Privacy Policy

Last updated: October 21, 2026

Short version: we collect the minimum we need to run your account and the auctions. We don't sell your data, we don't run ads, and we don't use third-party analytics or tracking cookies.

What we collect

• Account: the ID our login provider (Privy) gives us, and the login method you choose (for example your X account or email), plus the username you pick.
• Wallets: your Solana wallet address and any address you withdraw to.
• Activity: deposits, withdrawals and their transaction signatures, your balance history, bids, units won, cards, sales, claims, points and chat messages.
• Technical: IP address and basic request logs (browser type, time), kept to keep the Service secure and fix problems.
• On your device: we store a few preferences in your browser (for example sound on/off, or that you've seen the welcome screen), and our login provider stores what it needs to keep you signed in. None of this is used for tracking or ads.

Your username, bids, wins, cards pulled, points and chat messages are public on the site. Blockchain transactions are public by nature.

Why we use it

• To run your account, balance, auctions, Vault and withdrawals (to provide the Service you asked for).
• To prevent fraud, abuse, multiple accounts and cheating, and to keep the Service secure (our legitimate interest).
• To meet legal obligations, such as keeping financial records or answering lawful requests from authorities.
• To run the points leaderboard and any future airdrop.
• To answer you when you contact us.

Who we share it with

Only with the providers we need to run the Service, and only what they need:

• Privy: login and embedded wallets.
• Solana network and RPC providers: to send and check transactions.
• The card vault that holds the cards: we buy packs on your behalf, and when you claim a card its NFT is sent to your wallet address.
• Hosting (our servers are in the European Union) and Google Fonts, which receives your IP address when the page loads its fonts.
• Authorities, when the law requires it.

We never sell your data or share it for advertising.

How long we keep it

We keep account and transaction records while your account is open and for as long as the law requires us to keep financial records afterwards. Request logs are kept for a short time (usually less than 30 days) unless we need them to investigate abuse. Information written to the blockchain can't be deleted by anyone.

Your rights

Depending on where you live, you can ask us for a copy of your data, to correct it, to delete it, or to restrict or object to how we use it. Some data we must keep for legal or security reasons. Write to us and we'll reply within 30 days. If you're in the EU/UK you can also complain to your data protection authority.

Security

We protect your data with encryption in transit, access controls and regular backups. No system is perfectly secure: keep your login and wallet safe, and tell us right away if you think your account has been compromised.

Children

The Service is only for people aged 18 or over. We don't knowingly collect data from minors; if we find out, we'll close the account.

Changes and contact

We'll post any changes to this policy here and update the date above. Questions or requests: [email protected].