Privacy policy

The data controller is Théo THOUVENIN EI, publisher of Wild TCG, 59 rue de Ponthieu, bureau 326, 75008 Paris, France.

For any question about your data: wild.tcg.contact@gmail.com.

• Your account: your e-mail address, your username and your password. The password is stored in hashed form: nobody, not even us, can read it.
• If you sign in with Google: Google sends us your e-mail address, your name, your profile picture and your Google account ID. We only use the e-mail and the ID to sign you in. The name and picture are kept with your account by our authentication provider, but we neither display nor use them.
• Your game: the cards you get, the boosters you open, your dust, your luck counters and the related dates.
• Technical data: your IP address and sign-in details (date, browser) are used to limit sign-in attempts and detect abuse.
• Notifications (only if you turn them on): the technical delivery address provided by your browser and your choices (booster ready, trades). Deleted as soon as you turn them off in My account.

We do not collect your location, your contacts or your browsing on other websites.

• To create your account, run the game and save your collection. Legal basis: performance of the terms of use you accept when signing up.
• To send you the essential e-mails (address confirmation, new password). Legal basis: performance of the terms of use. We will not send you a newsletter without your consent.
• To protect the game against cheating, bots and attacks. Legal basis: our legitimate interest in offering a safe and fair game.

Wild TCG's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This data is only used to sign you in. It is never sold, shared, or used for advertising or to train artificial intelligence models. We have no access to anything else in your Google account.

Only the publisher and the technical providers the game cannot run without have access, each for its own task:

• Supabase, Inc.: database, authentication and image storage. The data is hosted in Ireland (European Union).
• Vercel Inc.: website hosting.
• Google: only if you choose "Continue with Google".
• Stripe Payments Europe, Ltd.: payment for shop purchases, only if you buy something. Stripe receives your e-mail and payment details; we only receive the payment confirmation.
• Cloudflare, Inc.: anti-bot check (Turnstile) on the sign-in and sign-up forms. It looks at technical information from your browser, without advertising cookies.
• Your browser's notification services (Google, Apple, Mozilla…): only if you turn notifications on. They carry our messages encrypted, without being able to read them.

Other players can see your username (in the arena, for example), never your e-mail address. Players you accept as friends can also see your card collection.

Our data is stored in the European Union. As Supabase is an American company, access from outside the EU remains possible for maintenance: it is covered by the European Commission's standard contractual clauses. Google is certified under the EU–US Data Privacy Framework.

• Your account and your game: as long as your account exists. If you delete it, your data is erased within 30 days; backup copies are overwritten in the following weeks.
• Inactive account: after 3 years without signing in, your account may be deleted. We will warn you by e-mail first.
• Technical data: only for as long as the game's security requires.

Wild TCG only uses cookies that are essential for it to work. They do not require your consent and are never used to track you:

• Session cookie (name starting with "sb-"): keeps you signed in until you sign out.
• NEXT_LOCALE: remembers the language you chose.
• Your device's local storage (not a cookie): remembers that you saw this cookie notice and your answer to the notifications offer. This information never leaves your device.

No advertising or audience measurement cookies.

At any time you can ask to access your data, correct it, erase it, receive it in a readable format (portability), restrict its use or object to it. You can also give instructions about what happens to your data after your death.

You can delete your account yourself from My account. To exercise the other rights, write to wild.tcg.contact@gmail.com from your account's address. We reply within one month.

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL, or with the authority of your country.

Wild TCG is open to everyone. If you are under 15, ask a parent to read this page with you before creating an account. Your parents can exercise your rights by writing to us.

Traffic with the site is encrypted (HTTPS), passwords are hashed, and access rules make sure each player can only read their own data.

This policy may change, for example when the shop opens. The date of the last update is shown at the top of the page; for any significant change, we will let you know in the game or by e-mail. The current version is always available at https://wild-tcg.com/en/privacy.