Privacy Policy

Last updated: September 4, 2026

1. Who we are

Biodeck is an educational, non-commercial card game. For any question about your personal data, contact biodeck.tcg@gmail.com.

2. Data we collect, and why

• Email address: account creation, sign-in, email confirmation, password reset. Legal basis: performance of the contract.
• Password: never stored in clear text, only as an irreversible hash (scrypt). Legal basis: performance of the contract / account security.
• Google account identifier (if you use "Sign in with Google"): used only to authenticate your account; we only request your email, no other Google account data. Legal basis: performance of the contract, at your initiative.
• Username: public, shown to other players (trades, battles, showcase). Legal basis: performance of the contract.
• Game progression (owned cards, in-game currency, boosters, quests, trades): required for the game to work. Legal basis: performance of the contract.
• Language preference (FR/EN): to display the interface in the right language. Legal basis: legitimate interest.
• Account creation date. Legal basis: performance of the contract.

3. What we don't collect

We do not store your IP address (it is only forwarded to Cloudflare Turnstile for the anti-robot check, see section 5, and never stored by Biodeck). We use no analytics, no advertising, no third-party trackers.

4. Cookies

A single cookie, biodeck_session: strictly necessary for the service to work (keeping you signed in), exempt from cookie consent requirements. It is HttpOnly and secure, and expires after 30 days or on sign-out. No analytics or advertising cookies.

5. Recipients and sub-processors

Your data is never sold or shared for commercial purposes. It only reaches the providers necessary for the service to run:

• Cloudflare, Inc. (Turnstile): anti-robot check on sign-up and sign-in.
• Google LLC (Google Sign-In): only if you choose this sign-in method.
• Resend: delivery of transactional emails (account confirmation, password reset) — receives your email address and the content of the email sent.
• Render: hosting of the application and database, in the European Union.

Some of these providers have entities outside the European Union; using them relies on the safeguards described in their own privacy policies (standard contractual clauses or equivalent).

6. Retention period

Your data is kept for as long as your account is active. If you delete your account (section 8), it is erased.

7. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, object to, and port your data. To exercise these rights, write to biodeck.tcg@gmail.com. You may also lodge a complaint with your competent supervisory authority (in France, the CNIL).

8. Account deletion

A request to biodeck.tcg@gmail.com results in the account and all associated data being erased.

9. Security

Hashed passwords (scrypt), encrypted connections (HTTPS), secure session cookie.

10. Children

Biodeck is not specifically directed at children and asks for no information beyond what is required to create an account.

11. Changes

This policy may change over time; the last-updated date is shown at the top of the page. French version: /confidentialite.

12. Contact

biodeck.tcg@gmail.com