wiki-tcg.com
Privacy policy
Last updated: October 14, 2026
This English version is provided for convenience; in case of discrepancy, the French version prevails. Read the French version
This page explains what personal data WikiTCG processes, why, for how long, with whom, and how to exercise your rights. The data controller is Vaxel, sole proprietorship (entreprise individuelle), 254 rue Vendôme, 69003 Lyon, France — contact@vaxel.fr. The game sells no data, shows no advertising and does no advertising profiling.
1. Data processed
Your account
Email address (except for guest accounts) and its confirmation, authentication identifier, username and display name, avatar (your Google account photo, or the image you upload), language, game settings (card back, border, blurring of sensitive images…), sign-up date and last seen time.
Your game
Collection, decks, packs opened, matches and how they unfolded, trades, bids and sales, friends, clan, messages between players and in clans, achievements, leaderboards, notifications, warnings and sanctions. Your username, avatar, border, clan, rank and record are visible to other players.
Your purchases
Offer, amount, currency, date, payment status, Stripe payment identifier, and the time at which you requested immediate performance and waived the right of withdrawal. Your card details are entered with Stripe and never reach us.
For a purchase made in the iOS app: the transaction signed by Apple — its identifier, the product, the price and currency, the date, and whether it is a real or a test purchase — and a game-account identifier the app attaches to it. Apple sends us neither your Apple identity nor your payment details; it tells us when a purchase is refunded.
Security and anti-cheating
The IP addresses you connect from are associated with your account, together with your browser family (for example “Firefox · Windows”) — never the full header — day by day. Game activity (pack-opening rhythm, trades, sales, matches) is analysed to detect automation and multiple accounts. These analyses decide nothing on their own: a person reviews each case before any measure is taken.
Referrals
If you invite a friend, or come through a friend’s invitation: who invited whom, when, and what the invitation earned. To make sure an invited friend really is another person, the game compares the two accounts — their IP addresses, their browser and their device fingerprint — and checks that the friend did not sign up through a VPN or with a disposable email address. The device fingerprint is a hash computed by your browser from a few of its characteristics (screen, graphics processor, how it renders a drawing and a sound); nothing is written on your device to obtain it, and it is computed at two moments only: when you open the “Invite a friend” window, and when you sign up through an invitation. An invited friend’s email address is also kept as a hash, so that the same mailbox is invited only once.
Reports
You can report a player from their profile, for a reason chosen from a list. We keep who reported whom, the reason, any details added and the outcome. The reported player never learns who reported them; the reporter only learns that the report has been reviewed. To assess a report, the team may read what the reason concerns, and only that: the profile picture and username (including those the player used before, see below), the messages exchanged between the reported player and the reporter, the reported player’s messages in a clan they share, and the matches and trades they had together. Never their conversations with other people.
When you change or remove an uploaded profile picture, or change your username, the previous version is kept, readable by the team only and only to handle a report: otherwise, changing it would be enough to erase what you are reported for.
Audience measurement
For each page viewed: the page, where you came from (referring site, campaign parameters), the country — derived from the IP address for the duration of the request, the address itself not being kept —, the screen shape, two random identifiers (for the browser and the visit) and, if you are signed in, your account.
Discord
If you link your Discord account, its Discord identifier, to give you your rank role and the server’s gifts. Nothing else is kept from your Discord account.
Your messages
The emails you send us, and our replies.
