HWA Universal Bot — browser extension for Hero Wars Alliance
Last updated 6 September 2026
The short version. Almost everything this extension does stays on your own computer. It sends data to a server in exactly one case: when you start the Dungeon or Frontier macro, it checks your licence. That check sends your licence key and your Hero Wars account number, and nothing else.
There is no analytics, no advertising, no tracking, and no third-party services beyond the hosting described below. Nothing is ever sold or shared for marketing.
This extension is developed and operated by an individual, Ivan, whose contact details are at the bottom of this page. For the purposes of the Nigeria Data Protection Act 2023 and the EU/UK GDPR, he is the data controller for the limited processing described here.
| Data | Where it lives | Why |
|---|---|---|
| Battle results — the hero team identifiers involved and win/loss counts | Your device only | Lets the Frontier macro pick which teams to field. Held in the browser's extension storage. |
| Your settings, activity log, and current team lineup | Your device only | Remembers your configuration between sessions. Held in the page's local storage. |
| Your licence key | Your device sent on check | Stored locally so you only type it once, and sent to the licence server to verify it. |
| Your Hero Wars account number | Your device sent on check | Ties a licence to one game account, so one key cannot be shared with many people. Kept in the page's local storage as well, so that a macro resuming after a page reload does not have to wait for the game to report it again. |
| The extension's version number | Sent on check | Lets us tell which release a request came from when diagnosing a fault. |
When you start the Dungeon or Frontier macro, the extension makes one request to
licence.hwa-bot.dev. That request contains three things: your licence key, your Hero
Wars account number, and the extension's version. It contains no other information.
On the server, a record for your licence holds:
Because only hashes are stored, the licence database cannot be used to work out who plays which Hero Wars account. That is deliberate.
The licence server runs on Cloudflare Workers, and its records are held in Cloudflare D1 in Cloudflare's network. As with any web request, Cloudflare processes your IP address in order to deliver the request and to protect the service against abuse. We do not store your IP address ourselves, and we do not combine it with your licence record. Cloudflare acts as our data processor; its own retention applies to its logs.
The extension can send you progress messages — macro started, macro stopped, an error, a floor
count — through a small relay program. This feature is switched off unless you turn it
on, and you supply the address it talks to; by default that address is your own computer
(127.0.0.1). Messages contain macro status text and timestamps, not your account
details.
If you point this feature at a service you run or at Telegram, data goes wherever you have directed it, and this policy cannot govern what happens to it there. Leaving the feature switched off means no such messages are sent at all.
To know what is happening on screen, the extension watches the game's own network messages inside your browser, for a fixed list of nine Hero Wars operations: eight that report Dungeon and Frontier progress, and one that reports your account number. This observation happens entirely on your device. Only your account number is ever transmitted, and only as part of the licence check above.
The extension has permission to run only on hero-wars-alliance.com and to reach
the licence server. It cannot read your other tabs, your browsing history, your bookmarks, or your
saved passwords, and it does not ask for the permissions that would allow it to.
Verifying your licence is necessary to provide the licensed features you asked for — in GDPR terms, performance of a contract. Binding a licence to a single game account rests on our legitimate interest in preventing one licence being shared without limit. The optional Telegram feature operates only on your own instruction.
You may ask us to give you a copy of the data we hold about you, correct it, delete it, or stop processing it, and you may complain to your data protection authority — in Nigeria, the Nigeria Data Protection Commission.
One practical limitation worth knowing: because we store only hashes, we cannot find your record from your name or your game account. To make a request about a licence, you need to send us the licence key, which is the only way to locate it. Data held on your own device is not something we can reach at all — you control it directly, through your browser.
We aim to respond within 30 days.
Our use of data obtained through the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. Data is used only to provide the features described here, is never sold, is never used for advertising, and is never transferred except as needed to run the service or where the law requires it.
This extension is not directed at children, and we do not knowingly process data from anyone we know to be a child.
If this policy changes, the date at the top of this page changes with it. If a change materially affects what is collected or why, we will note it in the extension's release notes.