Who we share it with

We don't sell or rent personal information, and we don't share it for cross-context behavioural advertising. We share it only with service providers who work on our behalf:

Hosting: our servers are rented from IONOS, in the United States.
Google Fonts: the site loads its fonts from Google. Your browser therefore connects to Google, which receives your IP address and user-agent.
Mailchimp (Intuit): runs the newsletter, if you subscribe.
Payment and shopping providers: when our store opens, its checkout and payment processor will handle your order and payment. We'll name them here when they are live.
Shipping carriers: they receive your name and address so they can deliver your order.

We may also disclose information:

if the law requires it;
to protect people's safety or our rights;
to a buyer or successor if our business is sold or merged. Any such buyer or successor remains bound by this policy.

Your display name, the hero you play and your moves are visible to the other players in your match.

5. Cookies and browser storage

We don't use advertising or analytics cookies. The site stores a few items in your browser's local storage to make it work:

your sign-in session (ufb.account);
your guest player ID and game token (ufb.playerId, ufb.clientId, ufb.token);
the display name, hero and map you last chose (ufb.name, ufb.hero, ufb.map);
a note that lets you rejoin a match in progress (ufb.rejoin);
your language and the random visitor ID described in section 2 (ufb.lang, ufb.vid).

You can clear these at any time in your browser settings. If you do, you are signed out and any guest progress is lost.

Links to social media, and embedded content from other sites, follow those sites' own policies.

6. How long we keep it

Accounts and game progress: until you delete your account. Guest saves and match records stay until we clear inactive data.
Figurine records: kept for as long as the figurine exists, because the figurine's hero and progress belong to it. When you release a figurine, or delete your account, your account is removed from the figurine's record.
Orders: as long as tax and accounting law requires, usually 7 years.
Match statistics: kept while useful for balancing the game. When we delete your account, we remove your account from these statistics, and they keep only anonymous totals.
Language events: kept for up to 400 days.
Raw web-server logs: deleted after 14 days. Our dashboard keeps its summary of requests, which includes IP addresses, for up to 400 days.
Backups: overwritten after 14 days.

7. Your rights and choices

You can ask us to:

tell you what personal information we hold about you and give you a copy;
correct it;
delete it, including your whole account;
stop using it for purposes based on our legitimate interests;
send it to you in a portable format.

Email support@thig.io from the address on your account. We may need to confirm it's really you. We will reply within 30 days, or within 45 days where US state law allows.

We won't treat you differently for using your rights. You can also have an authorised agent make a request for you.

You can change your display name in your account at any time. You can stop language events by not using the language menu, or by clearing your browser storage. You can unsubscribe from the newsletter with the link in any email.

Europe and the UK

If you are in the EEA, Switzerland or the UK, you have the rights listed above under the GDPR or UK GDPR. You can also complain to your local data protection authority.

Our servers are in the United States. When your information goes there, we rely on the safeguards the law allows, such as the European Commission's Standard Contractual Clauses, or on the transfer being needed to provide the service you asked for.

California and other US states

Residents of California and several other US states have the right to:

know what personal information we collect, use and disclose;
delete it;
correct it;
opt out of its “sale” or “sharing”.

We don't sell or share personal information in that sense. We haven't done so in the last 12 months, and we don't knowingly do so for anyone under 16.

In the last 12 months we collected these categories of personal information:

identifiers: email, display name, IP address, random device IDs;
commercial information: orders and claimed figurines;
internet activity: server logs and game activity;
approximate location: country, worked out from your IP address.

All of these come from you or your device, and are used for the purposes in section 3.

8. Children

You must be 13 or older to create an account. Guest play asks for no personal information. We don't knowingly collect personal information from children under 13.

If you believe a child under 13 has given us personal information, email support@thig.io and we will delete it.

9. Security

We use several measures to protect your information:

encrypted connections (HTTPS) for the whole site;
hashed passwords and claim codes;
rate limits on sign-in and claim attempts;
a database reachable only from our own server;
a password-protected admin area.

No system is perfectly secure, though. If there is a breach that affects you, we will tell you as the law requires.

10. Translations

This policy is available in several languages, some of them machine-translated. If a translation differs from the English version, the English version applies.

11. Changes to this policy

When we change this policy, we update the date at the top of this page. If a change is significant, we will also post a notice on the site, or email account holders, before it takes effect.

12. Contact

Thig.io, LLC
2802 Wetmore Avenue
Everett, WA 98201, USA
support@thig.io