2. Why, and on what basis
| Purpose | Legal basis |
|---|---|
| Providing the game and managing your account | Performance of the contract (terms of use) |
| Processing your purchases and keeping proof of them | Performance of the contract (terms of sale) and accounting obligations |
| Sending service emails (address confirmation, password, payment confirmation) | Performance of the contract |
| Emailing you game news — new seasons, new features — if your address is confirmed | Legitimate interest: telling our players about services similar to those they already use (article L34-5 of the French Post and Electronic Communications Code). You can opt out at any time, in one click. |
| Security, fighting cheating and multiple accounts, moderation | Legitimate interest: a fair and safe game |
| Referrals: giving the promised packs, and checking that an invited friend is another person | Performance of the contract (you invite, or accept an invitation), and legitimate interest: fair referrals |
| Audience measurement | Legitimate interest: understanding how the site is used |
| Discord linking | Your request (performance of the contract) |
| Answering your messages | Legitimate interest |
3. For how long
| Data | Duration |
|---|---|
| Account and game data | As long as the account exists |
| IP addresses associated with accounts | 180 days |
| Audience measurement | 25 months |
| Purchases (accounting records) | 10 years, including after the account is deleted |
| Warnings and sanctions | As long as the account exists |
| Reports | As long as the reported account exists |
| Previous profile pictures and usernames | 180 days, and the last 10 at most |
| Referral device fingerprints | 60 days |
| Referrals, and the hash of an invited friend’s email address | As long as the referral exists, including after an account is deleted: otherwise deleting one’s account would be enough to be invited again |
| Email correspondence | 3 years after the last exchange |
| Your opt-out from game news by email | As long as the account exists, so that we stop writing |
4. With whom
Only the game’s team accesses your data, to the extent necessary. Providers process it on our behalf, each for its own part:
- Google (Firebase Authentication): your sign-in credentials;
- Stripe: your payments on the website, and the receipt emailed to you;
- Apple: your purchases in the iOS app, and their refunds;
- Resend: sending the other service emails (address confirmation, forgotten password) and game news;
- Discord: account linking, if you request it.
The site itself is hosted by the publisher, in France. Google, Stripe, Apple and Resend may process data outside the European Union, notably in the United States; these transfers are covered by the safeguards provided for by the GDPR (a European Commission adequacy decision or standard contractual clauses).
5. Cookies and local storage
The site sets no advertising or social media trackers. It uses:
| Name | Purpose | Duration |
|---|---|---|
wikitcg_session | Keeping you signed in | 30 days |
wikitcg_langue | Remembering the language chosen with the selector | 1 year |
wikitcg_v | Random browser identifier: audience measurement, fighting multiple accounts | 1 year |
wikitcg_s | Random identifier of the current visit: audience measurement | 30 minutes |
wikitcg_discord | Discord account linking in progress | 10 minutes |
wikitcg_parrain | Remembering the invitation you came through, until you sign up | 30 days |
| Stripe | Fraud prevention, during a payment | Set by Stripe |
Your browser also keeps, in its local storage, your sign-in state (Firebase) and a few settings, such as the sound volume. Referrals also read a few characteristics of your device to compute its fingerprint, without writing anything on it (see “Referrals” above).
6. Your rights
You may access your data, have it corrected or erased, restrict its processing, object to processing based on our legitimate interest — including audience measurement —, receive your data in a reusable format, and set instructions for what happens to it after your death. Write to contact@vaxel.fr from your account’s email address; we reply within one month and may ask to verify your identity.
You can delete your account yourself, in the Account tab of your profile, on the website as in the app; you may also request it by email (see the terms of use). Your username, email address, photo, messages, friends, IP addresses and Discord link are then erased, and what remains of the account — games played, collection — is no longer linked to anyone. Purchases and the moderation history are kept for the periods given above, with nothing left that identifies you.
Every news email carries a link to stop receiving them, without signing in. Service emails keep arriving as long as the account exists.
If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority, the CNIL: www.cnil.fr.
7. Security
The site is served over HTTPS only; your passwords are handled by Firebase and never stored by us; your payment details stay with Stripe; access to data is restricted to the game’s team.
8. Minors
The game is open to players aged 13 and over. Under 15, signing up requires the consent of a person with parental authority, who may exercise the rights described above on the child’s behalf.
9. Changes
This policy may change as the game evolves; the date of the version in force is shown at the top of the page. Any significant change is announced in the game.