HWA Universal Bot — browser extension for Hero Wars Alliance
Last updated 30 October 2026
The short version. Almost everything this extension does stays on your own computer. It sends data to a server in two cases. The first is to check your Supporter ID, if you have entered one, which happens when you start the Dungeon or Frontier macro, when you open the Wars tab, when you press the Reports button, and when a remote training command runs. That check sends your Supporter ID and your Hero Wars account number, and nothing else. The second is the Reports button, which sends your guild's war battles — and only when you press it.
There is no analytics, no advertising, no tracking, and no third-party services beyond the hosting described below. Nothing is ever sold or shared for marketing.
This extension is developed and operated by an individual, Ivan, whose contact details are at the bottom of this page. For the purposes of the Nigeria Data Protection Act 2023 and the EU/UK GDPR, he is the data controller for the limited processing described here.
| Data | Where it lives | Why |
|---|---|---|
| Battle results — the hero team identifiers involved and win/loss counts | Your device only | Lets the Frontier macro pick which teams to field. Held in the browser's extension storage. |
| Your settings, activity log, and current team lineup | Your device only | Remembers your configuration between sessions. Held in the page's local storage. |
| Your Supporter ID | Your device sent on check | Stored locally so you only type it once, and sent to licence.hwa-bot.dev to verify it. |
| Your Hero Wars account number | Your device sent on check | Ties a Supporter ID to one game account, so one ID cannot be shared with many people. Kept in the page's local storage as well, so that a macro resuming after a page reload does not have to wait for the game to report it again. |
| The extension's version number | Sent on check | Lets us tell which release a request came from when diagnosing a fault. |
| Your guild's war battles — see Guild war reports | Sent when you press the Reports button | Builds win-rate and line-up reports for your guild. |
| Your guild members' total hero power — see Guild war reports | Sent when you press the Guilds Progress button | Records each member's power per day, so the guild can follow its progress over weeks and months. |
| Your guild's current championship defence — see Guild war reports | Sent when you press the defence button | Keeps every member's saved defence teams as the game lists them, champions and the rest told apart, the latest upload per guild. |
The extension makes one request to licence.hwa-bot.dev when it needs to verify
your Supporter ID: when you start the Dungeon or Frontier macro, when you open the Wars tab, when you
press the Reports button, or when a remote training command runs. That request contains three
things: your Supporter ID, your Hero Wars account number, and the extension's version. It contains
no other information — in particular, opening the Wars tab sends nothing about the war you
are looking at. Only the Reports button, described below, sends war data.
A successful check is remembered for fifteen minutes, so opening the Wars tab repeatedly does not repeat the request.
On the server, a record for your Supporter ID holds:
Because only hashes are stored, the supporter database cannot be used to work out who plays which Hero Wars account. That is deliberate.
If you support the project on Patreon and log in with Patreon on hwa-bot.dev/patreon/,
the login asks Patreon for your public profile only (the identity scope) — not your
email address — and the access token Patreon issues is used for that one request and then discarded.
Patreon also notifies licence.hwa-bot.dev when your membership or a payment changes. From
either source the server keeps, alongside your Supporter ID record:
Your name and email reach Patreon's notifications, but they are dropped on arrival and never stored or logged. What you pay, and to whom, stays between you and Patreon.
The server runs on Cloudflare Workers, and its records are held in Cloudflare D1 in Cloudflare's network. As with any web request, Cloudflare processes your IP address in order to deliver the request and to protect the service against abuse. We do not store your IP address ourselves, and we do not combine it with your Supporter ID record. Cloudflare acts as our data processor; its own retention applies to its logs.
