Datenschutzerklärung

This page explains what personal data WikiTCG processes, why, for how long, with whom, and how to exercise your rights. The data controller is Vaxel, sole proprietorship (entreprise individuelle), 254 rue Vendôme, 69003 Lyon, France — contact@vaxel.fr. The game sells no data, shows no advertising and does no advertising profiling.

1. Data processed

Your account

Email address (except for guest accounts) and its confirmation, authentication identifier, username and display name, avatar (your Google account photo, or the image you upload), language, game settings (card back, border, blurring of sensitive images…), sign-up date and last seen time.

Your game

Collection, decks, packs opened, matches and how they unfolded, trades, bids and sales, friends, clan, messages between players and in clans, achievements, leaderboards, notifications, warnings and sanctions. Your username, avatar, border, clan, rank and record are visible to other players.

Your purchases

Offer, amount, currency, date, payment status, Stripe payment identifier, and the time at which you requested immediate performance and waived the right of withdrawal. Your card details are entered with Stripe and never reach us.

For a purchase made in the iOS app: the transaction signed by Apple — its identifier, the product, the price and currency, the date, and whether it is a real or a test purchase — and a game-account identifier the app attaches to it. Apple sends us neither your Apple identity nor your payment details; it tells us when a purchase is refunded.

Security and anti-cheating

The IP addresses you connect from are associated with your account, together with your browser family (for example “Firefox · Windows”) — never the full header — day by day. Game activity (pack-opening rhythm, trades, sales, matches) is analysed to detect automation and multiple accounts. These analyses decide nothing on their own: a person reviews each case before any measure is taken.

Referrals

If you invite a friend, or come through a friend’s invitation: who invited whom, when, and what the invitation earned. To make sure an invited friend really is another person, the game compares the two accounts — their IP addresses, their browser and their device fingerprint — and checks that the friend did not sign up through a VPN or with a disposable email address. The device fingerprint is a hash computed by your browser from a few of its characteristics (screen, graphics processor, how it renders a drawing and a sound); nothing is written on your device to obtain it, and it is computed at two moments only: when you open the “Invite a friend” window, and when you sign up through an invitation. An invited friend’s email address is also kept as a hash, so that the same mailbox is invited only once.

Reports

You can report a player from their profile, for a reason chosen from a list. We keep who reported whom, the reason, any details added and the outcome. The reported player never learns who reported them; the reporter only learns that the report has been reviewed. To assess a report, the team may read what the reason concerns, and only that: the profile picture and username (including those the player used before, see below), the messages exchanged between the reported player and the reporter, the reported player’s messages in a clan they share, and the matches and trades they had together. Never their conversations with other people.

When you change or remove an uploaded profile picture, or change your username, the previous version is kept, readable by the team only and only to handle a report: otherwise, changing it would be enough to erase what you are reported for.

Audience measurement

For each page viewed: the page, where you came from (referring site, campaign parameters), the country — derived from the IP address for the duration of the request, the address itself not being kept —, the screen shape, two random identifiers (for the browser and the visit) and, if you are signed in, your account.

Discord

If you link your Discord account, its Discord identifier, to give you your rank role and the server’s gifts. Nothing else is kept from your Discord account.

Your messages

The emails you send us, and our replies.

2. Why, and on what basis

3. For how long

4. With whom

Only the game’s team accesses your data, to the extent necessary. Providers process it on our behalf, each for its own part:

• Google (Firebase Authentication): your sign-in credentials;
• Stripe: your payments on the website, and the receipt emailed to you;
• Apple: your purchases in the iOS app, and their refunds;
• Resend: sending the other service emails (address confirmation, forgotten password) and game news;
• Discord: account linking, if you request it.

The site itself is hosted by the publisher, in France. Google, Stripe, Apple and Resend may process data outside the European Union, notably in the United States; these transfers are covered by the safeguards provided for by the GDPR (a European Commission adequacy decision or standard contractual clauses).

5. Cookies and local storage

The site sets no advertising or social media trackers. It uses:

Your browser also keeps, in its local storage, your sign-in state (Firebase) and a few settings, such as the sound volume. Referrals also read a few characteristics of your device to compute its fingerprint, without writing anything on it (see “Referrals” above).

6. Your rights

You may access your data, have it corrected or erased, restrict its processing, object to processing based on our legitimate interest — including audience measurement —, receive your data in a reusable format, and set instructions for what happens to it after your death. Write to contact@vaxel.fr from your account’s email address; we reply within one month and may ask to verify your identity.

You can delete your account yourself, in the Account tab of your profile, on the website as in the app; you may also request it by email (see the terms of use). Your username, email address, photo, messages, friends, IP addresses and Discord link are then erased, and what remains of the account — games played, collection — is no longer linked to anyone. Purchases and the moderation history are kept for the periods given above, with nothing left that identifies you.

Every news email carries a link to stop receiving them, without signing in. Service emails keep arriving as long as the account exists.

If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority, the CNIL: www.cnil.fr.

7. Security

The site is served over HTTPS only; your passwords are handled by Firebase and never stored by us; your payment details stay with Stripe; access to data is restricted to the game’s team.

8. Minors

The game is open to players aged 13 and over. Under 15, signing up requires the consent of a person with parental authority, who may exercise the rights described above on the child’s behalf.

9. Changes

This policy may change as the game evolves; the date of the version in force is shown at the top of the page. Any significant change is announced in the game.