Privacy Policy

Effective Date: September 12, 2026
Version: 2026-09-12

This Privacy Policy explains how Blue Fox Coder ("we," "us") handles data for the game CardBound TCG (the "Game").

1. Data We Collect

Guest play

If you play as a guest without an account, your gameplay data stays only on your device. The Game creates a random guest identifier on your device. It is sent to us only if you later move your guest progress into an account.

Account data

If you create an account, we collect and store:

• Email address (used for sign-in, verification codes, and account recovery).
• Username and display name.
• A user id that identifies your account, and a shareable Friend ID.
• Account records: when the account was created, when you last signed in, your chosen avatar, and account status (for example, a pending deletion or a suspension).
• If you move guest progress into your account: the guest identifier and a record of the transfer, so the same progress cannot be applied twice.

If you sign in with Google or Apple, we receive your email address and the basic profile information that provider shares, such as your name, in order to create your account.

Gameplay data

• Your card collection, decks and deck names, in-game currency, packs and pack openings, in-game shop transactions, daily rewards, event progress, level and experience, and tutorial and onboarding progress.
• Match records when you play online matches: who you played, the decks used, the moves sent during the match, and the result.
• Trades, if you use trading: the trade code, the cards each side offers, and the trade history.

Friends and blocks

• Your friends list, the friend requests you send and receive, and the players you block.
• Your online status (for example, online, in a battle, or trading) and when you were last seen.

Direct messages

• Direct messages can only be exchanged between players who are friends. We store the messages you send and receive, with their send and read times, so both players can see the conversation.
• Messages are checked automatically before delivery for content that breaks our community rules, such as profanity, harassment, threats, scams, spam, or sharing personal information. Minor issues may be masked before the message is delivered; more serious ones stop the message from being sent. When a message breaks the rules, its original text is kept in a moderation log that only we can access. Repeated violations can lead to a temporary messaging restriction.

Reports and moderation

• If you report a player, we store the report: who you reported, the reason you picked, and an evidence snapshot our servers build from the reported message and recent messages in that conversation.
• If you are reported, or our automated checks flag your messages, we store that report or moderation record and any action taken, such as a warning, a temporary messaging restriction, or an account suspension.

Sign-in sessions and technical data

• When you sign in, our backend issues session tokens. The Game keeps a refresh token on your device so you stay signed in; logging out removes it from the device.
• Our backend provider records sign-in activity and processes technical information such as your IP address and request times to run the service and protect it from abuse.

Stored only on your device

Settings, local saves, and a local diagnostic log stay on your device. The diagnostic log is not sent to us.

What we do not collect

• We do not collect location data, the contacts in your device's address book, photos, camera or microphone data, advertising identifiers, or health data.
• The Game has no real-money purchases. Its shop uses in-game currency only, so we do not collect payment information.

2. No Ads, No Analytics, No Tracking

The Game shows no advertising and contains no advertising, analytics, or crash-reporting SDKs. We do not sell personal data, we do not use your data for advertising, and we do not track you across other apps or websites.

3. Why We Process Data

• Provide sign-in, cloud saves, and syncing of your collection and progress across devices.
• Run online features: friends, direct messages, trading, and online matches.
• Keep players safe: check messages automatically, review reports, and enforce our rules.
• Keep the Game secure, check match results and rewards on our servers, and prevent cheating, spam, and abuse.
• Respond to support messages you send us.
• Comply with legal obligations.

Where applicable law requires a legal basis, we rely on contract performance (providing the Game and its online features), legitimate interests (player safety, moderation, security, and abuse prevention), and legal compliance.

4. What Other Players Can See

• Other players can see your username, display name, Friend ID, and avatar, for example in player search, friend requests, matches, and trades.
• Your friends can also see your online status and when you were last seen.
• The friend you message can read the messages you exchange with them.
• The other player in a trade can see the cards offered in that trade.
• Reports are not shown to the player you report.

5. Where Data Is Stored

Account, gameplay, friends, message, and report data are stored with Supabase, our backend provider for authentication, database, and real-time updates, which processes this data on our behalf. Data may be processed in countries other than your own, with appropriate safeguards where required.

6. Sharing

We share personal data only with:

• Supabase, as our backend service provider.
• Other players, only as described in section 4.
• Google or Apple, if you choose to sign in with them, as needed to sign you in.
• Platform providers (for example, Apple) as needed to distribute and run the Game.
• Legal authorities where required by law.

7. Account Deletion and Retention

You can delete your account in the Game at Profile -> Settings -> Delete Account. Deletion is queued with a 30-day recovery window; signing back in during that window restores the account. After 30 days, the account and its data are permanently erased, including your friends list, blocks, the messages you sent, reports you made or that concern you, and moderation records. Some records of matches and trades that another player took part in with you may remain in their history without your account attached.

We otherwise keep account data, messages, reports, and moderation records for as long as your account exists. Anti-spam rate-limit records are cleared after about a day. Local save data is removed when you uninstall the Game or clear its data on your device.

8. Children's Privacy

The Game is intended for a general audience and is not directed to children under 13. Do not create an account if you are under 13 (or the higher minimum age required in your jurisdiction).

9. Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, or port your personal data. In the Game you can delete your account, remove friends, block or unblock players, hide conversations, and report players. For anything else, contact us at cardboundtcg@cardbound.com.

10. Security

We use reasonable technical and organizational safeguards. No system is 100% secure.

11. Changes to This Policy

We may update this policy; changes are reflected in the effective date and version above.

12. Contact

cardboundtcg@cardbound.com