Privacy policy

1. Data controller and contact

Data controller: Deckord. Contact for privacy matters and exercising your rights: support@deckord.com.

Before the commercial launch, this page will be completed with the registration details and legal address required of the definitive controller of the service.

2. Data we process

• Account: email address, username, password stored as a hash, and email verification status.
• Profile and community: avatar, banner, bio, favorite games, posts, comments, groups, messages, and follow relationships.
• Game and collection: decks, saved cards, wishlist, tournament participation, results, and public video game identities.
• Security and operation: pseudonymized IP address, user agent, session identifiers, technical logs, and administrative actions.
• User-submitted content: profile images and, when you take part in tournaments, evidence you choose to submit to validate results.
• Help and support: subject, description, related page, team replies, and, only if you authorize it when submitting, browser and screen size.

3. Purposes and legal bases

• Creating and maintaining your account, providing the social features, and managing collections and tournaments: performance of the requested service.
• Protecting accounts, preventing fraud, moderating content, and keeping security logs: legitimate interest and compliance with applicable obligations.
• Sending verification and recovery codes: security and performance of the service.
• Investigating help requests, responding to incidents, and improving Deckord: performance of the service and legitimate interest in keeping it safe and functional.
• Measuring platform usage through our own analytics: consent, which you can withdraw at any time.
• Sending future promotional communications: only when there is a separate, voluntary opt-in.

4. Recipients and providers

Deckord may use hosting, database, storage, transactional email, and security providers that act on the controller's instructions. Transactional email may currently be sent via Resend when configured.

Your username, profile, and content marked as public will be visible to other users. We do not sell your personal data.

5. International transfers

Some technology providers may process data outside the European Economic Area. Before public deployment, the definitive providers and applicable safeguards, such as adequacy decisions or standard contractual clauses, will be documented.

6. Retention

• Account data: while the account is active and for the periods necessary to meet legal responsibilities.
• Verification codes: expire after 15 minutes and are deleted after use or replacement.
• Technical and moderation logs: for the time proportionally necessary for security, abuse prevention, and resolving complaints.
• Support requests: while active and afterward for the period necessary to avoid repeated incidents and meet responsibilities.
• Public content: until you delete it or request its removal, unless there is a legitimate retention obligation.

7. Your rights

You can request access, rectification, deletion, objection, restriction, and portability by writing to support@deckord.com. You can also withdraw your analytics consent from "Manage cookies." If you believe your data isn't being processed correctly, you can file a complaint with the competent data protection authority.

8. Security and minors

We apply HttpOnly cookies, session controls, rate limits, hashed passwords, and server-side permission checks. No system fully eliminates risk, so we continuously review and improve these measures.

People who have not reached the legal age to consent to the processing of their data must use Deckord only with valid authorization from their legal guardian.