Privacy Policy

1. Scope

This Privacy Policy describes how GuessTheCards handles personal information when you use the website, accounts, games, community and competition features, purchases, and support. It does not control independent sites or services linked from GuessTheCards, including payment processors and Scryfall.

2. Information we collect

Information you provide

This can include account and profile details; email address; display name; language and preference settings; avatar; community challenges, comments, ratings, reports, and other submissions; and messages or attachments you send to support. A guest contact request includes the name, email, topic, subject, message, CAPTCHA response, and a protected hash derived from the network address.

Gameplay and transaction records

We record game attempts, answers, scores, timings, hints, saved cards, rankings, queue and tournament activity, eligibility, achievements, wallet balances, grants, redemption events, orders, subscription status, and reconciliation records needed to deliver and verify the Service.

Technical information

We may collect IP address, browser and device information, request times, routes, session and security-cookie identifiers, referring origin, error and audit records, rate-limit events, and signals used to prevent fraud, spam, abuse, and unauthorized access.

Payment providers process payment credentials. GuessTheCards may receive transaction identifiers, provider, amount, currency, product, status, limited billing details, and dispute information, but does not need your full payment-card number to operate ordinary checkout and support.

3. How we use information

Provide accounts, gameplay, card preferences, leaderboards, rewards, community features, purchases, subscriptions, and support.

Verify results, settle competitions, deliver grants, reconcile payments, and preserve accurate histories.

Personalize language, profile, card-printing, and accessibility choices.

Detect spam, cheating, fraud, security incidents, prohibited content, and violations of the Terms.

Debug, measure, maintain, and improve performance, reliability, features, and user experience.

Communicate service, security, support, transaction, and policy information.

Comply with law, enforce agreements, and protect users, the public, and the Service.

Depending on where you live, these uses may rely on performing a contract with you, legitimate interests in operating and securing the Service, consent, or compliance with legal obligations.

4. When information is shared

Information may be shared with service providers that host infrastructure, deliver email, process payments, provide card data or images, monitor reliability, or help operate the Service. They receive only information reasonably needed for their role and are expected to protect it.

We may disclose information when reasonably necessary to comply with law or a valid legal request; investigate fraud, abuse, or security threats; enforce agreements; protect rights and safety; or support a reorganization or transfer of the Service subject to appropriate safeguards.

Your public profile and content may be visible to others according to the feature and privacy settings you choose. Private support tickets, payment records, passwords, and non-public moderation records are not intentionally made public. We do not sell personal information for money.

5. Cookies and local storage

GuessTheCards uses necessary cookies and browser storage for sessions, CSRF protection, authentication, language and card preferences, temporary interface state, security, and reliable operation. Blocking necessary storage may prevent sign-in, protected submissions, or saved preferences. If optional analytics or advertising technology is introduced, any consent controls required by applicable law will be provided.

6. Retention

We retain information only as long as reasonably necessary for the purposes described here. Account and profile information is generally kept while the account is active. Game, reward, competition, audit, anti-abuse, payment, and support records may be kept longer when needed for integrity, reconciliation, security, disputes, legal obligations, or backups. Public content may remain until deleted or moderated. De-identified information may be retained for analysis.

7. Your choices and rights

You can update supported profile and preference information in the Service, control public content through available tools, cancel supported subscriptions, and sign out. Depending on applicable law, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent.

Submit a privacy request through Contact us and select Privacy. We may verify the request and account ownership. Some information may be retained where permitted or required for security, legal compliance, transaction records, dispute resolution, or the rights of others. You may also have the right to complain to a local data-protection authority.

8. Security

We use administrative and technical measures intended to protect information, including encrypted transport, secure session controls, CSRF protection, role-based access, rate limiting, signed challenges, audit records, restricted database privileges, and private support storage. No system is completely secure, so use a unique password and report suspected compromise promptly.

9. Children

The Service is not directed to children under 13. Users must also meet any higher minimum age or consent requirement that applies where they live. If you believe a child provided personal information contrary to these requirements, contact us so the matter can be reviewed.

10. International processing and changes

Information may be processed in countries other than your own, where privacy laws may differ. Appropriate safeguards are used where required. We may update this Policy as the Service or law changes; the effective date above identifies the latest version, and material changes may also be announced in the Service.

11. Contact

Use the secure contact form for privacy questions or rights requests. Select Privacy and do not include passwords, full payment credentials, or unnecessary sensitive information.