Privacy

Version of 2026-10-23

Last updated: 2026-10-23. The French version is the authoritative one; this translation is provided for convenience.

1. Data controller

The publisher of the CodCards website (an individual acting on a non-professional basis, see the legal notice) — contact: [email protected]. No data protection officer (DPO) has been appointed.

2. Data collected, purposes and legal bases

• Account: username, email address, language, creation and last login dates, account status. Purpose: create the account, log you in, contact you about the service. Legal basis: performance of the contract (Terms).
• Email login codes: CodCards uses no password. A 6-digit code is emailed to you; only an encrypted fingerprint (HMAC) is kept, along with the email address, the number of attempts and the IP address of the request. Purpose: authentication. Legal basis: performance of the contract.
• Sessions and security: fingerprint of the session token, summary of the browser and device, IP address, activity dates; security event log (logins, failures, flagged sales) with IP address; anti-abuse counters. Purpose: secure accounts, let you log out your devices, prevent fraud. Legal basis: legitimate interest.
• Invitations and referrals: invitation code used at sign-up and the associated referrer account; your personal code and the list of people you invited (visible to you). Purpose: manage access to the private beta and limit abuse. Legal basis: performance of the contract and legitimate interest.
• Waiting list: if you leave your email address on the home page, we keep that address, the language, the IP address, the date, and the date an invitation is sent, if any. Purpose: send you an invitation. Legal basis: your consent (which you can withdraw at any time by email).
• Game: team and team name (and its history), cards, CP and transaction history, boosters, matches, rankings, notifications, listings, bids and sales on the market. Purpose: run the game, detect cheating and real-money trading. Legal basis: performance of the contract and legitimate interest.
• Moderation: team name reports (reporter, reason). Purpose: enforce the Terms. Legal basis: legitimate interest.
• Proof of acceptance: versions of the Terms and of this policy accepted, age declaration (18 or older), date and IP address. Purpose: prove your acceptance. Legal basis: legitimate interest and burden of proof.
• Internal audience measurement: for each page viewed, the page (without any identifier), the language, the device type (computer or mobile), the referring site or campaign (for example “reddit”) and whether the visitor is signed in. No IP address or identifier is stored: a truncated fingerprint, recomputed every day with a secret value that changes daily, is only used to count unique visitors on a given day and cannot track you from one day to the next. For signed-in players, we also record the days on which the account was active and, at sign-up, the referring site or campaign. No extra cookie and no third-party tool: the data stays with us and is only used for internal statistics (pages viewed, features used, where players come from). Purpose: improve the game. Legal basis: legitimate interest.
• Technical logs: server error and operation logs (no password or login code; email addresses only appear as a truncated fingerprint). Purpose: maintenance and security. Legal basis: legitimate interest.

Chat: the game offers a global chat. For each message, we store its content (280 characters at most), its author (your account), its date and, if it is deleted by the moderation team, the deletion date and the account of the administrator who deleted it. Messages, along with your username, your tag and your team emblem, are visible to all other logged-in players. Links are rejected and insults are masked automatically; the number of messages is limited (5 messages per 20 seconds). A deleted message is no longer displayed, but it is kept in the database for moderation and dispute handling. Purpose: letting players talk to each other and moderating those exchanges. Legal basis: performance of the contract (terms of use) for sending and displaying messages, legitimate interest for moderation and keeping deleted messages.

No data is sold, rented or used for advertising. No third-party audience measurement, advertising or social network tool is embedded: the only audience measurement is internal (see above). No payment is processed during the beta.

3. Retention periods

• Login codes: valid for 10 minutes, deleted after 24 hours.
• Anti-abuse counters: 24 hours.
• Sessions: 30 days after your last visit, then deleted 30 days after expiry or revocation.
• Security events: 12 months.
• Audience measurement (page views) and account activity days: 13 months; beyond that, only daily totals with no individual data are kept.
• Waiting list: 12 months after joining the list (addresses deleted automatically, or as soon as an account is created).
• Chat messages (including messages deleted by moderation): only the latest 100 messages are kept; older ones are permanently erased whenever a new message is posted.
• Technical logs: 12 months (service security), then automatic deletion.
• Account, game data and proof of acceptance: as long as the account exists; when it is deleted, the email address is erased and the remaining data anonymised, except what must be kept as evidence or to handle a dispute.

4. Recipients and processors

Your data is only accessible to the publisher and to the following processors, solely for the needs of the service:

• Hosting of the website and database: Hetzner Online GmbH.
• Sending emails (login codes, invitations): Resend (Resend, Inc., United States). This transfer outside the European Union is governed by Resend's data processing agreement (DPA), which incorporates the standard contractual clauses adopted by the European Commission.

Your username, team name and results are visible to other players (rankings, market, matches).

5. Cookies and local storage

CodCards only uses cookies and local storage that are strictly necessary or tied to your preferences, which are exempt from consent:

• cm_auth: keeps you logged in (30 days after your last visit);
• cm_sid: technical session and form protection (end of session); until you sign up, it also keeps the site or campaign you came from;
• cm_lang: chosen language (1 year);
• cm_view, cm_view_auto, cm_vw: desktop or mobile display and screen width (1 year);
• cc_chat: chat collapsed or expanded (1 year);
• browser local storage: interface preferences (chat, strategy guide, replay view).

No advertising, audience measurement or third-party cookie is set. The internal audience measurement described above uses no cookie and is limited to anonymous statistics; no consent banner is therefore needed.

6. Security

One-time code login, codes and tokens stored only as fingerprints, attempt limits, encrypted connection (HTTPS) and the option to log out all your devices.

7. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, the right to withdraw your consent (waiting list) and the right to set instructions regarding your data after your death. To exercise them, write to [email protected] from the address linked to your account; you will receive an answer within one month. Account deletion is currently done on request by email.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr) or with the data protection authority of your country of residence.

8. Minimum age

CodCards is reserved for people aged 18 or older, which you declare by ticking the sign-up box. An account that turns out to belong to a younger person is deleted along with its data.

9. Changes

This policy may change (for example when a shop opens). The last update date appears at the top of the page; in case of a significant change, you will be informed and your agreement may be requested again.