HWA Universal Bot — browser extension for Hero Wars Alliance
Last updated 20 September 2026
The short version. Almost everything this extension does stays on your own computer. It sends data to a server in one case only: to check your licence, which happens when you start the Dungeon or Frontier macro, when you open the Wars tab, and when a remote training command runs. That check sends your licence key and your Hero Wars account number, and nothing else.
There is no analytics, no advertising, no tracking, and no third-party services beyond the hosting described below. Nothing is ever sold or shared for marketing.
This extension is developed and operated by an individual, Ivan, whose contact details are at the bottom of this page. For the purposes of the Nigeria Data Protection Act 2023 and the EU/UK GDPR, he is the data controller for the limited processing described here.
| Data | Where it lives | Why |
|---|---|---|
| Battle results — the hero team identifiers involved and win/loss counts | Your device only | Lets the Frontier macro pick which teams to field. Held in the browser's extension storage. |
| Your settings, activity log, and current team lineup | Your device only | Remembers your configuration between sessions. Held in the page's local storage. |
| Your licence key | Your device sent on check | Stored locally so you only type it once, and sent to the licence server to verify it. |
| Your Hero Wars account number | Your device sent on check | Ties a licence to one game account, so one key cannot be shared with many people. Kept in the page's local storage as well, so that a macro resuming after a page reload does not have to wait for the game to report it again. |
| The extension's version number | Sent on check | Lets us tell which release a request came from when diagnosing a fault. |
The extension makes one request to licence.hwa-bot.dev when it needs to verify
your licence: when you start the Dungeon or Frontier macro, when you open the Wars tab, or when a
remote training command runs. That request contains three things: your licence key, your Hero Wars
account number, and the extension's version. It contains no other information — in
particular, nothing about the war you are looking at is ever sent anywhere.
A successful check is remembered for fifteen minutes, so opening the Wars tab repeatedly does not repeat the request.
On the server, a record for your licence holds:
Because only hashes are stored, the licence database cannot be used to work out who plays which Hero Wars account. That is deliberate.
The licence server runs on Cloudflare Workers, and its records are held in Cloudflare D1 in Cloudflare's network. As with any web request, Cloudflare processes your IP address in order to deliver the request and to protect the service against abuse. We do not store your IP address ourselves, and we do not combine it with your licence record. Cloudflare acts as our data processor; its own retention applies to its logs.
The extension can send you progress messages — macro started, macro stopped, an error, a floor
count — through a small relay program. This feature is switched off unless you turn it
on, and you supply the address it talks to; by default that address is your own computer
(127.0.0.1). Messages contain macro status text and timestamps, not your account
details.
If you point this feature at a service you run or at Telegram, data goes wherever you have directed it, and this policy cannot govern what happens to it there. Leaving the feature switched off means no such messages are sent at all.
HWA Bot is an optional program that runs on your own computer and lets you control the extension from Telegram. You install it yourself, from hwa-bot.dev/bot. It talks to three places and no others:
api.telegram.org — using the bot token you created with @BotFather. The
bot is yours; we never see it, its token, or your messages.127.0.0.1 — the extension in your browser. That address is your own
computer, so this traffic never leaves it.hwa-bot.dev — only to check whether a newer version exists, when the app
starts and every few hours. That request carries the app's version and your operating system
and nothing else: no identifiers, no account details. Nothing about you is stored.The app has no analytics and no tracking of its own. The bot token and Telegram id it works with stay on your computer; they are never sent to us.
To know what is happening on screen, the extension watches the game's own network messages inside your browser, for a fixed list of nine Hero Wars operations: eight that report Dungeon and Frontier progress, and one that reports your account number. This observation happens entirely on your device. Only your account number is ever transmitted, and only as part of the licence check above.
The extension has permission to run only on hero-wars-alliance.com and to reach
the licence server. It cannot read your other tabs, your browsing history, your bookmarks, or your
saved passwords, and it does not ask for the permissions that would allow it to.
Verifying your licence is necessary to provide the licensed features you asked for — in GDPR terms, performance of a contract. Binding a licence to a single game account rests on our legitimate interest in preventing one licence being shared without limit. The optional Telegram feature operates only on your own instruction.
You may ask us to give you a copy of the data we hold about you, correct it, delete it, or stop processing it, and you may complain to your data protection authority — in Nigeria, the Nigeria Data Protection Commission.
One practical limitation worth knowing: because we store only hashes, we cannot find your record from your name or your game account. To make a request about a licence, you need to send us the licence key, which is the only way to locate it. Data held on your own device is not something we can reach at all — you control it directly, through your browser.
We aim to respond within 30 days.
Our use of data obtained through the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. Data is used only to provide the features described here, is never sold, is never used for advertising, and is never transferred except as needed to run the service or where the law requires it.
This extension is not directed at children, and we do not knowingly process data from anyone we know to be a child.
If this policy changes, the date at the top of this page changes with it. If a change materially affects what is collected or why, we will note it in the extension's release notes.