Privacy Policy

The data controller is [Operator name & address — TBD]. For any question about your data or to exercise your rights, write to [contact address — TBD].

• Account: email address (and whether you have confirmed it), display name, password (stored only as a secure hash), and — if you sign in with Google or Discord — the identifier of that account and the profile picture it provides.
• Profile and settings: avatar card, language, display preferences (sensitive-card blur, public or private profile) and, only if you choose to set them, your country and region for local leaderboards.
• Gameplay: your cards and their history, packs opened, Wikoins transactions, market listings and orders, trades, friends, wishlist, achievements, guild membership and guild chat messages, card reports you send.
• Security: for each signed-in session, the IP address and the browser user agent; security events (failed human checks, rate limits, anti-cheat signals).

We do not collect payment data, we do not use analytics or advertising trackers, and we do not ask for your real name.

• To run your account and the game you signed up for (performance of the contract): sign-in, collection, packs, market, trades, social features.
• To keep the game fair and secure (our legitimate interest): fighting bots, multi-accounting, fraud and abuse, protecting accounts.
• To balance and improve the game (our legitimate interest), using aggregated statistics only.
• To show you on local leaderboards (your consent, which you give by setting a country or region and can withdraw by clearing it).
• To meet our legal obligations, for instance answering a request from the authorities.

Your display name, avatar, guild, score and rank are public in the game. Your collection and profile are public too unless you make your profile private in your settings (friends can still see it). If you set a country or region, it is shown on the matching leaderboards. Your email address is never shown to other players.

Your data is only accessible to the Wikizz team and to the service providers we need to run the game, under contract:

• Cloudflare — hosting, network, the Turnstile check that tells humans from bots, and Cloudflare Email Service, which sends the account emails (address confirmation link, password reset link) to your email address;
• PlanetScale — database hosting;
• Google or Discord — only if you choose to sign in with them;
• Wikimedia — card images are loaded by your browser directly from Wikimedia servers (without telling them which page you are on);
• Google Fonts — the site fonts are loaded from Google’s servers.

We never sell or rent your data, and never share it for advertising.

Some of these providers are based in the United States or may process data outside the European Union. These transfers are covered by the safeguards provided by the GDPR: the EU–US Data Privacy Framework where the provider is certified, or the European Commission’s standard contractual clauses.

• Account, profile and game data: as long as your account exists. When it is deleted, your personal data is erased or anonymized; trades already made with other players stay in their history without being linked to you.
• Sign-in sessions: until they expire or you sign out.
• Security logs: [retention period — TBD], then deleted.
• An inactive account may be deleted after [period — TBD] without activity, after an email notice.

Wikizz only uses what is strictly necessary for the site to work, which is why there is no cookie banner:

• a session cookie that keeps you signed in;
• a language cookie (1 year) that remembers the language you picked;
• temporary browser-storage flags used to reload the page cleanly after an update, or to hide the email-confirmation reminder until your next visit;
• the cookies Cloudflare Turnstile may set to tell humans from bots.

No advertising or audience-measurement cookies are used.

Under the GDPR you can ask to access your data, correct it, erase it, get a copy of it in a portable format, restrict or object to its use, and withdraw your consent at any time. You can also give instructions on what should happen to your data after your death.

To do so, write to [contact address — TBD] from the email address of your account. We answer within one month. Several settings (display name, avatar, language, profile visibility, location) can also be changed directly in the game.

If you think your rights are not respected, you can lodge a complaint with the CNIL (cnil.fr) or with the data protection authority of your country.

Traffic is encrypted (HTTPS), passwords are hashed and never stored in clear, access to the production data is restricted to the people who need it, and sensitive actions are protected by rate limits and human verification. No system is perfectly secure: if a breach affects your data, we will notify you and the authorities as required by law.

Wikizz is not meant for children under 15. If you are under 15, you need the permission of a parent or legal guardian to create an account. If you think a child has given us data without that permission, contact us and we will delete it.

We may update this policy when the game or the law changes. The date at the top of this page shows the latest version; important changes will be announced in the game.