Privacy

Last updated: 4 November 2026. This page covers the game Helion Rift (including its Steam Playtest) and the TokkeBe Games websites.

The short version

Helion Rift has no ads and no payment forms inside the game. Any paid extra content (DLC) is bought on Steam, which handles the payment, so I never see your card details. I never sell your data and never share it for advertising.

Online play needs a random player ID and your IP address, handled by Unity. Opening COMMUNITY maps downloads a map list from storage that Cloudflare runs for me.

If you host a match, your Commander Name is shown in a public list of open matches. Use a callsign, not your real name.

Lobby chat is on. Its text is kept by Vivox, a Unity service, for 7 days.

A bug report leaves your PC only when you click SEND REPORT, or when you send one through the report form on the website.

Steam: while you sit in a public lobby, your Steam friends can see "In a lobby" and a JOIN GAME button. The Workshop screen shows the Steam names of other players as map authors. The game does not read your own Steam name, Steam ID or friends list.

If you publish a map to the Steam Workshop, your Steam name and the author name inside the map are both shown to everyone.

These websites set no cookies and run no analytics.

Who is responsible

Helion Rift is made by Tim Van Horebeek, trading as TokkeBe Games, in Aarschot, Belgium. Under the EU data protection law (GDPR) I am the controller of the personal data described here. This is a one person studio. Contact for anything about privacy, and for reporting abuse or illegal content: privacy@tokkebegames.com.

Data that stays on your PC

Settings, key bindings, your Commander Name, a Unity sign in token and installation ID, reconnect codes, a match count, your mute list (player ID, name seen, date; at most 100 entries; removed after 365 days), maps, replays (the hosting PC records them by default, with every player's Commander Name; newest 50 kept; you can turn recording off), a match archive of your newest 20 matches holding a copy of the log with your Windows user name removed, the replay and a small info file, kept so that you can send them with a bug report, bug report drafts, Player.log and log.txt (can contain your Windows user name in file paths; look before you send them). A map you download from the Steam Workshop is stored by Steam in its own Workshop folder on your PC.

Settings live in the registry key HKEY_CURRENT_USER\Software\TokkeBe Games\Helion Rift; files live under %USERPROFILE%\AppData\LocalLow\TokkeBe Games\Helion Rift\. If you played the earlier build "Leopard: Helion Rising", the game may copy its saved data to the new places on your PC and never deletes the old ones. There is no "delete my data" button yet: delete those places yourself.

Online matches

Online play uses Unity Gaming Services (Authentication, Lobby, Relay, Vivox). Unity acts for me as a processor under its Data Processing Addendum. Unity processes data partly in the EU and partly in the United States, Brazil, Asia and Australia; I cannot choose the region. Transfers outside the EU rest on the Standard Contractual Clauses in Unity's addendum.

What is processed: a random player ID and installation ID, your IP address and match traffic through a Unity relay, lobby data other lobby members see (player ID, Commander Name, faction, team, color, ready state, join code), and your Commander Name in the public list of open matches if you host. Without the player ID and IP address, online play does not work; solo play needs neither.

Unity's own retention figures (read 1 October 2026): Relay 30 days, Lobby up to 30 days, Authentication until deleted. One player's PC hosts each match; I keep no match history, results or rankings. A map you save carries your Commander Name as author.

Community maps

Opening the COMMUNITY maps screen downloads a map list, previews and chosen maps from leopard-cdn.tokke.be, run by Cloudflare for me, so Cloudflare sees your IP address and the request. The game adds no identifier of its own. I run no map submission server: you cannot upload a map to me. You can share a map with friends, and it transfers to a friend who joins your match. Publishing a map is done through the Steam Workshop (see "Steam").

Chat

Match chat goes between the players in that match via the hosting PC, up to 200 characters; I do not store it, the game does not save it and it is not in replays.

Lobby chat is text only, runs on Vivox as my processor, and Vivox keeps your player ID, a device ID and a shortened IP address up to 30 days and your messages 7 days. Lobby chat rests on my legitimate interest (GDPR Art. 6(1)(f)); you can object by muting, leaving or not opening chat. Everyone in the lobby sees what you type. The built in chat filter runs on your PC and its word list is currently empty.

