1. Controller

Jonas Grøndahl, Denmark, is the data controller for this service. Privacy requests can be sent to jonas.groendahlxd@gmail.com. Please send a request from the email associated with your account when possible.

2. Data processed

Depending on how you use the service, the following data is processed:

• account identifiers, email address, username, profile image, and Google OAuth records;
• sessions, IP address, user agent, security events, and authentication records;
• player name, avatar, cosmetics, and age/content preferences;
• active games, game seats, invite codes, completed game history, and custom decks;
• league entries, attempts, results, ranks, and rewards;
• feedback, moderation results, and support correspondence;
• privacy-conscious usage analytics and basic technical diagnostics;
• local browser storage for preferences, onboarding, and resumable game seats; and
• voice-chat signalling and peer connection metadata. Voice audio is sent between players and is not intentionally recorded or stored by this service.

3. Purposes and legal bases

• Contract: creating accounts, authenticating users, saving decks, operating games, and providing requested account features.
• Legitimate interests: securing the service, preventing abuse, moderating player names, diagnosing faults, measuring basic usage, and maintaining fair play.
• Consent: optional settings or features where consent is requested, including enabling adult-content preferences. Consent may be withdrawn.
• Legal obligation: responding to valid legal requests and keeping records when required by law.

4. Providers and recipients

The production service uses these processors or external recipients when their feature is enabled:

• Railway for application hosting and operational logs;
• Neon for the hosted PostgreSQL database;
• Google for optional OAuth sign-in and public STUN infrastructure used to establish peer-to-peer voice connections;
• Resend for verification, password reset, and account-deletion email;
• Umami Cloud EU for privacy-focused website analytics; and
• TypeSafe/JEV for automated player-name moderation.

Other players receive the name, avatar, game actions, and voice data needed for a match. No PayPal, advertising, or donation processor is integrated. Providers may process limited technical data under their own privacy terms.

5. Retention

Account profile, custom decks, league records, and account-linked game history are generally kept while the account exists. Sessions remain until logout, expiry, revocation, or account deletion. Active game snapshots remain while needed to resume or operate a game. Completed game results, feedback, moderation records, analytics, and operational logs do not currently have a guaranteed automatic deletion schedule and may remain until manual cleanup, provider expiry, or deletion of the related account. Do not submit sensitive information in feedback.

Account deletion removes custom decks, sessions, account and league records, and completed games involving that account. It detaches the account identifier from active game seats so anonymous seats can finish. Local account and saved-game data is cleared in the browser that completes deletion. Anonymous, aggregated, legally required, or backup data may persist until it is overwritten or no longer required.

6. International transfers

Some providers may process data outside Denmark or the European Economic Area. Where required, transfers rely on an adequacy decision, EU Standard Contractual Clauses, the EU–US Data Privacy Framework, or another lawful safeguard offered by the provider.

7. Security

Reasonable technical and organisational measures are used, including hashed passwords, verified email flows, scoped session cookies, access controls, rate limits, and encrypted transport. No online system can be guaranteed completely secure, so use a unique password and do not share private game or verification links.

8. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, data portability, or an objection to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. You may also complain to the Danish Data Protection Agency (Datatilsynet) or your local supervisory authority. Identity verification may be required before a request is completed.

9. Children

The service is not intended for anyone under 16. If you believe a child has provided personal data, contact the operator so it can be investigated and removed.

10. Changes

This policy may change when features, providers, or legal requirements change. The effective date above identifies the current version. Material changes will be communicated appropriately.