Privacy

• We keep what the game needs to run: your account, your collection, your coins, your trades and your settings.
• We don't sell your data and we don't show advertising.
• The game doesn't load advertising or analytics from other companies.
• You can see, export and delete your data yourself, from the account screen.
• There is no chat. Other players only see what you choose to show, and what you type is limited to your display name and bio.

Your account: your email address, your password (kept only as a one-way hash, so nobody can read it), your handle, display name and bio, and your language and edition. We need them to sign you in and to run your account.

Your game: your collection and how you got each card, the packs you opened, your coin ledger, your listings, bids and trades, your quests and stamps, your showcases and shares, your challenge results and your notifications. We need them to run the game and to keep it fair.

Your devices: for each device you sign in on, a random device key, the kind of browser, and when it was first and last used. We use it to show you where you're signed in and to spot abuse.

Safety records: the network address and the time of actions that matter for security, such as signing in, changing a password, trading or sending a report, and the decisions that moderators make. We use them to protect players and the service.

Guests: a guest album is tied to a random identifier on your device. It has no email address and no name.

Rights requests: whoever sends a request through the report form gives a name and an email address. We use them to answer that request.

We don't ask for your real name, your phone number, your address, your birth date, your location or your contacts.

The game sets a cookie that keeps you signed in, a cookie that protects its forms against forgery, and a cookie that remembers your language and theme so that pages open the way you like them.

Your browser also stores your settings, a copy of your album for when you're offline, and actions that couldn't be sent yet. If you allow notifications, it stores the subscription that lets us send them.

All of this is needed for the game to work. None of it follows you to other sites. You can clear it in your browser, and you will be signed out.

Your privacy settings decide who can see your profile, collection, showcase, wish list and activity: everyone, friends or only you. Guests are private.

A shared pull, set or showcase can be seen by anyone who has its link, until you stop sharing it.

Other players never see your email address, your password, your wallet, your devices or your notifications.

Our staff can see account data when they need to for support, safety and moderation. Their actions are recorded.

We don't share your personal data with other companies for their own purposes. The game runs on servers and services that we use to run it, such as hosting and, when it is turned on, email delivery. They handle data only on our behalf.

To tell people from bots, the game asks your browser to solve a small puzzle by itself. If the operator turns on the optional Cloudflare Turnstile check, your browser also contacts Cloudflare for it.

We may share data when the law requires it.

• Feed entries and notifications: 30 days.
• Sign-in sessions: they end 30 days after you last used them.
• Devices: 90 days after you last used them.
• Detailed results of opened packs: in full for 180 days, then archived. A shared pull keeps its own copy for a year, or until you stop sharing it.
• Records of security and moderation actions: 400 days.
• Rights requests: 2 years after the decision, then the name and contact details are erased.
• Export files: they expire and are deleted automatically.
• Your account data: for as long as you keep the account. When you delete it, it is hidden at once and removed for good after a waiting period in which you can cancel.

Some records of coins, trades and audits stay after a deletion in anonymised form, so that totals and logs stay correct. Technical server logs are kept for a short time.

You can open, correct and export your data yourself: change your profile and email in the account screen, export a copy there, and choose who sees what in your privacy settings.

You can delete your account from the account screen, and turn notifications off in your settings.

Depending on where you live, the law may give you more rights, such as asking us to restrict or stop using your data, or complaining to the authority that supervises data protection in your country. To use a right that you can't use yourself, write to us as described below.

When we change this policy in a way that matters, we publish the new version here with a new version number, and we tell you in the game.

The game has no public mailbox. To report a problem with a card, use the report form. Everything else about your data you can do yourself from the account screen and the privacy settings.