Your data
Privacy policy
Last updated: October 24, 2026
This translation is provided for information only; only the French version is legally binding.
In short: we keep the bare minimum to run the game and protect it from cheating. No name, no date of birth, no address, no phone number, no advertising, no resale. You can download or delete your data at any time from your account.
1. Who is responsible
The data controller is the site's publisher: NITO LTD, 1 Poulton Close, Dover, Kent CT17 0HL, Royaume-Uni. Contact for any question about your data: contact@rbxtcg.com.
The company is established in the United Kingdom, which the European Union recognizes as providing adequate data protection. The GDPR rules apply to you if you live in the European Union.
2. The data and why
| Data | Why | Legal basis |
|---|---|---|
| Email, password (never stored in plain text), Discord ID if you log in with Discord | Create your account, log you in, recover your account | Performance of the service you request (contract) |
| Username | Playing, appearing in the rare pulls feed, the leaderboard and your friends' lists | Contract |
| Age declaration ("15 or older" or "under 15 with a parent's agreement") and its date | Apply the protections provided for under-15s | Legal obligation |
| Game activity: cards, gems, charges, guarantee counter, missions, wishlist, friends, trades | Run the game | Contract |
| Log of booster openings and currency movements | Help if something goes wrong, proof that pulls follow the published rates, fraud detection | Contract and legitimate interest |
| Device and IP address fingerprints (see §3), security log, sanctions | One account per device, fighting bots, cheating and account farms | Legitimate interest (security and fairness of the game) |
| Gem purchases: offer, amount, date, Stripe payment ID, status, acceptance of immediate delivery | Delivering gems, handling refunds and disputes, applying the purchase rules, keeping the accounts | Performance of the contract; legal obligation (accounting) |
No data is used for advertising or commercial profiling, or sold. No decision with legal effects is made fully automatically: anti-abuse limits (number of attempts, caps) apply automatically, but a freeze or ban is decided by a person, with a reason you can read and appeal.
3. Device and IP address
To limit multiple accounts, your browser receives a random identifier (cookie rtcg_device, unreadable by the page's scripts). Your IP address is read at sign-up, login or for the trial booster. Neither one is stored in plain text: we only keep a fingerprint computed with a secret key (HMAC-SHA-256), which can't be used to recover the address. For an IPv6 address, only the part that identifies the subscription is taken into account.
These fingerprints are erased 90 days after their last use (7 days after expiry for the trial booster without an account). We don't use any "browser fingerprinting" (fonts, graphics card, etc.).
If an account is deleted while it was frozen or banned, its devices' fingerprint is kept for 90 days, with no link to the account, to prevent someone from immediately creating a new account on the same device.
4. What other players see
Your username (leaderboard, friends, trades) and, if you get a rare card, a line in the pulls feed on the home page. You can remove yourself from the feed in your profile. Choose a username that isn't your real name. There is no free messaging between players.
5. Under 15
The site is open to all ages. At sign-up, each player states whether they are 15 or older; a player under 15 declares that a parent (or their legal guardian) agrees. For these accounts, the username doesn't appear in the public feed by default, and we don't ask for any more data than from other players.
A parent can ask us at any time to access their child's account data or to delete it, at contact@rbxtcg.com.
6. How long
| Data | Duration |
|---|---|
| Account (email, username, age declaration), cards, currencies, missions, friends, currency log, sanctions | Until the account is deleted |
| Booster opening log | 2 years, or until the account is deleted |
| Device and IP address fingerprints linked to the account | 90 days after last use |
| Trial booster without an account (and its fingerprints) | 7 days after it expires |
| Security log | Fingerprints erased after 90 days, event deleted after 1 year |
| Database backups | Replaced after about 7 days |
| Gem purchases (offer, amount, date, Stripe payment ID, status) | 6 years after the purchase (accounting obligations); detached from your account if it's deleted |
These durations are enforced by an automatic deletion every night.
7. Who else receives it
Only the technical service providers the site needs, each for its own role:
| Provider | Role | Data | Country |
|---|---|---|---|
| Vercel Inc. | Site hosting | IP address and requests (technical logs) | United States |
| Supabase Inc. | Database and authentication | email, username, game data, hashes | United States (data in the region chosen for the project) |
| Cloudflare, Inc. (Turnstile) | Anti-bot check at sign-up, login and for the trial booster | IP address and technical browser signals, at the time of the check | United States |
| Sendinblue SAS (Brevo) | Sending emails (login codes, account deletion) | email address, email content | France |
| Discord Inc. | Login with Discord, only if you choose it | Discord ID and email provided by Discord | United States |
| Pwned Passwords (Have I Been Pwned) | Checking that a password hasn't already leaked | the first 5 characters of a password fingerprint, nothing that identifies you | Australia |
| Stripe Payments Europe, Ltd. | Payment for gem purchases | account ID, offer, amount, email and payment details entered at Stripe (we never see your card) | Ireland (possible transfers to the United States) |
Some are located outside the European Union. These transfers rely on the safeguards provided by the GDPR (adequacy decision, including the EU–US Data Privacy Framework, or the European Commission's standard contractual clauses).
8. Your rights
- Download your data (access and portability): "Download my data" button in your account.
- Delete your account (erasure): in your account, with a code sent by email. Everything is erased; the cards are destroyed (their number stays taken, with no link to you).
- Correct some data (rectification), object to processing or ask for it to be restricted: write to contact@rbxtcg.com.
- If you think your rights aren't being respected, you can complain to the data protection authority in your country: in France the CNIL (cnil.fr/fr/plaintes), in the United Kingdom the ICO (ico.org.uk).
We reply within one month. To check that a request really comes from you, we may ask you to write from your account's email.
9. Security
Encrypted connection (HTTPS), passwords hashed by our authentication provider, session cookies unreadable by the page's scripts, database access restricted by per-player rules. Database backups are replaced after about 7 days: deleted data may remain in them until then.
Cookies: the full list and your settings are on the Cookies page.
10. Changes
If this policy changes significantly, we'll say so on the site before the change applies. The date at the top of the page is that of the latest version.
See also: Legal notice · Privacy · Terms of use · Cookies · Drop rates