Privacy Policy

1. What we collect

• Account: your email, chosen username, hashed password (never plaintext — we use Argon2id), and, if you sign in with Google or Discord, the identifiers those providers give us. OAuth tokens are encrypted at rest.
• Profile: your 13+ attestation and when you gave it (not your date of birth), which Terms/Privacy version you accepted and when, and your visibility preferences.
• Decks and matches: decks you explicitly save, their version history, and match results you and an opponent both confirm.
• Stores: if you register or join a store, its public contact details and your membership role.
• Quote requests: if you request a price quote from a store, the cards/quantities you selected and your email (shown to the store as the reply address). These are automatically deleted after 30 days.
• Audit log: a record of sensitive actions (sign-ins, profile/visibility changes, store actions) for security and abuse investigation. It never contains passwords, tokens, or your deck contents.

2. What's public and what's private

Your profile is private by default. You choose whether visitors can see your optional profile details, aggregate win/loss stats, deck count, or individual decks. Your email, linked login providers, age attestation, store membership, full match history, and private decks are never shown publicly — this is enforced on the server, not just hidden with styling.

3. Where your data lives

Data is stored in MongoDB Atlas. Transactional email (verification, password reset, Magic Link, store invitations) is sent through Resend from accounts@shardbugs.tierrahuecastudio.com. We don't sell your data or share it with advertisers.

4. Sessions and security

Sessions use secure, HttpOnly cookies with origin validation. You can view and revoke your active sessions from your account page at any time, including "sign out everywhere else."

5. Your rights: export, correct, delete

You can request an export or correction of your data, or delete your account, from your account settings (or by contacting us if a control isn't available yet). Deleting your account:

• Revokes all sessions and unlinks OAuth providers.
• Removes your login and contact information.
• Irreversibly disconnects your personal data from historical records — past tournament standings may keep a non-identifying label like "Deleted User" instead of your username, since removing the standing entirely would be unfair to other participants.

Deletion is permanent, not a reversible deactivation.

6. Minors

We don't knowingly create accounts for anyone under 13. Under-13 participants may only join as guests at in-person tournaments, without an account and without us storing personal data about them.

7. Changes to this policy

If we materially change what we collect or how we use it, you'll be asked to accept the new version before continuing to use account features. Your consent history (which version, and when) is kept on record and shown on your account page.