Privacy policy

1Who is responsible

The data controller is Alexis Javaux, entrepreneur individuel (SIREN 832 506 539), SAS en cours de création, 8 quai des Chevillards, 59800 Lille, France. For any question about your data: contact@web-tcg.com.

2The data we process

• Your account: username, country, language, creation date, and a record of the terms you were shown when you signed up (version and date).
• How you sign in: your e-mail address if you use a code sent by e-mail, or your Google account identifier and the e-mail address it gives us if you sign in with Google (we never receive your Google password; the details are in “Signing in with Google”). A code sent by e-mail is only kept as a fingerprint and expires after 10 minutes.
• Your game: cards, dust, Webicoin, boosters opened, auctions, achievements, the history of your actions and the ledger of currency movements.
• Technical data: IP address and logs, used for security and to limit abuse, kept for a short time.
• Anonymous technical measurements: the errors your browser meets and how long pages take to load, with no identifier.
• When you sign in, or when you sell, bid on or give a card, signals from your browser (how the page runs) are analysed by an anti-robot service to tell a person from a program; they are used for nothing else.
• Your display preferences (sound, pace, mascot): they stay in your browser.

3Why, and on what basis

• To run the game and your account (performance of the contract).
• To protect the service and players against fraud, bots and abuse (legitimate interest).
• To meet our legal obligations, notably accounting ones when payments exist.
• To understand how the game is used through aggregated statistics, without tracking individuals for commercial purposes (legitimate interest).

We run no advertising, no commercial profiling, and we never sell data.

4Signing in with Google

You can sign in with your Google account. Here is exactly what we do with it.

• What we ask Google for: the “openid”, “email” and “profile” permissions, the minimum that allows a sign-in. We ask for access to nothing else (no contacts, Gmail, Drive or calendar) and we call no other Google API on your behalf.
• What we receive and keep: your Google account identifier and your e-mail address, which Google certifies as verified. With the “profile” permission, Google may also send us your name and profile picture: we do not store them and show them nowhere; your username is the one you choose in the game. We never receive your Google password and keep no token giving access to your Google account.
• Why: only to sign you in and find the same account again each time (including when you already signed in with a code sent to the same e-mail address) and, if payments are open, to know that your account is tied to a verified identity, which buying requires. Never for advertising, never for profiling; this data is neither sold nor shared with third parties, apart from our hosting (Vercel) and database (Supabase) providers, which act on our behalf.
• Where: in our database, at Supabase (region Irlande (eu-west-1)), like the rest of your account.
• How long: as long as your account exists. If you delete it, the Google identifier and the e-mail address are erased immediately.
• Deleting it: “Delete my account” on the My account page, or a message to contact@web-tcg.com.
• Revoking access: at any time at https://myaccount.google.com/permissions. This withdraws the permission given to Web TCG; what we have already stored stays until your account is deleted (or until you ask us at contact@web-tcg.com).

Web TCG’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

5Cookies and storage in your browser

We only use what the service needs: a session cookie to keep you signed in, a language cookie, and your browser’s local storage for your preferences. They are not used to track you or for advertising, so they do not require consent.

While you sign in with Google, a technical cookie lasting 10 minutes is used to complete the sign-in securely, then it disappears.

If Cloudflare’s anti-robot check (Turnstile) is turned on, it may set a technical item of its own, only to check that you are a person.

6Who receives your data

Our providers, who act only on our instructions:

• Vercel, which runs the site and provides the BotID anti-robot check (with its partner Kasada);
• Supabase, which hosts the database, in the Irlande (eu-west-1) region;
• Google, if you sign in with your Google account;
• Resend, our e-mail provider, for the sign-in codes sent by e-mail;
• Stripe, if payments are open: we never see your card number;
• Cloudflare, for the anti-robot check, if it is turned on.

Some of these providers may process data outside the European Union; those transfers are covered by the mechanisms the law provides (standard contractual clauses, the EU–US data protection framework).

7How long we keep it

• Your account and your game: as long as your account exists. If you delete it, your game and sessions are erased immediately and your profile is anonymised (username replaced, e-mail address erased).
• Sign-in codes sent by e-mail: valid for 10 minutes; their records are deleted after a day.
• The ledger of Webicoin movements: kept in pseudonymised form for accounting and fraud prevention.
• Booster history: 90 days. Technical logs and request keys: a few days to a few weeks.
• Site removal requests: 3 years after they are handled, so that we can justify our decisions.

8Your rights

You can access your data, get a copy, correct it, object to a processing, and ask for it to be restricted or erased.

• From your account: “Export my data” downloads everything we hold about your game; “Delete my account” erases it.
• For anything else: write to contact@web-tcg.com. We answer within one month.

If you think we are not respecting your rights, you can complain to the data protection authority of your country.

9Children

Web TCG is for a wide audience but does not seek to collect data about children. If you are under 15 (or the age set by the law of your country), use the game with the agreement of a parent or legal guardian. If you think a child created an account without it, write to us and we will delete the account.

10Security

Exchanges are encrypted, sessions are protected, sign-in codes are only kept as a fingerprint and sensitive actions are rate-limited. No system is infallible: if a data breach concerned you, we would tell you and the competent authority, as the law requires.

11Changes

This policy carries a version date. If we change it in a significant way, we will tell you before it applies.