To report abuse, write to the contact address above with the day, the lobby or map and the Commander Name. A chat report is kept 90 days from the day I answered it, then deleted.

How bug reports are handled

You can report a bug in two ways: the report button in the game, or the report form on the game's website.

In the game. SAVE REPORT keeps a zip on your PC and sends nothing. SEND REPORT sends it once, when you click; it is always your choice. A sent report holds what the form lists before you send: a screenshot if you keep it on (lobby chat panel left out), the game log with your Windows user name and PC name removed, the match replay if you keep it on (human player names replaced by seat numbers), match and performance details, a summary of your PC (Windows version, processor, graphics card name and graphics driver version, memory, screen size), the game build, a map file only if you add one, and what you type, including a Discord name if you type one. The game tries to remove chat messages, Commander Names, account IDs, join codes and IP addresses automatically. It is not perfect, so look before you send.

On the website. The form asks for a title and a description. Everything else is optional: what you expected, steps, map, faction, mode, host or guest, how often, build, one screenshot, and your Discord name. You must tick a box to confirm you checked the notice. Your browser turns the screenshot into a JPEG, which removes camera and location data. A screenshot can still show your name, other windows or a chat, so check it. Your Discord name is stored apart from the report and is not posted anywhere.

Basis. The basis is my legitimate interest in fixing the game (Art. 6(1)(f)); you can object at any time. Sending is optional and not sending has no effect on you.

Where it is stored. Cloudflare, a US company, stores the zip in private storage in the EU and runs the upload, as my processor. While your report arrives, Cloudflare's servers see your IP address like any web service; the upload service has request logging switched off and I do not store your IP address with the report. Where data is transferred outside the EU, Cloudflare's data processing terms provide the safeguard. The written part of a report is stored together with the zip and appears in a short text post in a private Discord forum (title, your text, build and match details, Report ID); the zip and screenshot are never posted; invited testers can read the post. The post is removed in a monthly clean up, at most 90 days after you sent it. Until the clean up script has run once, I remove old posts by hand each month, and each time I remove every post older than 60 days, so that none stays past 90 days.

How long. The stored zip and my downloaded copies are deleted within 90 days of sending. Until the storage has an automatic delete rule, I do this by hand, at least once a month, and each time I delete everything older than 60 days, so that nothing stays past 90 days. To ask for a copy of your report, or to have the report and its forum post deleted or withdrawn, write to privacy@tokkebegames.com and give the Report ID. If you lost it, give the day, the map and the title. Withdrawing is as easy as sending: one mail is enough, with no reason. I answer within one month. The full notice is also in the game folder as PRIVACY-BUG-REPORTS.txt.

Other players. A replay or log in a report can show what other players did in a match. Their names are replaced by seat numbers. If you played in a reported match you have the same rights as the sender.

Who reads reports. Only I do, on my own PC. Invited testers can read the forum post (see above), not the zip or the screenshot. Since the bug report upload service went live and up to 8 October 2026 I also gave the written text of some reports to Claude, an AI assistant made by Anthropic, a US company, through Claude Code, to help sort them. Claude received no zip and no screenshot. I have deleted every summary Claude wrote, and I keep none. Since 9 October 2026 I give report text, zips and screenshots to no outside service.

Steam

Helion Rift is delivered through Steam, run by Valve. Your Steam account, purchases, refunds and key activations are Valve's, under Valve's privacy policy. I never see your payment details, address or real name.

Friends and JOIN GAME. While you are in a public lobby, the game tells Steam two things: the text "In a lobby", and the lobby code that makes the JOIN GAME button work. Steam shows them to your Steam friends, within your Steam privacy settings. The game removes them when the match starts, when you leave the lobby and when you quit. In a private lobby it offers no JOIN GAME code. During a match it shares nothing. It does not send your faction, map, score or name to Steam. I keep nothing of this. Valve handles it as part of Steam.