The Reports tab has three upload buttons: Collect & upload under Guild wars,
Upload members progress under Guilds Progress and Upload our current defence in
wars under Champions. Nothing in this section happens until you press one of them: the
extension never uploads war data on its own — not when the game loads, not when the Reports tab
is opened, and not on a schedule. When you press Collect & upload, the extension reads your guild's Guild War and Championship
history from the game — the same battle records every member of your guild can open in the
game's own war screens — and sends them to licence.hwa-bot.dev, where they are
stored under your guild's number so that reports for your guild (attack and defence success,
hero deaths, which line-ups beat which) can be built from them.
Each upload contains, for every battle of the days the game still lists:
This includes data about other people — your guild-mates and your opponents — that the game already shows to every member of your guild. It is processed on the basis of our legitimate interest in providing guild statistics to guilds that ask for them, and it is used for nothing else. Because the same battles are visible to every member of a guild, a second member pressing the button on the same day adds only the battles fought since the first upload; nothing is duplicated or replaced.
The Guilds Progress button, shown to guild masters and generals only, reads the list of your guild's current members from the game and then, for each member, the total power of their heroes — the single number the game shows on every player's profile. It sends your guild's number and, for each member, their game id and that number, and nothing else: the same game answer also says who is online and when each member was last active, and neither is sent. The server records each member's power under the day it arrived (UTC); pressing the button again on the same day replaces that day's numbers, and other days are never changed. This is kept so that a guild can follow how its members' power develops over weeks and months: the Open progress report button opens a page on this site, signed in the same way as the war reports, that lists the current members with their power and its change over the last week or month. As with the war battles, it is data about your guild-mates that the game already shows to every member of the guild, processed on the basis of our legitimate interest in providing guild statistics to guilds that ask for them.
The Upload our current defence in wars button, shown to the same two roles, reads your guild's Championship defence from the game — the defence teams every member has saved, the same ones the war map shows — and sends your guild's number and, for each member with a saved defence, their game id, whether they stand in a slot of the war map, and their teams: for each hero or titan its id and power and, for a hero, its relic level and the id and level of the talisman it wears. Nothing else — not the position, not the build, not the remaining health. No names are sent. The server keeps the latest upload per guild only: a new upload replaces the one before it. It is data about your guild-mates that the game already shows to every member of the guild, processed on the same basis as the war battles.
A guild master or general can open these reports, or the progress report, on this site and share one table with a link. From the war reports, or with the Reports tab's MVP button, they can also open the Championship MVP page: award podiums for the guild's last four weeks of Championship battles, built from the same stored battles, which shows the in-game names of the champions who made a place and the numbers that put them there. It can be shared the same way, as a whole. A shared link shows that table or those podiums exactly as they were at that moment — the names and numbers in it, the guild's name, the war and the period — to anyone who has the link, without any sign-in. It expires after thirty days, and the person who shared it can revoke it earlier from the same page. Nothing else about the guild is reachable through a shared link.
Any member of the guild can open the battle search from the extension's Wars tab (Find battles, next to each Train button); the war reports also link to it. It lists single battles from the wars your guild uploaded. For each one it shows the day and the war, the opposing guild's name, both players' in-game names, each team's total power, the heroes or titans on both sides as the battle began, with their relic levels, and the outcome. The list can be narrowed by a line-up on either side, a player, an opposing guild, a period, the result and similar filters. These are the battles every member of your guild can already open in the game's own war screens. The page is signed in the same way as the reports, with a link that lasts twelve hours. The server issues it only to a player it knows as a member of that guild:
That link opens the battle search and nothing else, not the war reports or the progress report. The filters you choose appear in the page's address, never your Supporter ID.
Anyone using the battle search can share its results with a link. The server runs the search again and keeps its first hundred battles as they were at that moment — for each one the same details the search shows, with the players' and guilds' in-game names, plus the filters and the guild's name — and shows them to anyone who has the link, without any sign-in. Game account numbers are left out wherever a name is known. A shared search is deleted thirty days after it was made, and the person who shared it can revoke it earlier from the same page. To limit each person to ten shared searches a day, the server stores a code with every share that is derived one-way from the Supporter ID and identifies no one outside this count.
