Privacy

Godsunbound is an independent, hobbyist trading-card game. This page describes what data we collect when you play, why, and how to remove it. Plain language, no dark patterns.

What we store

• Username — required, used to identify you in matches and on leaderboards.
• Password — stored as a bcrypt hash. We never see your plaintext password.
• Email (optional) — only stored if you provide one during registration. Used for future password recovery and nothing else. You can register without it.
• Account stats — ELO rating, wins, losses, registration date.
• Decks — the card lists you save in the deck builder.
• Match outcomes — winner, ELO change, hero played. Always recorded because matchmaking needs them.
• Detailed match events (cards played, damage dealt, per-round actions) — only stored if you ticked the analytics consent box during registration. Used purely to balance card strength. You can withdraw consent any time by emailing us.
• Bug reports — when you submit a bug via the in-game form, we store your description, username at the time, the page you were on, your browser's user-agent string, and an optional context blob.

We do not use third-party analytics, advertising trackers, or social-media pixels. We do not store IP addresses long-term. We store small localStorage entries in your browser (auth token, last-used hero) — these are strictly necessary to keep you logged in and are not used for tracking.

Why we store it

Account data lets you log in across sessions. Match history powers ELO and balance analysis. Bug reports help us fix the game. The legal basis under the EU GDPR is your consent (given by creating an account) combined with the legitimate interest of running a functional online game.

Who we share it with

Nobody. Match results and usernames are visible to your opponents and teammates inside the game (and on any public leaderboard we eventually add). Beyond that, your data stays on our server.

How long we keep it

• Account & decks: until you delete your account.
• Match history: kept for balance analysis even after account deletion, but anonymised — your username is replaced with a placeholder and your email is wiped.
• Bug-report logs: kept until manually pruned.

Your rights (GDPR)

You have the right to access, correct, export, or delete your personal data. To exercise any of these rights:

• Delete your account — log in and use the Delete account button in the lobby (or send a request to the address below). This wipes your email, password, and decks, and anonymises your match history.
• Export your data — email us and we'll send you a JSON dump of everything tied to your account.
• Correct your data — email us; we'll update it.

Contact

Questions, requests, or complaints: [email protected].

Changes to this policy

If we change how we handle data, we'll update this page and the "Last updated" date above. Significant changes will be announced in-game.

← Back