Privacy Policy

Last updated October 5, 2026

We collect as little as we can to run the Game.

What we store

• Your display name, and if you secure your account, your email and a salted, hashed password (never the password itself).
• Your game progress and a login cookie that keeps you signed in. When you play inside another site's page (such as our itch.io page), a sign-in token kept in your browser's storage does the same job, and we note which site you first came from.
• Your profile choices: the profile picture you pick and, only if you choose to share it, your country (shown publicly as a flag on your profile and next to your name in chat). You can change or remove your country at any time in the Account tab.
• Your Discord account, only if you choose to link it: your Discord user ID and username, used to give you roles in our Discord server. You can unlink at any time in the Account tab or with the bot's /unlink command.
• Your online status: while you play, other players can see that you're online in the Social tab. You can turn this off in the Social tab or the Account tab. Things you do in public, such as chat messages, trades and notable card pulls, are still visible when it's off.
• Records of purchases (item, amount, time). Card details are handled entirely by Stripe and never reach our servers.
• Chat posts, direct messages, friend and block lists, and trade records, so these features work and so we can handle abuse reports.
• Abuse reports: who reported whom, the reason and any details, and a copy of the reported message and the conversation around it, kept so we can review the report even if the message is later deleted.
• Suggestions you send, and art you submit together with your signed submission agreement (including your full legal name, the time and your IP address), so we can review them and prove ownership of art we use.
• If you secure your account, we may email you about your auctions (for example, when you are outbid at the last moment). You can turn these off in Account settings.
• Your IP address, briefly and in memory only, to rate-limit abuse.

What we don't do

We don't sell your data, show third-party ads, or use tracking or analytics cookies. Your display name and scores appear on public leaderboards.

Processors

Stripe (payments), Cloudflare (hosting network and attack protection) and Resend (account and auction emails).

Your choices

Email [email protected] to get a copy of your data or have your account deleted.