A guild master or general whose Supporter ID also includes battle simulation can use the Championship simulations section of the Reports tab. For one Championship day, the extension fights each attack on a hero slot again in the game's own battle engine, inside your browser, from the battle data the game already gave you, and sends the server two numbers per battle: how many times the attack won and how many times it lost. Nothing else is sent with them besides your guild's number and the day. The numbers are stored with that battle, and the battle search shows them on it. A battle the server does not have yet is uploaded first, exactly as Collect & upload would upload it.
The upload is tied to your Supporter ID: the ID and your account number travel with it for verification, exactly as in the Supporter ID check, and the server records only their one-way hashes against the upload. The battle data is kept in Cloudflare D1 and Cloudflare R2, for as long as the guild's reports are offered. A guild may ask for its data to be deleted by sending us its guild number and a Supporter ID that uploaded for it.
The extension can send you progress messages — macro started, macro stopped, an error, a floor
count — through a small relay program. This feature is switched off unless you turn it
on, and you supply the address it talks to; by default that address is your own computer
(127.0.0.1). Messages contain macro status text and timestamps, not your account
details.
If you point this feature at a service you run or at Telegram, data goes wherever you have directed it, and this policy cannot govern what happens to it there. Leaving the feature switched off means no such messages are sent at all.
HWA Bot is an optional program that runs on your own computer and lets you control the extension from Telegram. You install it yourself, from hwa-bot.dev/bot. It talks to three places and no others:
api.telegram.org — using the bot token you created with @BotFather. The
bot is yours; we never see it, its token, or your messages.127.0.0.1 — the extension in your browser. That address is your own
computer, so this traffic never leaves it.hwa-bot.dev — only to check whether a newer version exists, when the app
starts and every few hours. That request carries the app's version and your operating system
and nothing else: no identifiers, no account details. Nothing about you is stored.The app has no analytics and no tracking of its own. The bot token and Telegram id it works with stay on your computer; they are never sent to us.
To know what is happening on screen, the extension watches the game's own network messages inside your browser, for a fixed list of nine Hero Wars operations: eight that report Dungeon and Frontier progress, and one that reports your account number and your guild role. The role is kept in memory only, to decide whether the Reports tab is shown (guild masters and generals see it). This observation happens entirely on your device. Of what is observed, only your account number is ever transmitted, and only as part of the Supporter ID check above. The war history the Reports button sends is not taken from this observation: it is requested from the game when you press the button, and only then.
The extension has permission to run only on hero-wars-alliance.com and to reach
licence.hwa-bot.dev. It cannot read your other tabs, your browsing history, your bookmarks, or your
saved passwords, and it does not ask for the permissions that would allow it to.
Verifying your Supporter ID is necessary to provide the supporter features you asked for — in GDPR terms, performance of a contract. Binding a Supporter ID to a single game account rests on our legitimate interest in preventing one Supporter ID being shared without limit. Storing guild war battles rests on our legitimate interest in providing guild statistics to the guilds that request them, and happens only when a member presses the Reports button. The optional Telegram feature operates only on your own instruction.
You may ask us to give you a copy of the data we hold about you, correct it, delete it, or stop processing it, and you may complain to your data protection authority — in Nigeria, the Nigeria Data Protection Commission.
One practical limitation worth knowing: because we store only hashes, we cannot find your record from your name or your game account. To make a request about a Supporter ID, you need to send us the ID itself, which is the only way to locate it. Data held on your own device is not something we can reach at all — you control it directly, through your browser.
We aim to respond within 30 days.
Our use of data obtained through the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. Data is used only to provide the features described here, is never sold, is never used for advertising, and is never transferred except as needed to run the service or where the law requires it.
This extension is not directed at children, and we do not knowingly process data from anyone we know to be a child.
If this policy changes, the date at the top of this page changes with it. If a change materially affects what is collected or why, we will note it in the extension's release notes.