Privacy policy

1. Data controller

The data controller is the publisher of the TradeCircle service. That controller is not the game’s publisher, does not act on its behalf and does not send it your data. To exercise your rights, use the in-app settings (Profile) or write to support@tradecircle.app.

2. Data we collect

Account

• username, email address, password (stored hashed) or technical identifiers from a social login (Google, Apple, Facebook);
• country, when you provide it;
• authentication tokens required for the app to work.

Use of the Service

• status of your collection (missing, owned, duplicate and quantity) per card and village;
• trade offers, confirmations, disputes, reputation ratings and comments, reports;
• history of collected reward links, if the module is on;
• optional community posts (caption, image you send, moderation status);
• preferences (language, notifications) stored on the device;
• technical push-notification identifiers (device subscription / OneSignal) when you accept notifications.

Data we do not collect

• no game login, no game password, no publisher in-app purchases;
• no official artwork, trademarks or assets of the publisher — TradeCircle has no access to the game servers and does not sync with them;
• no sale of advertising files crossed with the game’s publisher.

3. Purposes and legal bases

• Contract performance: create the account, show the catalog, compute reciprocal matches, follow trades and 72-hour confirmations, display reputation and reliability.
• Legitimate interest: moderating reports and disputes, security, improving the Service, preventing impersonation and content that infringes the game rights holders’ copyright.
• Consent: notifications, in-app advertising (Google UMP consent form) when ads are enabled, social login (according to that provider’s settings).
• Legal obligation: answering an authority, keeping certain records in case of a claim.

4. Recipients

Your data may be accessed:

• by you, in the app;
• by other players, strictly as needed for the Service (username, country, scores, cards involved in a match or offer — never your email);
• by TradeCircle administrators for the catalog, moderation and rewards;
• by Hetzner Online GmbH (Germany, EU) for server and database hosting;
• by Brevo for transactional emails (verification, password reset, service messages);
• by OneSignal to deliver push notifications, when you have accepted them;
• by social identity providers (Google, Apple, Facebook) when you choose to sign in with them;
• by advertising partners (Unity Ads) when ads are enabled in the app, only to serve and measure ads.

These processors are bound by contract and limited to their task. The game’s publisher is not a recipient of your TradeCircle data. Conversely, TradeCircle receives no personal data from the game’s servers.

5. Retention

• account, collection, trades and scores: for the life of the account, then deletion or anonymisation within a reasonable time after closure (unless legally required otherwise);
• reports and moderation decisions: for as long as the file requires, then limited archiving;
• access tokens: until logout, expiry or revocation;
• technical logs: a short period compatible with the security of the Service.

6. Transfers outside the European Union

Primary hosting (Hetzner) is located in Germany, in the European Union. If another processor (social login, push notifications, advertising) is established outside the EU, the transfer occurs only with a recognised mechanism (standard contractual clauses, adequacy decision or equivalent).

7. Your rights

Under the GDPR and the French Data Protection Act, you have rights of access, rectification, erasure, restriction, objection, portability, and the right to withdraw consent. You may also set instructions for after your death, and lodge a complaint with the CNIL (cnil.fr) or your local supervisory authority.

Deleting the account erases or anonymises identifying data. Trades already completed with another player may leave an anonymised trace needed for that player’s scores to remain consistent.

8. Cookies and trackers

The public site (landing, terms, privacy) does not need advertising cookies. A session cookie may be set only for the administration area. The mobile app stores an authentication token and preferences (language, notifications) locally. When ads are enabled, the app may show Unity Ads after a consent prompt (UMP) in the European Economic Area.

9. Minors

The Service is not intended for children below the digital age of consent (15 in France). If an account was created below that age without the legal representative’s agreement, we will delete it as soon as we learn of it.

10. Intellectual property and data

TradeCircle does not copy, index or resell the publisher’s databases, artwork or trademarks. The internal catalog (card names, villages, rarities, tradability, set activity dates) is a community reference used only for matching. It is not an official database and is not synced with the publisher.

Any image you send remains your responsibility: do not place official works, logos or protected elements you have no right to circulate.

11. Security

Hashed passwords, API tokens, admin access separate from player accounts, and limited data exposed to other users. No system is infallible: report any unusual access from the app.

12. Changes

This policy may evolve, including if the catalog, the rewards module or processors change. The date at the top of the page prevails. A substantial change will be announced in the app or on the site.