Privacy Policy

This policy explains what personal data we process when you use ftcg.app (the "Service"), why, on what legal basis, who receives it and what your rights are. It applies under the EU General Data Protection Regulation (GDPR) and the Portuguese data protection law (Lei n.º 58/2019), and we apply the same standard to every player, wherever they live.

1. Controller

The controller of your data is Anton Grydz, Rua de Braga 71, 1 esq, Alcabideche, Portugal. For any privacy question or request, write to mail@ftcg.app.

2. What we collect

You give us

• Account data: email address; if you sign in with Google, the name and profile picture Google shares with us; the username, avatar and bio you choose.
• Wallet address: the public address of the wallet you link, and the signature proving you control it. We never receive your private key or recovery phrase.
• Messages: what you send us when you contact us.

Created when you play

• Game data: your cards, packs and how you obtained them, dust, decks, battles and their results, quests, streaks, achievements, trades and referrals.
• Purchase data: transaction hash, paying and receiving addresses, amount, offer, the packs credited, and the confirmation you tick before paying — its exact wording and time — as evidence of what you agreed to. On your first purchase that confirmation includes your age, and we record the time you confirmed it.
• Technical and security data: IP address recorded with trades, to detect multi-accounting, and the request logs our hosting and database providers keep (IP address, browser, time). When you open the shop, we check which country your connection comes from, because packs are not sold everywhere; the country is used for that request only and not stored.

From other sources

• Public blockchain data: the FTCG NFTs held by your linked wallet and your purchase transactions, read from the Base network.

3. Why we use it, and on what basis

• Running your account and the game — sign-in, collection, packs, battles, trades, rewards, NFT perks, support. Basis: performance of our contract with you (the Terms).
• Selling and crediting packs, keeping purchase records. Basis: contract, and our legal accounting and tax obligations.
• Security and fair play — preventing fraud, cheating, multi-accounting and abuse of referrals and trades; protecting the Service. Basis: our legitimate interest in a safe and fair game.
• Showing your public profile — see Section 5. Basis: contract; it is how the game's profiles and leaderboards work.
• Service emails — sign-in codes and important messages about your account or these documents. Basis: contract and legal obligation. We send no marketing email without your consent.
• Aggregate statistics on how the site is used, to improve it. Basis: legitimate interest. These statistics are cookieless and do not identify you.
• Legal claims and requests from authorities. Basis: legal obligation and legitimate interest.

We do not sell your personal data, and we make no decision about you based solely on automated processing that has legal or similarly significant effects. Pack contents are random and are not a profile of you.

4. Who receives it

Only people at FTCG who need it, and the service providers below, who process it on our instructions under data processing agreements:

• Supabase — database and authentication, including sending sign-in codes;
• Vercel — hosting, file storage for avatars and card images, cookieless analytics;
• Google — sign-in, only if you choose it;
• Alchemy — reading the Base blockchain for your wallet's NFTs and purchases;
• OpenSea — NFT market data for cards and wallets;
• WalletConnect (Reown) — connecting your wallet, only if you use it;
• our email provider, for transactional emails.

We may also disclose data where the law requires it, to protect our rights or players' safety, or to a successor if the Service changes hands, in which case this policy continues to apply.

5. What is public

• Your username, avatar, bio, linked wallet address, collection highlights and game statistics appear on your public profile and on leaderboards, visible to anyone.
• Transactions on the Base blockchain — including your purchases and the NFTs your wallet holds — are public by design, permanent, and outside our control. We cannot delete or change them.

6. International transfers

Some providers above are based in, or access data from, the United States and other countries outside the European Economic Area. Where they do, transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.

7. How long we keep it

• Account and game data: while your account exists, then deleted within 30 days of its closure.
• Purchase records: 10 years, as required by Portuguese tax and accounting law.
• IP addresses recorded with trades: erased 30 days after the trade is closed. Provider request logs: as short as each provider keeps them.
• Messages to us: 3 years after the last exchange.
• Data needed for a dispute, a fraud investigation or a legal obligation: until it is resolved or the obligation ends.

8. Cookies and local storage

We use only what the Service needs to work: a session cookie that keeps you signed in, a short-lived cookie used while you link a wallet, and local storage in your browser for your cart, filters and display preferences. These are strictly necessary and do not require consent. We do not use advertising or cross-site tracking cookies. If we ever add cookies that need consent, we will ask first.

9. Your rights

You have the right to:

• access your data and receive a copy of it;
• have inaccurate data corrected;
• have your data erased, including by closing your account;
• restrict or object to processing based on our legitimate interest;
• receive the data you gave us in a portable format;
• withdraw any consent you gave, at any time;
• give instructions on what happens to your data after your death.

Write to mail@ftcg.app from the email address of your account. We will answer within one month. We may keep data we are legally required to keep, and we cannot erase blockchain records. You may also lodge a complaint with the Portuguese data protection authority, the CNPD (cnpd.pt), or with the authority of your country.

10. Age

The Service is for people aged 18 and over. We do not knowingly collect data from anyone younger; if we learn that we have, we close the account and delete the data.

11. Security

We protect your data with encrypted connections, access controls, row-level security in our database and limits on sign-in attempts. No system is perfectly secure; if a breach puts your rights at risk, we will notify you and the authorities as the law requires.

12. Changes

We will update this policy when our processing changes. For material changes we will notify you by email or in the Service before they take effect. The effective date at the top shows the current version.