Workshop. The Workshop screen asks Steam for a list of maps. For each map, the game asks Steam for the Steam name of the player who made it and shows it as the author. The game does not read your own Steam name, your Steam ID or your friends list. When you press Download, Steam subscribes your Steam account to that map and downloads it. Steam keeps that subscription on your account, and you can remove it in Steam. When you publish a map, the game sends Steam the map files, title, description, tags and an optional preview picture, and you choose public or private. A public map shows both your Steam name and the author name saved inside the map (your Commander Name unless you changed it). Valve stores and shows the map under the Steam Workshop terms. A published map stays until you remove it, or until Valve or I take it down. I receive no copy of your map from the game. For all of this Valve is its own controller.

The game does these things on its side because you click for them (JOIN GAME, Workshop) and because I have a legitimate interest in a working game (GDPR Art. 6(1)(b) and (f)).

Playtest invitations

If I gave you a Steam key for the Playtest, I keep a private list on my own PC with the key, the name or handle I know you by and the date I sent it, until the Playtest phase ends or you ask me to delete it. Basis: my legitimate interest in running a small invited test.

What happens when you visit the websites

Both sites are hosted by Cloudflare. Like any web host, Cloudflare's servers process technical data such as your IP address to deliver the pages and protect them from abuse. I only see aggregate request counts, not individual visitors. The sites set no cookies, run no analytics and embed nothing from other companies. Basis: my legitimate interest in running a safe website. Buttons for Steam, Ko-fi and other platforms are plain links; once you follow one, that site's own privacy policy applies.

When you email me

I keep your message and address to answer you, and I do not use them for anything else. Mail is handled by Runbox (Norway).

I keep it for 12 months after the last message in the conversation, then delete it.

Ko-fi

If you support me on Ko-fi, that happens on Ko-fi's own site, under Ko-fi's privacy policy. Ko-fi is responsible for your payment and account.

I see what Ko-fi shows me: the name you give, the amount, your message and (if shown) your email address. I use it only to thank you and to keep my accounts. I never sell it. I do not add anyone to my newsletter from Ko-fi; that needs its own sign up.

The live studio floor

TokkeBe Games is one person, based in Belgium. The live studio floor is a small page that shows a playful picture of work happening: lit up while work is going on, quiet when it is not. The people in the picture are illustrated characters, not real people.

The page keeps an open connection to show the floor live. No cookie, no storage, no tracking. This page's own code collects no visitor information. It sets no cookie for visitors, uses no browser storage and runs no analytics or tracking of any kind. You do not need to log in or give any detail to watch it. Like every website, it still has to be delivered over the internet, and the company that delivers it sees your IP address while it does (see the Cloudflare paragraph below).

To stop one person taking every seat, the page keeps a scrambled, non-reversible stand-in for your address, only while your connection is open. It is made with a secret key, it cannot be turned back into your address, it is kept only as a label on your open connection (while the floor sleeps between visitors, Cloudflare's runtime holds that label for me), my code never writes it to a log or to a database, and it is dropped when your connection closes.

What the floor shows and keeps is the floor itself: whether the lights are on, which of twenty four seats are filled, a one letter status for each seat (one of six: arriving, working, waiting, on a break, idle at a desk or gone), a role label for each figure and a display name for each figure. The role label is one word from a fixed list of ten (Architect, Advisor, Planner, Engineer, Artist, Promo, Writer, Records, Analyst, Designer), plus Commander and Assistant for the two fixed drawn characters. The display name is a first name of letters only, at most eight. It comes from one of three places: normally a made up first name from my own list of invented names; or a name I set myself for a role with my own name command; or, for a sponsor who gave their written yes, the name that sponsor chose. The code checks only the shape of a name, not what it means. Both are drawn on the figure's desk or above its head, in the picture. Each job sits at its own fixed desk, so the room it sits in (Architect office, Tech Ops, Art pod and so on) says the same as its role label and shows nothing more. The picture also holds two fixed drawn characters, the commander at his desk while the floor is lit and his assistant Ines in the corridor, whose lamps light when a question waits. They are static art driven by the same two lit and waiting signals, not by any data about me. The made up names do not belong to real people, and no name is ever a task, a prompt, a file name or any other text about the work. Nothing else about the work is shown.

