Privacy policy

1. Data controller

The data controller is the publisher of the TradeCircle service. That controller is not the game’s publisher, does not act on its behalf and does not send it your data. To exercise your rights, use the in-app settings (Profile) or write to support@tradecircle.app.

2. Data we collect

Account

• username, email address, password (stored hashed) or technical identifiers from a social login (Google, Apple, Facebook);
• authentication tokens required for the app to work.
• for a guest account: a generated username and the account creation date, with no email or password;

Use of the Service

• status of your collection (missing, owned, duplicate and quantity) per card and village;
• trade offers, confirmations, disputes, reputation ratings and comments, reports;
• history of collected reward links, if the module is on;
• optional community posts (caption, image you send, moderation status);
• preferences (language, notifications) stored on the device;
• technical push-notification identifiers (device subscription / OneSignal) when you accept notifications.
• the friend link of your game account (invitation link), which you enter in order to trade;
• messages exchanged with the other player as part of a trade;
• IP address, used to limit abuse (guest account creation, logins) and kept in technical logs;

Data we do not collect

• no game login, no game password, no publisher in-app purchases;
• no official artwork, trademarks or assets of the publisher — TradeCircle has no access to the game servers and does not sync with them;
• no sale of advertising files crossed with the game’s publisher.
• your album screenshots: they are read on your phone and are not sent to our servers. Only the result (the status of each card) is saved. If a set is not listed yet and you choose to report it to us, only its name and the card names read are sent, never the image.

3. Purposes and legal bases

• Contract performance: create the account, show the catalog, compute reciprocal matches, follow trades and 72-hour confirmations, display reputation and reliability.
• Legitimate interest: moderating reports and disputes, security, improving the Service, preventing impersonation and content that infringes the game rights holders’ copyright.
• Consent: notifications, social login (according to that provider’s settings).
• Legal obligation: answering an authority, keeping certain records in case of a claim.
• Legitimate interest (security): limiting abuse (per-IP limits, trade caps, refusing disposable emails and friend links attached to a permanently suspended account) and deleting inactive guest accounts.

4. Recipients

Your data may be accessed:

• by you, in the app;
• by other players, strictly as needed for the Service (username, scores, cards involved in a match or offer — never your email);
• by TradeCircle administrators for the catalog, moderation and rewards;
• by Hetzner Online GmbH (Germany, EU) for server and database hosting;
• by Brevo for transactional emails (verification, password reset, service messages);
• by OneSignal to deliver push notifications, when you have accepted them;
• by social identity providers (Google, Apple, Facebook) when you choose to sign in with them;
• by advertising partners (Google AdMob and/or Unity Ads, depending on the network enabled per platform) when ads are enabled in the app, only to serve and measure ads.
• the other player involved in a trade offer: your game friend link, so that you can add each other in the game.

These processors are bound by contract and limited to their task. The game’s publisher is not a recipient of your TradeCircle data. Conversely, TradeCircle receives no personal data from the game’s servers.

5. Retention

• account, collection, trades and scores: for the life of the account, then deletion or anonymisation within a reasonable time after closure (unless legally required otherwise);
• reports and moderation decisions: for as long as the file requires, then limited archiving;
• access tokens: until logout, expiry or revocation;
• technical logs: a short period compatible with the security of the Service.
• guest accounts: deleted automatically after a period of inactivity with no trade at all (90 days at the date of the update). A guest account that you secure follows the rules of a full account.

6. Transfers outside the European Union

Primary hosting (Hetzner) is located in Germany, in the European Union. If another processor (social login, push notifications, advertising) is established outside the EU, the transfer occurs only with a recognised mechanism (standard contractual clauses, adequacy decision or equivalent).

7. Your rights

Under the GDPR and the French Data Protection Act, you have rights of access, rectification, erasure, restriction, objection, portability, and the right to withdraw consent. You may also set instructions for after your death, and lodge a complaint with the CNIL (cnil.fr) or your local supervisory authority.

Deleting the account erases or anonymises identifying data. Trades already completed with another player may leave an anonymised trace needed for that player’s scores to remain consistent.

8. Cookies and trackers

The public site (landing, terms, privacy) does not need advertising cookies. A session cookie may be set only for the administration area. The mobile app stores an authentication token and preferences (language, notifications) locally.

Details: the public website sets a single functional cookie, “locale”, which remembers your language for one year; it sets no session cookie and no advertising cookie. In the app, a marker stored in the device’s secure storage indicates that a guest account has already been created there, so that a device creates only one automatically. It contains no personal data; on iOS it may remain after the app is uninstalled.

When ads are enabled, the app may show ads via Google AdMob and/or Unity Ads, depending on the network chosen per platform. For AdMob, a consent form (UMP) may be shown in the European Economic Area, the United Kingdom and Switzerland before personalised advertising; on iOS, Apple’s tracking permission (ATT) may also be requested. For Unity Ads, the app does not claim consent to personalised advertising: it tells Unity that you have not consented, so only limited, non-personalised ads are requested. These partners may process technical device data (for example the IP address and, where applicable, an advertising identifier) to serve and measure ads.

9. Minors

The Service is not intended for children below the digital age of consent (15 in France). If an account was created below that age without the legal representative’s agreement, we will delete it as soon as we learn of it.

This rule also applies to guest accounts, which are created without asking for your age: by using the app you declare that you meet the required age.

10. Intellectual property and data

TradeCircle is an independent companion app and is not affiliated with, endorsed by, or sponsored by Moon Active, the publisher of Coin Master.

TradeCircle does not copy, index or resell the publisher’s databases, artwork or trademarks. The internal catalog (card names, villages, rarities, tradability, set activity dates) is a community reference used only for matching. It is not an official database and is not synced with the publisher.

Any image you send remains your responsibility: do not place official works, logos or protected elements you have no right to circulate.

11. Security

Hashed passwords, API tokens, admin access separate from player accounts, and limited data exposed to other users. No system is infallible: report any unusual access from the app.

12. Changes

This policy may evolve, including if the catalog, the rewards module or processors change. The date at the top of the page prevails. A substantial change will be announced in the app or on the site.