Privacy policy
How TactiDeck handles your data.
Last updated:
This policy explains what TactiDeck collects when you visit the site or play the game, why we collect it, who we share it with, and the choices you have. It covers tactideck.com and the TactiDeck web application.
Who is responsible for your data
TactiDeck operates this website and the game service, and decides why and how the personal data described here is processed.
If you have a question about this policy or want to exercise a privacy right, write to [email protected].
The data we collect
The account record is deliberately small. TactiDeck does not ask for a legal name, a postal address, a phone number, or payment details.
- Account data: your team name, email address, a hashed password, whether your email is verified, your preferred language, and the dates your account was created and last active.
- Social sign-in data: when you sign in with Google or X, we receive your email address and the account identifier that provider uses, and we store the link between that identifier and your TactiDeck account. We never receive your provider password.
- Gameplay data: your card collection, squads, formations, team instructions, match preparations, league standings, match results and reports, rewards, and the share links you create.
- Technical data: the IP address, browser type, and request details our servers log to keep sessions working, apply rate limits, and investigate errors or abuse.
- Usage data: aggregated page views and sign-up events measured through Google Analytics.
How and why we use it
Each purpose below is tied to a lawful basis under the GDPR and the Turkish Personal Data Protection Law (KVKK).
- Running your account and the game, including matches, leagues, and rewards. Basis: performance of our contract with you.
- Sending service email such as email verification, email change confirmation, and password reset. Basis: performance of our contract with you.
- Keeping the service secure and the league fair, including rate limiting, abuse detection, and incident investigation. Basis: our legitimate interest in a safe and fair service.
- Understanding which pages and features are used so we can improve them. Basis: our legitimate interest in aggregated product measurement.
- Meeting legal obligations and responding to lawful requests. Basis: legal obligation.
What other players can see
Your team name is visible to the opponents you face, in league standings, and in match reports. Your email address is never shown to other players.
When you create a share link for a match report, anyone holding that link can open the report and see the team names, the result, and the report content. You can revoke a share link at any time, after which the link stops working.
Where your data is processed
Our providers may process data outside your country, including outside the European Economic Area and Türkiye. Where that happens we rely on an appropriate transfer safeguard, such as an adequacy decision or the European Commission Standard Contractual Clauses.
How long we keep it
We keep personal data only for as long as the purpose it was collected for requires.
- Account and gameplay data: for as long as your account exists.
- Deleted accounts: your account and the personal data linked to it are removed when you delete the account. Aggregated records that no longer identify you may remain.
- Security and server logs: a short period, normally no longer than 12 months, unless a longer period is needed to investigate an incident.
- Analytics data: for the retention period configured in Google Analytics.
How we protect it
Passwords are stored only as salted hashes, traffic is served over HTTPS, and the session refresh token lives in an HttpOnly cookie that scripts cannot read. Access to production data is limited to what operating the service requires.
No online service can promise perfect security. Use a unique password, and tell us at [email protected] if you believe someone else has reached your account.
Your rights
Depending on where you live, you may exercise the following rights over your personal data.
You can change your team name and email address, and delete your account, from your profile settings. For anything else write to [email protected], and we will answer within 30 days.
- Access a copy of the data we hold about you.
- Correct data that is inaccurate or incomplete.
- Delete your account and the personal data linked to it.
- Restrict or object to processing, including processing based on our legitimate interests.
- Receive your data in a portable format.
- Complain to a supervisory authority, such as the Turkish Personal Data Protection Authority or your local European authority.
Children
TactiDeck is not directed to children under 13 and we do not knowingly collect their data. Where local law sets a higher age for agreeing to online services, that age applies instead. If you believe a child has created an account, write to [email protected] and we will remove it.
Changes to this policy
We update this policy when the service or the applicable rules change. The date at the top of the page always shows the current version, and we announce significant changes in the app or by email before they take effect.
Questions about your data
Write to us and we will get back to you.