The last 64 pictures, which include the roles and names, are stored so a new visitor can catch up; a new visitor is sent only the last minute of them. Each stored picture stays until a newer one replaces it. When the floor stands down, 63 of them keep their roles and names until newer pictures replace them. If a sponsor withdraws their name, it stops showing on the floor usually within minutes and at the latest within 24 hours, the same as on the Garrison Log. It is removed from storage when newer pictures replace it, not sooner. I keep daily visitor counts as the newest 35 daily rows, one row per day the floor ran, so the oldest row is dropped when a new one is added: how many connected, the peak number connected at once and how many were turned away. These counts hold no personal data. Nothing is kept about who visited, and this feature's own code does not store or log any visitor IP address.

The page shows a small line such as "3 watching". It is the number of pages that have the floor open at that moment, nothing more. The server counts the open connections and sends every open page a bare number. The live number itself is not stored and not written to a log. The only thing kept from it is the highest number seen on each day (the daily peak described above), held for 35 days with no link to your address or to anything else about you. A person with two tabs open counts twice.

Task cards. When you click or tap a figure, a small card can show one short line about the kind of work that figure is doing, such as "Reviewing patch". That line is not text that I or my tools wrote down. It is put together from a fixed list of 143 plain words (review, patch, tests, shader and so on), at most four words and forty characters. Any word that is not on the list is thrown away, so a file name, a project name, a person's name, a link or a secret cannot get through. The list is checked in my studio tool, on my PC and on the server. If nothing on the list fits, the card has no task line. No line is shown for figures that are idle or gone, and none while private mode or photo mode is on. A sponsor's figure can show a task line next to the name the sponsor chose. Task lines are sent live to open pages only. They are not part of the 64 stored pictures and are not kept on the server. The list is fixed and changes only with my approval, but a line that has been sent can be copied by anyone watching and cannot be recalled. I can switch task lines off at any time.

Small talk. Now and then a figure, or two figures at neighbouring desks, show a short speech bubble. These lines are scripted. They come from a fixed library of 125 lines (51 entries) that I wrote in advance, and they are chosen by the clock and by who sits where. They are not what my agents or I actually said, and they never come from a task, a prompt or any text about the work. Only a line number travels over the connection, never the text itself. The bubbles are decoration: they are not real conversations. A sponsor's figure may speak these lines too. They are left out in private mode, photo mode and quiet mode. A button on the page turns them off for your visit; it remembers nothing after you leave. They are sent live to open pages only and are not part of the 64 stored pictures. I can switch them off at any time.

Who delivers the page. Cloudflare serves the page and carries the connection for me. For this feature Cloudflare acts as my processor: it follows my instructions and does not decide what the data is used for. While it delivers the page, Cloudflare processes connection data, which includes your IP address. This feature's own code does not store or log that address. The floor picture is stored in a Cloudflare Durable Object that I have set to Cloudflare's EU jurisdiction, which Cloudflare documents as a hard limit on where that object runs and keeps its data. The page itself is delivered through Cloudflare's network, which can answer from outside the EU.

Abuse protection. I use one Cloudflare rate limit rule to block a program that opens connections far too fast. When it blocks one, Cloudflare records a security event that includes that visitor's IP address, and I can see it in my Cloudflare dashboard. I do not copy, export or use these events for anything else.

Why, and the basis. The reason is to show you the page and keep it working against abuse. It rests on my legitimate interest in running a small public page safely (GDPR Article 6(1)(f)). Where a sponsor's chosen name is shown, the basis is that sponsor's written yes (Article 6(1)(a)). You can object at any time, see Your rights below.

How long. This feature keeps nothing about who visited. The recent pictures are replaced as newer ones arrive, and the daily counts are kept as the newest 35 daily rows. The security events from the rate limit rule above, which include an IP address, are kept by Cloudflare for 31 days, the period Cloudflare's documentation gives for security events on the free plan, which is the plan I use. Cloudflare keeps its other connection records for its own period, which I neither lengthen nor shorten.

Your rights. You can ask me for access to data about you, for it to be corrected or deleted, for its use to be limited, and you can object to it. Where the basis is your consent (the sponsor names on this page and on the Garrison Log), you can withdraw it at any time, and that is as easy as giving it. To ask or to object, write to the contact address above. If you think I handle your data wrongly, you can complain to the Belgian data protection authority: the Gegevensbeschermingsautoriteit (GBA), in French the Autorité de protection des données (APD).

