Privacy policy

Data we process

Cartoria processes the account data needed to run the game: email address, display name, preferences, progress, collection, decks, battle results, and notification settings. To protect the Market economy, Cartoria may also retain a rotating HMAC fingerprint of the IP address, limited to Market actions; no raw IP address or browser fingerprint is retained for this purpose.

A birthday may be provided voluntarily for an annual reward. Payment data is handled by Stripe; Cartoria does not store full payment card data.

Why we use it

This data lets us create and secure accounts, run battles, display rankings, grant rewards, process purchases, and send emails you have enabled. The Market’s limited signals help detect and limit abusive transfers between accounts, without making a decision on a shared connection alone.

Audience measurement may be used to understand public page usage and improve the game.

Service providers

Cartoria uses Vercel for hosting, Supabase for authentication and data, Cloudinary for images, Stripe for payments, Resend for email, and Google Tag Manager and Google Analytics for audience measurement when allowed.

These providers access data only as needed to provide their service.

Cookies and audience measurement

Strictly necessary cookies support sign-in, security, language selection, and game operation. They cannot be disabled through the consent manager.

A random first-party identifier, kept for no more than one year, helps detect multiple accounts using the same installation for Market security. Its raw value stays in the browser and is not a hardware fingerprint of the device.

Google Analytics and advertising measurement trackers load only after you agree to the relevant purpose. You may accept, refuse, or customize these uses; your choice is stored on the device for six months and can be changed from the public footer or game settings.

Your choices and rights

You can edit your profile and email preferences in account settings. Every non-essential email includes an unsubscribe link.

You can request access, correction, or deletion of your data through Cartoria's official contact channels. Temporary Market network and installation fingerprints are deleted after 35 days. Some transaction data may be retained where legally required.