This site is run by [Murali Anand] as a free, unofficial fan tool. It is not affiliated with, endorsed by, or connected to Top Heroes, its publisher, or Discord.

For anything in this policy — including deletion requests — write to [contact@muralianand.in].

Discord account

We request the identify scope only. That gives us your Discord user ID, username, display name, and avatar. We do not receive your email address, your servers, your friends, or any of your messages.

Top Heroes UIDs

Each UID you add, plus the nickname, level, avatar, and server ID that the game’s public player lookup returns for it.

Redemption records

One row per gift code and UID: the code, the UID, the outcome, the raw response code and message from the game API, the number of attempts, and the timestamp.

Daily sign-in records

One row per UID per day: the outcome, the campaign ID, and the timestamp.

Manual submissions

When you submit a code by hand we log your Discord ID and username, the code, the verdict, and the time. This backs the hourly submission limit and lets us trace abuse.

Session cookie

One cookie, th_session. It is HTTP-only, cryptographically signed, expires after 30 days, and holds your Discord ID, username, display name, and avatar so you stay signed in. There are no analytics, advertising, or tracking cookies on this site.

Server logs

Our host (Vercel) keeps standard request logs, which include IP addresses and user agents, under its own retention policy.

When we look up a UID, the game’s response includes a billing block containing the account holder’s legal name and postal address. We read only four fields from that response — nickname, level, avatar, and server — and never store, log, or display the rest.

That data still passes through our server in transit every time a UID is looked up. We discard it immediately, but if you are not comfortable with it reaching a third-party server at all, do not add your UID here.

The code history page is public and can be read without signing in. It shows:

• every gift code we know about, when it was first seen, and whether it still works;
• how many redemption attempts succeeded across all users, as totals only — never broken down by person or UID;
• the Discord username of whoever submitted a code by hand, shown next to that code.

Your UIDs, their nicknames, and their individual results are shown only to you, in your own signed-in session. If you would rather your username not appear next to a code you submitted, ask us and we will remove it.

We process this data on the basis of your consent, given when you sign in and again each time you add a UID — the sole purpose is to do the thing you asked for, which is to redeem codes and collect the daily sign-in for the UIDs you listed.

Submission logs and rate-limit records are kept on the basis of our legitimate interest in keeping the service working and preventing abuse.

You can withdraw consent at any time by removing your UIDs, which stops all automation immediately, or by asking us to delete your account entirely.

• Discord — handles sign-in and tells us who you are.
• MongoDB Atlas — stores everything listed in section 2.
• Vercel — hosts the site and keeps request logs.
• store.topheroes.com — we send your UID and the gift code to the game’s own redemption endpoint. That transfer is the entire point of the service and cannot be opted out of while a UID is active.

These providers operate globally, so your data is stored and processed outside your own country, including in the United States. We do not sell your data, share it with advertisers, or use it for any purpose beyond the ones described here.

Removing a UID from your dashboard deactivates it immediately and stops all automation for it. The redemption and sign-in rows for that UID are retained, because they are the record that stops a code being redeemed twice for the same account.

There is currently no self-serve “delete my account” button. To have your account, your UIDs, and their history erased, email [contact@muralianand.in] from an address you can be reached at, or contact us with the Discord account in question. We will action it within 30 days and confirm when it is done.

Public code history entries are kept indefinitely — they are the point of that page — but they identify a person only where someone submitted a code by hand, and that username can be removed on request.

Whatever your jurisdiction, you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything inaccurate;
• erase your account and its data;
• stop processing, by withdrawing your consent.

If you are in India, you also have the right to nominate someone to exercise these rights on your behalf, and to raise a grievance with us before escalating to the Data Protection Board. Our grievance contact is [contact@muralianand.in]. If you are in the EU or UK, you may also complain to your national supervisory authority.

This site is not intended for anyone under 18. Under India’s Digital Personal Data Protection Act a child is anyone under 18, and processing their data requires verifiable parental consent, which we have no way to obtain. If you are under 18, please do not sign in or add a UID. If we learn that we hold a child’s data, we will delete it.

The site is served over HTTPS, the session cookie is signed and HTTP-only, and database access is restricted to the application. Note that the game’s store logs in with a UID alone — no password is involved anywhere in this system, so there is no game password for us to hold or to leak.

No service is perfectly secure, and this one is run as a hobby project rather than by a security team. Please do not treat it as a vault for anything sensitive.

If this policy changes we will update the date at the top of the page. If a change materially affects what we do with your data, we will say so on the dashboard.

[Murali Anand] — [contact@muralianand.in]. See also our Terms of Service.