GDPR & Data Protection

Our commitment

We treat the General Data Protection Regulation (GDPR) as a baseline, not a checkbox. We do not sell data, we do not run advertising or tracking profiles, and we never ask for payment details, addresses or identity documents — there is nothing to pay for on this platform. Every feature is designed around data minimisation: if the game does not need it, we do not store it.

What personal data we process

• Account: email address (for sign-in and account recovery) and, if you use Google sign-in, the basic profile details Google returns.
• Profile: display name, collector avatar and bio — all chosen by you and visible to other members.
• Game data: cards, Silver Coins, packs opened, daily claims, XP and season progress, battle results, rank and marketplace activity.
• Content: news comments, card reports, support tickets and private messages.
• Operational data: anonymous page-view counts and timestamps of actions, used to keep the service running and to detect reward abuse and multi-accounting.

We do not process special-category data (health, beliefs, biometrics). Please do not put sensitive personal information into your bio, messages or card content.

Legal basis for processing

• Contract: running your account, your collection and the game features you asked for.
• Legitimate interests: keeping the platform secure, preventing cheating and multi-accounting, moderating content and protecting younger members.
• Consent: anything optional, such as non-essential browser storage. You can withdraw consent at any time.
• Legal obligation: where we must keep or disclose information by law.

How we keep it secure

• All traffic runs over encrypted HTTPS connections, and data is encrypted at rest by our hosting provider.
• Passwords are never stored by us in readable form — authentication is handled by our managed auth provider.
• Every database table is protected by row-level security, so one account can never read another account's private data, even if a request is tampered with.
• Sensitive fields such as email addresses and coin balances are never exposed publicly. Public profiles are served through restricted server-side functions that return only safe display fields.
• Sensitive actions (coins, packs, moderation, administration) run server-side with permission checks, so they cannot be faked from the browser.
• Rate limits protect messages, comments, reports, listings and tickets against spam and abuse.
• Administrator access is limited to the accounts that need it and is used only to operate and moderate the platform.

How long we keep data

• Account and game data: for as long as your account exists.
• Silver Coin history: rolling 90 days.
• Page-view statistics: rolling 90 days, then deleted.
• Support tickets and moderation records: kept while needed to handle disputes and repeat abuse.
• When you delete your account, your personal data and game progress are permanently removed and cannot be restored.

Who else is involved

We use a managed hosting and database provider as our data processor to store and serve the platform, and an AI provider for optional card artwork and bio generation — prompts sent there are not used to identify you. We do not share your data with advertisers, data brokers or analytics networks.

International transfers

Our providers may process data outside the European Economic Area. Where that happens, the transfer is covered by the safeguards those providers offer, such as the European Commission's Standard Contractual Clauses.

Your rights

Under the GDPR you can, at any time:

• Access the personal data we hold about you.
• Correct it — display name, avatar and bio are editable directly in your profile.
• Delete everything: Settings contains a one-click account deletion that permanently removes your account and game data.
• Restrict or object to processing based on our legitimate interests.
• Port your data — ask us for a copy in a machine-readable format.
• Withdraw consent for anything optional, without affecting the service basics.
• Complain to your national data protection authority if you believe we have handled your data wrongly.

To exercise a right that is not a button in the app, send a support ticket or message an administrator in the app. We aim to respond within 30 days.

Children

The platform is free, ad-free and contains no real-money features, but it is not intended for children below the age of digital consent in their country without a parent or guardian's involvement. See our Parents & Guardians page for details, and contact an administrator if a child has created an account without permission — we will remove it.

Data breaches

If a breach ever occurs that is likely to affect your rights, we will notify the relevant supervisory authority within 72 hours and inform affected members without undue delay.