Privacy

What we store when you use the companion app, what other players can see and how to delete your data.

What is stored

• Your Discord id, and nothing else from Discord: not your name, avatar, email or servers. Signing in asks for the identify permission only, and the one-time token is thrown away straight away.
• A public key made on your computer. The matching private key never leaves it.
• Your characters' names and realms, taken from your history.
• Your history: every card found, crafted, recycled and traded, with times, the trade partner's character name and the trade id.
• Your score and when it last changed.
• Legacy wanted lists uploaded by older companion versions may remain in your account data. Current companions keep wanted lists in game; they are not published on this site.
• Reports you send about other players (the character's name, a reason and a short note you wrote) and reports other players sent about you. Only the people who run the service read them; they are not shown to anyone else, and they are erased with the rest when you delete your data.
• Counts the server needs to check play: attempts per card, random-number positions used, and any fair-play flags with a reviewer's note.

What is shown to others

Only if you chose public when you signed up: your character name and realm, your rank and score, your sets finished, the cards in your binder, on this site and with a "verified" mark beside your name in the game. A private player is stored but never listed.

What is not collected

Nothing about what is on your screen, in the game's memory or in your chat. The companion app reads one file the game writes and writes one file the add-on reads. It does not touch the game process or its network traffic.

Your choices

• Choose public or private when you sign up, and change it by signing in again.
• Delete your data from the server at any time with Delete my data in the companion app. Your record, history, characters, Discord link and any archived binders are erased from the live service at once. Copies kept for recovery after a mistake age out on their own: Cloudflare’s recovery history lasts 7 days and our own daily copies are kept for 14. Your cards in the game and the files on your computer are not touched. You can sign up again later, from nothing.
• Download a copy of everything held about you with Download my data in the companion app: your account, keys, characters, every event of every binder you have had, your saved state, score, trades, finished sets, wanted cards and the reports you sent. It leaves out reports other players made about you, the notes reviewers wrote and the server's secrets.
• A banned account's record is kept, so that a ban cannot be undone by deleting the account.

Questions about your data

Use Download my data and Delete my data in the companion app, or open an issue on the project's GitHub tracker (please do not put personal details in a public issue).

Technical logs

The server keeps a log of each request (the route, the result and how long it took, with a request id) so that problems can be found. It does not log your Discord id, your cards or what you uploaded. Cloudflare, which runs the server, also keeps its own technical logs, which include the address a request came from, for a limited time.

Where it lives

On Cloudflare (Workers and D1). Secrets are kept as Worker secrets, never in the project's code.