LEGAL · PRIVATE ALPHA
Privacy Policy
Updated October 21, 2026
This policy describes the current private-alpha implementation. Production launch requires the operator’s legal identity, privacy contact, retention schedule, regional disclosures, and processor list to be finalized.
1. Information collected
| Category | Examples | Purpose |
|---|---|---|
| Account | Email address, display name, hashed password credential | Create and secure an account |
| Game profile | Player ID, collection, decks, campaign progress, rewards, cosmetics, Season Pass state | Provide persistent gameplay and synchronize account data |
| Transactions | Product, currency change, provider transaction reference, review state | Fulfil and audit purchases, prevent duplicate claims, support users |
| Online activity | Session identifiers, login and last-seen times, lobby/match activity, network address in security rate limits | Run online play, maintain sessions, prevent abuse, and diagnose availability |
| Social integrations | Discord or other provider identifiers, OAuth authorization data processed during connection, lobby membership, presence, invites, chat/voice state, and signed webhook events when enabled | Connect accounts and provide and protect the social features the player chooses to use |
| Technical | Errors, service logs, client/server versions, device and performance information; aggregated web-request route, response status and duration; user-agent string; and approximate country, region and city derived locally from the connecting network address | Secure, debug, and improve the alpha; understand website reliability and audience device/location trends |
| Closed-alpha research | Screen navigation, match mode and outcome, anonymous installation identifier, crash stack traces and recent client log lines, tester bug reports and support replies, and optional survey responses | Find defects, communicate with testers, and balance gameplay during the closed alpha |
2. How information is used
Information is used to operate accounts and matches, maintain security, fulfil entitlements, investigate defects and abuse, comply with legal obligations, and improve CardBrawler. Alpha data is not used for third-party targeted advertising.
3. Passwords and session tokens
Passwords are processed with a salted, computationally expensive hash. Session tokens are stored only as cryptographic hashes. Do not disclose a session credential.
3A. Closed-alpha telemetry and feedback
Telemetry is submitted only while the DesktopGL client is signed in to an online CardBrawler account. Event payloads are limited to approved gameplay and navigation fields; passwords, session tokens, email addresses, card text, and chat content are not accepted as telemetry properties. Crash reports are first queued on the player’s device without account credentials and uploaded after a later authenticated connection. Tester bug reports, replies, and survey answers are intentionally associated with the submitting player ID so the team can respond and prevent duplicate survey submissions.
3B. Traffic and service telemetry
Cloudflare provides website delivery, security and traffic analytics. Its processing depends on the services configured by the operator; see Cloudflare's privacy policy. The application records aggregated public API route, method, status and duration statistics for service administration. It no longer creates its own website page-view, browser or geographic analytics records. Previously collected records may remain in the database; this change does not delete them.
3C. Cookies and your choice
The cb_analytics_choice cookie stores your preference for 180 days; the application no longer creates its former cb_visitor cookie and requests its removal when present. Closing the notice without choosing dismisses it for the current browser session but does not change your consent preference. Your choice can be changed using . This setting does not itself control Cloudflare services or other third-party cookies. Browser settings can remove stored cookies. Other storage supports security, administration and account sessions; third-party services may use their own storage under their respective policies.
4. Sharing and processors
Data may be processed by infrastructure, authentication, social, analytics, security, and payment providers only as needed for their function. The current architecture may include Cloudflare, PostgreSQL hosting, Discord, Google, Steam, Stripe and platform commerce services. Information may also be disclosed when required by law or necessary to protect users and the service.
5. Discord and other linked services
When you choose to connect Discord or use a Discord lobby feature, Discord processes information under its own privacy policy. The server exchanges Discord OAuth authorization codes and resolves the stable Discord user identifier needed to link accounts; the Discord client secret is never sent to the browser or game client. Discord Event Webhooks are authenticated with the application Public Key before the server accepts them. Disconnecting a CardBrawler account session does not delete a separate Discord, Google, or Steam account.
6. Retention
Account and gameplay data is retained while needed to provide the alpha and resolve security, transaction, or support issues. Expired and revoked sessions may be retained for a limited security/audit period. Transaction records may require longer retention. Test data may be reset during the alpha. A concrete production retention schedule will replace this statement before public launch.
7. Security
The service uses transport encryption in deployment, restricted database networking, hashed credentials and session tokens, signed Discord webhook validation, per-session revocation, rate limiting, and access-controlled operations tools. No system is completely secure; report suspected account compromise through the alpha support channel.
8. Your choices and rights
You can update your display name and end your current session on the account website. Depending on your location, you may have rights to access, correct, delete, restrict, or export personal information, or object to certain processing. Submit a request through the support contact supplied with your alpha invitation. Identity verification may be required.
9. Children
CardBrawler’s private alpha is not intended for children under 13. Do not register if you are below the minimum age required in your location. If the operator learns that ineligible child data was collected, it will be removed as required.
10. International processing and changes
Service providers may process information in countries other than yours, subject to the safeguards required for the launch regions. Policy changes will be posted with a revised effective date and communicated when legally required.
11. Contact
Use the privacy/support contact supplied with your private-alpha invitation. A permanent privacy email and the operator’s legal identity and address must be published before public commercial launch.