Privacy & consent

What xphero.fans collects, what it deliberately does not, and every control you have over advertising and data.

Last updated 4 November 2026

The short version

No accounts, no sign-up, no newsletter, no contact forms.
No first-party cookies, no analytics, and no tracking scripts of any kind.
Every tool on this site runs entirely in your browser — what you type never reaches us.
Advertising is provided by NitroPay, which brings its own IAB-registered consent platform (CMP). You can reopen it at any time with the “Privacy settings” button in the footer of every page.

Who we are

XPHero Fans (xphero.fans) is an unofficial fan site for the mobile game XP Hero. It is not affiliated with Supercent or the game's developers, and this policy covers only this website — not the game, which has its own privacy policy.

What we collect

Nothing you type into the tools

The DPS calculator, Hero Builder, Progress Tracker and World Map are plain static pages: the calculations happen in your browser and nothing is sent to a server. Some tools can put a saved build or a progress state in the page URL so you can share it as a link — that data lives in the link you copy, not in a database of ours.

Server logs

Like any website, our hosting provider records standard access logs for the files you request: your IP address, the browser's user-agent string, the URL requested and a timestamp. They exist to serve pages, keep the site up and stop abuse, and are kept for a short period by the host.

Nothing else

No first-party analytics product, no session recording, no advertising identifiers set by us, no cookie set by this site's own code.

Advertising

Advertising on xphero.fans is provided by NitroPay, an ad partner that sells our inventory to demand partners. Which exchanges are authorised to sell it is published in our ads.txt. When no ad script is loaded on a page — for example during a rollout — no advertising cookies are set at all.

Advertising is what pays for the site. There are no paywalls and no sponsored content disguised as an article.

Declaration — CMP resurfacing button: an IAB-registered consent management platform is implemented on this site, and the CMP resurfacing button is implemented on every page. Visitors can reopen the consent dialog at any time from the “Privacy settings” control in the footer, which is present site-wide, needs no navigation away from the page, and also appears here:

NitroPay's ad library bundles NitroPay's own IAB-accredited CMP, which collects and records consent for visitors in the EEA, the UK and Switzerland under IAB TCF v2.2.

How the resurfacing control works

IAB requires the first prompt to be shown automatically; the CMP handles that on first visit.
Once a choice is stored the prompt is not repeated on its own, so every page of this site carries a permanent Privacy settings button in the footer, next to the CMP's own consent-link slot (#ncmp-consent-link).
The button calls the CMP directly (__cmp('showModal'), with the IAB-standard __tcfapi('displayConsentUi') as the fallback), so a visitor can review, change or withdraw a choice without leaving the page.
Where no CMP is loaded — readers outside the GDPR regions, or any page served before the ad script is present — the same button says so and links to this section.

Withdrawing consent stops personalised advertising; ads may still be shown on a non-personalised basis. Consent can also be withdrawn by clearing this site's data in your browser, which removes the stored consent string.

California privacy rights (CCPA/CPRA)

Declaration: xphero.fans declares that it complies with the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), including the right to opt out of the sale or sharing of personal information and the right to limit the use of sensitive personal information. The opt-out control is below and in the footer of every page.

Categories we handle

Identifiers and internet activity (IP address, user-agent, pages requested) in the server logs described above.
Advertising data — once advertising is live, our ad partner and the exchanges listed in ads.txt may process device and browser identifiers and the pages you visit in order to serve and measure ads.
Sensitive personal information: we do not collect it, and we do not use or disclose it for any purpose beyond serving this site.

Sale and sharing

We do not sell personal information for money. Personalised advertising can count as “sharing” for cross-context behavioural advertising under the CPRA, so we treat ad personalisation as sharing and give you a direct opt-out.

Do Not Sell or Share My Personal Information

Use this control to opt out of the sharing of personal information for personalised advertising:

We also honour the Global Privacy Control (GPC) browser signal: if your browser sends it, we treat it as a valid opt-out request for the ad personalisation our ad partner controls.

Your other California rights

Know what categories of personal information are collected, and request a copy of it.
Delete personal information we hold. In practice this means the server-log entries described above — we keep no profiles or accounts to delete.
Correct inaccurate personal information.
Non-discrimination: we will not deny you the site, charge you a different price, or give you a lower level of service because you exercised a privacy right here. Everything on the site is free either way.

Requests are handled within 45 days as the CCPA requires, and we may ask for enough detail to verify a request relates to you. An authorised agent may submit a request on your behalf with written permission.

Other US state privacy laws

Residents of other US states with comprehensive privacy laws (for example Virginia, Colorado, Connecticut, Utah, Texas and Oregon) can exercise the same rights — access, deletion, correction, and opt-out of targeted advertising — using the controls on this page. We do not sell personal information, so no “sale” opt-out beyond the advertising control is required.

Your rights in the EEA and UK

Where the GDPR or UK GDPR applies, you have the right to access, rectify, erase or restrict processing of your personal data, to object to processing, to data portability, and to withdraw consent at any time. Withdrawing consent does not affect processing that already happened. You also have the right to lodge a complaint with your local data protection authority.

Children

This site is a game reference aimed at a general audience and is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided personal information here, contact us and we will delete it.

Third-party links

Pages on this site link out to the game's official Google Play and App Store listings, our Discord server, and other sites. Once you follow such a link, that site's own privacy policy applies — ours stops at the link.

Changes to this policy

When this policy changes, the “last updated” date at the top changes with it. Material changes — a new ad partner, a new category of data — will be called out in the blog as well.

Contact

Questions, or a privacy request: our Discord server is the fastest route. We answer privacy requests there and by any address used to reach the site's operators.