Privacy Policy

Without an account

Your decks, collection, duel sessions and settings are kept in your browser. They are not sent to us unless you sign in, share something or publish a combo.

With an account

Signing in is optional: it keeps your data in sync between devices and lets you share and publish it. You sign in with Google or Discord, and of what they tell us about you we keep only the ID and email address of that account. We use them only to recognise you, to tell you why if we hide one of your decks, remove your nickname or delete your account, and, before a change to how your data is used, to tell you by email. For your account we store your decks, collection (with a daily and a weekly backup), settings, published combos, the nickname you choose, if any, and which decks you like, and for each signed-in session the IP address and browser it was opened from.

What you share

A public collection folder, a deck shared by link, a published combo and a finished online match can be seen by anyone with their link. A folder shows everything in it, notes included, and your nickname if you chose one; its link contains your account ID. A deck shows its cards, name, note and cover, and a deck shared by link names nobody. A match record includes its chat.

A deck you make public can be seen by anyone, with no link needed. It is shown on your profile and, once its Main Deck is complete, listed among the community's decks, found by search and shown on the pages of the cards it holds. It is shown under your nickname, which a public deck needs, with a link to your profile. Besides the deck itself, anyone can see how many people like it, when it was published and last changed, and the deck it was copied from while that one is public too. It follows every save; when you make it private or delete it, it leaves the community within a few minutes.

A nickname is optional. Once you choose one, anyone can see it: on your public decks, beside your public folders and on your profile page, whose address contains your account ID and which lists both. You can remove it whenever none of your decks is public. We never show the name, email or picture of your Google or Discord account.

When you like a public deck, we keep that you did, so you can see it and take it back while the deck is public. Others see only how many people like a deck, never who. If the deck stops being public, your like is kept out of sight until the deck is public again or deleted, or until you delete your account.

Feedback and reports

The Feedback form, and the Report button on a shared deck's page, send us what you write and, if you leave one, a contact for a reply, together with the address of the page you were on (for a report, the deck's), your display language, your browser and your screen size. Neither needs an account, and neither is linked to yours. They reach us by email, are kept for up to a year, and are never published; a deck's owner is not told who reported it.

Cookies and browser storage

The site sets only the cookies it needs to work: session cookies that keep you signed in, a short-lived one that secures sign-in, and one that remembers your language for a year. Everything else it keeps (your local data, your settings, a random token that recognises you in duel rooms) stays in your browser. No advertising or analytics cookies are set on this site.

Who handles it

Cloudflare hosts the site and stores its data, and delivers feedback, and email sent to our address, into our inbox; servers in the EU answer searches and never see your IP address or account. Google and Discord run sign-in under their own privacy policies. Cloudflare may process data outside the EU, under the EU-U.S. Data Privacy Framework and the European Commission's standard contractual clauses.

Why

• To run your account, sync your data and show what you choose to share or publish, because you asked for it (GDPR Art. 6(1)(b)).
• To keep the site secure and working through request logs, session records and limits against abuse, which is our legitimate interest (Art. 6(1)(f)).
• To read, act on and answer the feedback and reports you send, and to hide, remove or delete what breaks our terms, which is our legitimate interest too (Art. 6(1)(f)).

How long

Account data, backups, published combos, public decks and your nickname: until you delete them or your account. Likes: until you take them back, the deck is deleted, or you delete your account. Sessions: 7 days after last use. Request logs: up to 7 days. Abuse limits: 24 hours. Feedback and reports: up to a year. An idle duel room: one hour. Finished match records are kept, and name no account. A nickname we remove for breaking our terms is kept too, in a simplified spelling linked to no account, so that no one can choose it again.

Your rights

You can delete your account from the account menu, and everything stored with it goes: your nickname, your decks and their place in the community, and the likes you gave. Copies other people made of a deck you shared are theirs and stay. For a copy of your data, or to have it corrected, restricted or exported, write to contact@duelingatlas.com.

You can also object to the processing we do for security.

And you can complain to a data protection authority, such as the one where you live.

Changes

Small changes are posted here with a new date. Before a change to how your data is used takes effect, account holders are told by email.