Privacy policy

This page is a translation of the French version, which alone is authoritative.

This policy explains what personal data Gaming TCG processes, why, for how long, and how to exercise your rights. It applies the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).

1. Who is responsible

The data controller is Ambre Langelidou, who publishes the site and whose contact details are given in the legal notice. For any question about your data: contact@gaming-tcg.com.

2. The data we process

The data you give us

• Your email address and your password, stored in hashed form and never in plain text.
• Your username, your language and your avatar.
• If you sign in with Google or Discord: the identifier of that account, the associated email address and the sign-in tokens that service gives us. Neither your name nor your photo is kept.
• The messages you attach to your trade offers, and what you post in your guild.
• Your reports and the emails you write to our contact address.
• If you use the reporting form without an account: your email address, the address of the reported content and your message.

The data generated by your gaming activity

• Your collection, your booster openings, your missions and your achievements.
• Your balances and all their movements, your listings, bids, sales, purchases and trades.
• Your games, your results and your leaderboard rankings.
• Your friends, the players you block and your guild.
• Your referrer, if you signed up through their link, and your referrals, if you have any.
• Your notifications on the site and your notification settings.

Technical data

• Your IP address, the date and time of your logins, your browser and device type.
• A random identifier specific to your device, set in a cookie when you sign in. It is used to alert you by email to a sign-in from a new device, stating the device and the IP address. Together with the IP address of your logins over the last thirty days and the form of your email address, it is also used to spot accounts that appear to be linked (multiple accounts, market or referral fraud). This matching is automated; it only alerts the moderators, who alone decide on any measure.
• If you enable push notifications on a device: the technical address your browser assigns to it, its encryption keys and the browser type.
• For audience measurement (Google Analytics): a random identifier kept in a cookie, the pages viewed (their addresses, without username, token or parameter), the page you came from, the language, the device and browser type, and an approximate location (country, city) that Google derives from your IP address without storing it.

Payment data

The site offers no payment: no bank details are collected.

3. Why, and on what legal basis

4. Who receives your data

Your data is neither sold nor rented. It is accessible to the site’s publisher and, for moderation, to the moderators, as well as to our processors, solely for the purposes of their role:

• Scaleway SAS (France): hosting of the site, the database and the images, on servers located in the Netherlands, and sending of the site’s emails.
• Cloudflare, Inc. (United States): all of the site’s traffic goes through its network, which protects it, encrypts it and caches the card images. Cloudflare therefore sees your IP address and the pages requested. It also manages the site’s domain name, forwards the emails written to our contact address to the publisher’s mailbox, and protects forms against bots (Turnstile).
• Google Ireland Limited (Ireland): audience measurement (Google Analytics), with Google signals and ad personalisation turned off.

Push notifications, if you enable them, go through your browser’s notification service (for example Google, Mozilla, Apple or Microsoft). It receives an encrypted message and the technical address of your device, and keeps the message for up to 24 hours if the device is off. If you sign in with Google or Discord, that service processes your data under its own privacy policy.

Cloudflare is established in the United States, and browsers’ notification services may be too. Google may process audience measurement data in the United States. These transfers are governed by the EU–US Data Privacy Framework or by standard contractual clauses.

Your username, your avatar, your profile, your showcases and your listings are visible to everyone, including visitors without an account, within the limits of your privacy settings. A booster opening you share is visible to anyone who has the link.

If you refer a player, you see their username, their level, the date they signed up and the status of their referral, and you are notified when they sign up and then when they reach the required level. Your referral sees your username.

5. How long

6. Deleting your account

To delete your account, write to contact@gaming-tcg.com from your account’s email address, stating your username: this is how we check that the request really comes from you. We delete the account no later than one month after your request, and confirm it to you by email. Your personal data is then erased, in particular your email address, your username, your logins and your devices, your friends, your guild, your referrals and your notifications. Your listings without a bid and your ongoing trades are canceled; an auction that has already received a bid runs to its end.

Some data is kept, attached to an account emptied of your email address, your username and your logins: the market and trade history, the game’s accounting ledger, the games played, and the reports and moderation decisions that concern you. The messages and reasons they contain may still mention your former username. Deletion is permanent: your collection and balances cannot be restored.

7. Your rights

At any time, you can:

• access your data and obtain a full copy of it, in JSON format, simply by asking us by email;
• have it rectified or erased;
• request the restriction of processing or object to it;
• withdraw a consent you have given, without affecting what was done before;
• retrieve your data in a reusable format;
• give instructions on what happens to your data after your death.

Write to contact@gaming-tcg.com: we reply within one month. If you believe that your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

8. Minors

The site is not open to children under 13: by accepting the terms of use, you declare that you are at least 13. The site does not ask for your age and shows no advertising. If you are under 15, only enable the weekly summary and push notifications, which are based on your consent, with the agreement of a person holding parental authority (Article 45 of the French Data Protection Act).

9. Security

Communications with the site are encrypted. Passwords are hashed, access to data is limited to the people who need it, and our team’s sensitive actions are logged. You can enable two-factor authentication and view your active sessions in your settings. If a data breach posed a risk to you, we would inform you.

10. Cookies

The use of cookies is detailed on the Cookies page.

11. Changes to this policy

We update this page when our processing changes. You are notified of any significant change on the site or by email before it takes effect.