Privacy policy
Updated October 19, 2026
This page explains what data DuffleCards collects, why, how long it is kept and how to exercise your rights. We collect the minimum needed to run the game: no sale of data, and ads only when you choose to watch one to earn packs. This English version is provided for convenience; the French version applies.
Data controller
Red Brick Studio, 41 rue Jacquemars Giélée, 59800 Lille. For any question about your data: contact@dufflecards.app.
Data we collect
•
Your player ID: a random number created at first launch, even as a guest. The service number shown in the profile is derived from it.
•
Your e-mail address, if you save your collection or sign in with an e-mail. If you use Google or Apple, we receive the ID and e-mail address that service sends us (with Apple, this may be a relay address).
•
Your game data: cards, opened packs, coins and their history, market listings and sales, rewards received.
•
With an account: your username, which you choose, and your friends (those you add with their link and those who add you with yours), the offers and parcels you exchange, your « Looking for » list and the usernames you report.
•
Your purchases: product, price, date, payment platform and transaction number. We never see your bank details: they are handled directly by Apple, Google or Stripe.
•
Technical data: IP address, device and browser type, connection times, in our hosts’ logs. On the web, an anti-bot check (Cloudflare Turnstile) may analyze signals from your browser to make sure you are not a script.
•
How you use the app: screens opened, sessions, a few actions (opening the shop, for example), with the device type, the app version and, on the web, the site that brought you. This data stays with us: no third-party audience measurement tool.
•
The ads you watch to earn packs: date, number per day and reward received. In the iOS and Android app they come from Google AdMob, which receives your player ID to confirm to us that an ad was watched to the end.
We do not collect your name, date of birth, location or contacts. Other players see the cards you list for sale and their price, never your e-mail address. Your username is public (tag, showcase). Your friends also see your card count, your spares, your « Looking for » list and your side, never the rest of your album.
Why, and on what basis
•
Running the game and your account (collection, market, backup, sign-in by code): performance of the contract, that is the terms of use.
•
Delivering and tracking your purchases, handling refunds: performance of the contract, then legal obligation (accounting).
•
Protecting the game against cheating, bots and accounts created in bulk, keeping the market fair: legitimate interest of the publisher and the players.
•
Sending the e-mails the account needs (sign-in code, address change): performance of the contract. We do not send marketing e-mails without your consent.
•
Offering you rewarded ads, which you choose to watch: performance of the contract for the reward; for personalized ads in the app, your consent, asked by Google’s form before the first ad (otherwise ads are not personalized).
•
Understanding how the game is used to improve it (traffic, screens used, balance of the economy): legitimate interest of the publisher. You can object by writing to the address below.
How long
•
Account and game data: as long as the account exists. You can delete it at any time from the profile (“Delete my account”): cards, packs, coins, history and e-mail are then erased.
•
Inactive guest account: deleted after 12 months without signing in.
•
Inactive account with an e-mail: deleted after 3 years without signing in, after a warning e-mail.
•
Purchases: kept 10 years for accounting, detached from your account when you delete it.
•
Past market sales: kept without the seller’s or buyer’s identity, for price history.
•
Technical logs: a few days to a few weeks depending on the host, at most 12 months.
•
Usage data: 13 months, then deleted; the count of the days you played, 25 months. When the account is deleted, your past usage is detached from your identifier.
Who has access
Only the publisher accesses your data, along with the technical providers working for it and on its instructions:
•
Supabase (database, accounts, image storage), with data stored in the European Union;
•
Vercel (website hosting);
•
Cloudflare (anti-bot check on the web);
•
[À compléter : prestataire d’envoi d’e-mails] (sending codes by e-mail);
•
Google AdMob, for rewarded ads in the iOS and Android app. For showing and measuring ads, Google acts as a separate controller, under its own policy (policies.google.com/technologies/ads);
•
Apple, Google, Stripe and RevenueCat for payments, when you make a purchase; Apple and Google also if you sign in with them.
Some of these providers are based in the United States. Transfers are covered by the European Commission’s standard contractual clauses or by the EU–US Data Privacy Framework.
Your data is never sold or rented.
Storage on your device
The app stores on your device (browser or app local storage) your sign-in session, the chosen theme and the messages already seen. This is only used to make the app work, so it does not require consent and there is no cookie banner. On the web, no advertising tracker or third-party audience measurement is used. In the iOS and Android app, the Google AdMob kit may read the device’s advertising identifier for rewarded ads: your consent is asked first, and you can change it in your device settings.
Your rights
You can access your data, correct it, erase it, get it in a readable format (portability), object to processing based on legitimate interest or ask for it to be restricted. You can also give instructions about your data after your death.
Deletion is done directly in the app. For anything else, write to contact@dufflecards.app from your account’s address, or with your service number if you play as a guest. We reply within one month.
If you believe your rights are not respected, you can lodge a complaint with the CNIL (cnil.fr) or your local data protection authority.
Minors
The game does not ask for your age and only collects the data the game needs. If you are under 15, talk to your parents before creating an account, and always ask for their permission before a purchase.
Security
Traffic is encrypted (HTTPS). Every operation on cards and coins is checked by the server, and each player can only read their own data. Sign-in uses a one-time code: there is no password to steal.
Changes
This policy may change, for example when a new service is added. The update date is shown at the top of the page; if there is a significant change, you will be told in the app.
