Data controller
The controller of personal data connected with Balance of Arcana is Bartosz Czarnecki, Poland.
For any privacy question or request to exercise your rights, contact privacy@balanceofarcana.com.
Scope of this policy
This policy covers balanceofarcana.com, the Balance of Arcana game (currently a Windows prototype and future releases), the newsletter, sign-in services, lobby, online matches, player profiles, match history and communications with us.
Links to third-party services lead to services governed by their own privacy rules.
Data we collect
| Category | Examples |
|---|---|
| Account and sign-in | email address, internal account ID, sign-in method and confirmation status; when Google sign-in is used, also the ID and basic profile data shared by Google |
| Profile | display name and profile creation or update timestamps |
| Gameplay | match and room IDs, wizard names, room settings, participants and bots, in-match actions, result, winner, round count and disconnect information |
| Technical data | IP address, connection time, authentication events, errors, server events and reconnect data; reconnect tokens are stored as hashes |
| Anonymous website statistics | page visited, referrer, language, screen resolution, and browser, operating system and device type; the IP address is used temporarily to determine an approximate country and anonymous session but is never stored |
| Newsletter | email address, form language, subscription source, and information about sending and completing the confirmation process |
| Correspondence | sender address, message content and technical email data when you contact us |
We do not ask for special-category personal data, payment details or your full date of birth. Please do not include such information in your player name or correspondence unless it is necessary.
Purposes and legal bases
- Creating and managing an account, sign-in, running and reconnecting to matches, profiles and match history — performance of a contract or steps taken at your request before entering into one (Article 6(1)(b) GDPR).
- Technical and authentication messages — performance of the service (Article 6(1)(b) GDPR).
- Newsletter about project development, playtests and releases — your freely given consent (Article 6(1)(a) GDPR). We use double opt-in; you can withdraw consent at any time using the unsubscribe link in an email, the unsubscribe page, or by contacting us.
- Security, abuse prevention, diagnostics, match integrity and anonymous website and service statistics — our legitimate interest (Article 6(1)(f) GDPR).
- Answering questions and handling requests — depending on the request, performance of the service or our legitimate interest in communication and establishing or defending legal claims (Article 6(1)(b) or (f) GDPR).
- Meeting legal obligations and responding to authorised public bodies — compliance with a legal obligation (Article 6(1)(c) GDPR).
Your email address and sign-in data are required if you want to create an account and use online features. Other data is provided voluntarily, but a particular function may not work without it.
Data visible to other players
Your display name, wizard name, public room settings and match information may be visible to other participants. Public room information may also appear in the lobby. Do not use information as a name if you do not want it disclosed.
Data recipients and providers
Data may be processed by providers that support the service, only to the extent necessary:
- OVHcloud — server hosting and core infrastructure in the EU;
- Brevo — delivery of authentication email and management and delivery of the newsletter;
- Google — optional Google Account sign-in;
- ImprovMX — forwarding email sent to the privacy contact address.
We may also disclose data where required by law or a valid request from an authorised body, or when necessary to protect the rights and safety of users and the service. We do not sell personal data.
Transfers outside the European Economic Area
The core database and game server are hosted in the European Union. Google, ImprovMX or provider subprocessors may process some data outside the EEA. Where this happens, transfers rely on safeguards required by the GDPR, such as an adequacy decision or Standard Contractual Clauses. Details are available in each provider's privacy notice.
How long we retain data
- Account and profile — while you use the account and, after a deletion request, only as long as needed to complete the request, comply with law or establish or defend legal claims.
- Active match state — for as long as needed to play and resume a match. Inactive waiting rooms are currently removed after about 15 minutes, abandoned active matches after about 30 minutes and completed rooms after about 5 minutes.
- Match history — for as long as needed for profiles, statistics and service integrity. After account deletion, the participant record may remain without an account link in anonymised or pseudonymised form.
- Technical and security logs — only as long as reasonably necessary for diagnostics, security and abuse prevention, after which they are rotated or deleted.
- Anonymous website statistics — for no longer than 24 months, after which older events are deleted.
- Newsletter — until you withdraw consent or the newsletter ends; records required to demonstrate that consent was given or withdrawn may be retained for the applicable limitation period.
- Backups — automatically rotated; backups older than 14 days are currently removed. Data deleted from the primary system may remain in a protected backup until then.
- Correspondence — while handling the matter and then for as long as needed to document it or establish or defend legal claims.
Device storage and cookies
The public website stores no cookies or analytics data in your browser's local storage. It uses Umami, hosted on our own server, to measure visits and selected clicks anonymously. Umami does not build advertising profiles, does not track visitors across websites and respects the “Do Not Track” setting. The game app may store session data and settings locally on your device when necessary to keep you signed in and operate the game. You can remove this data by signing out, clearing the app's data or uninstalling it.
Security
We use safeguards appropriate to the project's stage and risk, including encrypted connections, access controls, authentication, rate limiting, hashed reconnect tokens, backups and basic administrative logs. No storage or transmission method can, however, guarantee absolute security.
Your rights
Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction of processing and data portability, and object to processing based on legitimate interests. You may also withdraw newsletter consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Email privacy@balanceofarcana.com from the address associated with your account. We may ask you to verify your identity. We will delete the account and profile; match history may remain without a link to your account where necessary for result integrity, statistics or legal claims.
You also have the right to lodge a complaint with a supervisory authority. The controller's lead authority is Poland's President of the Personal Data Protection Office (UODO). If you live elsewhere in the EEA, you may normally contact your local supervisory authority.
Automated decision-making
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Bots and server-side randomisation affect gameplay only.
Children's privacy
The service is not directed to children who cannot independently use online services under applicable law. We do not knowingly collect a child's data contrary to the law. A parent or guardian can report such a situation through the privacy contact so that we can verify it and take appropriate action.
Changes to this policy
We may update this policy as the game evolves or when we add platforms, payments or new providers. The current version and revision date will always be published at this address. We may also announce material changes in the game or by email.