The Garrison Log

The Garrison Log is a small page of studio counters, such as operations this week and the longest shift. It also lists Ko-fi sponsors by the name they chose, next to a count.

A sponsor name is personal data. It is shown only with the sponsor's written yes, which is the basis for it (GDPR Article 6(1)(a)). The Leopard Commander tier is for adults only. That is a rule I apply myself: I ask you to confirm it in our written exchange and I note it by hand in a private record. No program checks anyone's age. You can take your yes back at any time. When you ask, I turn the name off in my studio tool, which rewrites the local file at once. While my upload program runs, the page follows, usually within minutes. If my PC is off, the page hides every sponsor name once the last upload is more than 24 hours old. So a name comes down usually within minutes and at the latest within 24 hours. That stops it showing from then on, but I cannot undo that someone saw or copied it while it was up: the page data is public and others can archive it.

Names also come down when a sponsorship ends. I type an end date for each name by hand, about 7 days after the last paid period I see on Ko-fi. My code never reads Ko-fi, so it does not know whether a membership is still active: the name stays up until that date has passed, and I check the memberships myself. After that date, my upload program drops the name at midnight on my PC, and the 24 hour limit above covers a PC that is off. The sponsor's entry is deleted from my studio tool when the 14 day hold that follows the end date runs out.

The names are kept in Cloudflare Workers KV, which cannot be restricted to the EU, under one key that Cloudflare deletes by itself 24 hours after the last upload. The counters sit under a second key that never expires and holds numbers only, no names. An older key from before 4 November 2026 can still hold an old copy of the sponsor list until it expires on its own, about 12 November 2026. The page never shows names from it. Copies may sit in my own backups until those are next rotated. I do not promise that a backup copy is deleted the same day. I keep a private note of when each yes was given, which wording it covered and when it was withdrawn, so I can show what you agreed to.

The page sets no cookie for visitors and uses no tracking. While its preview gate is on, it sets one cookie, named __Host-gv, but only in the browser of the person who opens the page with the owner's preview key. It is HttpOnly and Secure, and it lasts 30 days. An ordinary visitor never gets it. This feature's own code does not store or log any visitor IP address. The same Cloudflare statements as for the studio floor apply, and so do your rights below.

Who else receives data

Unity (processor: online play and lobby chat); Cloudflare (processor: bug report storage, the Community maps download and the websites); Discord (its own controller: the report forum post); Anthropic, a US company (its assistant Claude received the written text of some bug reports until 8 October 2026; see "How bug reports are handled"); Valve (its own controller: selling and running the game, the "In a lobby" status your Steam friends see, and the Workshop); Mailjet (processor: newsletter); Runbox (processor: email); Ko-fi (its own controller: supporter payments); your Steam friends (the lobby status and JOIN GAME button); other Workshop users (your Steam name as author of a map you published); other players in your match.

Where data is transferred outside the EU, the data processing terms of Unity and Cloudflare provide the safeguard. For Anthropic and Discord, both US companies, I have not checked the transfer terms yet. I never sell personal data.

Your rights

You can ask me for a copy of your data, to correct it, delete it, limit its use, move it, or stop using it where I rely on legitimate interest. Write to the contact address above. It is free. I answer within one month, extendable by up to two more months for a complex request, and I will tell you within the first month. Unity has no self service deletion for Relay, Lobby or Vivox; I ask Unity for you, quoting the player ID. Online play is anonymous, so I may need a Report ID, or the day and map, to find your data. You can complain to the Belgian Gegevensbeschermingsautoriteit, Drukpersstraat 35, 1000 Brussel, contact@apd-gba.be, or to the authority where you live.

Children

Helion Rift is not made for children. If you are under 16, ask a parent or guardian before you play online or send a bug report. I do not knowingly collect data from children under 13.

Security and changes

I hold very little. Bug reports sit in private EU storage. If a breach happens I tell the Belgian authority within 72 hours unless it is unlikely to risk your rights, and tell you directly if the risk is high. Every new version of this page is published at this address with a new date, and when a game version adds a new kind of data the page changes in that same version, before the feature reaches you. This page is in English.

Last updated

4 November 2026