Privacy Policy

1. Information we collect

• Account details. Your email address, username, display name, chosen avatar, account settings and sign-in history. If you set a password, we store a salted password hash rather than the password itself.
• Connected accounts. Google sign-in provides a verified email address and Google account identifier. Linking Discord provides your Discord identifier and username. We also record the club-server membership and rank-role information needed for the connection. We do not receive your Google or Discord password.
• Game activity. Games, table participation, match results, rankings, tournament registrations and results, balances, rewards, items, gifts and store activity.
• Content and communication. Messages you send, uploaded avatars and custom emotes, player reports, and information you send when asking for help.
• Payments. Pack orders, amounts, currencies, payment status, provider receipts, payment references or transaction hashes, and information needed to credit or review a purchase. Information you enter on a payment provider's website is also handled under that provider's own policy.
• Technical information. IP addresses, browser and device information, requested pages, connection times, errors and approximate country information derived from your connection. Our use of approximate country information does not require your device's precise GPS location.

2. How we use your information

We use this information to create and secure your account, keep games connected, match players, show results and rankings, deliver messages and items, process purchases and rewards, manage tournaments, and answer support requests.

We also use activity and technical records to understand how the club is used, improve performance, investigate bugs, prevent fraud and abuse, and handle player reports or disputes.

If you choose to link Discord, the connection can check club-server membership and manage relevant club roles. Where the authorization screen requests permission to join the server, that action uses the permissions you approve there.

3. Who can see or receive your information

Other players can see information needed for the community and games, such as your public profile, avatar, rankings, match or tournament results, presence, and messages or emotes you send to them. Avoid putting private information in your display name, avatar, emotes or table chat.

Direct messages are delivered to the other participant and stored on our servers. They are not end-to-end encrypted. Club administration tools provide access to records used for support, operation, payment review and moderation.

Providers supporting the service may process relevant information:

• DigitalOcean and Cloudflare support hosting, delivery, connection security and protection against abuse.
• Google provides sign-in and Analytics. Advertising is discussed separately below.
• Discord handles optional account linking, server membership and community features you use.
• Ba9chich and payment services you choose handle payment activity. Cryptocurrency transaction details recorded on a public blockchain may be visible independently of KartaClub.

We may also disclose relevant records when required by law or when necessary to investigate fraud, protect the service, or address a serious safety or rights concern. Hosting and other providers may process data outside your country. Contact us if you need more information about a particular provider or transfer.

4. Cookies and browser storage

KartaClub uses browser storage to keep you signed in and remember choices such as language, sound settings, muted players and dismissed announcements. Connection and authorization features may also use cookies, including a short-lived cookie to protect Discord linking.

Google services may place or read cookies and similar identifiers. You can block or clear cookies and site storage in your browser. Clearing the club's stored session signs you out and may reset preferences. Blocking required storage can prevent sign-in or account linking from working.

5. Google Analytics and advertising

We use Google Analytics to understand visits and use of the website. When the Analytics script loads, your browser sends information to Google, including page information, your IP address and browser/device information. Analytics can use cookies and identifiers to measure visits and interactions.

How Google uses information from sites and apps that use its services explains Google's processing. You can also read Google's Privacy Policy and use the Google Analytics browser opt-out add-on where supported.

KartaClub shows ads from Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to KartaClub or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to KartaClub and/or other sites on the Internet.

Google and other advertising partners may also place and read cookies, web beacons, IP addresses or other identifiers to deliver and measure ads and to prevent fraud. The cookies of other third-party vendors or ad networks may be used to serve ads on KartaClub too.

You can opt out of personalized advertising from Google in Ads Settings, which opens Google's My Ad Center. You can opt out of other vendors' use of cookies for personalized advertising at aboutads.info. Where the law requires consent, such as in the European Economic Area, the United Kingdom and Switzerland, ads only use those cookies after you accept them in the consent message.

6. How long we keep information

Account information is kept while your account is active, unless you change or delete it. Sign-in sessions have a 30-day expiry that can renew with activity. Routine table-chat log entries are scheduled to expire after 30 days; separate reports or investigation records may retain relevant information longer.

We do not currently apply one automatic deletion period to every record. Match and tournament history, payment and transaction records, moderation records, technical logs and backups may be retained after an account is deleted for service history, dispute handling, fraud prevention, recovery or legal obligations. Deleting an account does not automatically erase those records.

For a request concerning a retained record or uploaded image, email us. We will review what remains, why it is retained, and whether it can be deleted or de-identified.

7. Your choices and account deletion

You can change account details, manage your password and unlink Discord from Settings. Unlinking an account does not delete records separately held by Google or Discord.

1. Sign in and open Settings.
2. Leave any active table, lobby or tournament that prevents deletion.
3. Choose Delete my account, type DELETE, and confirm.

This removes the account, its sessions, friendship/request references, and sent and received direct messages from the active service. Historical and other retained records are described above. Other people may still have copies of information you shared with them.

You can email [email protected] to request access, correction or deletion, ask about retained data, or raise a privacy concern. Depending on where you live, you may have additional rights, including to object to or restrict certain uses, receive a copy of your data, or complain to a relevant privacy authority. We may need to verify that a request concerns your account. Please do not send identity documents unless we ask for them.

8. Children's information

If you are a parent or guardian and believe a child has provided personal information that should not be held by KartaClub, contact [email protected] so we can review the account and the request.

9. Security and policy updates

We use measures such as HTTPS, password hashing and account access controls to protect information. No online service can guarantee complete security. Keep your password and sign-in session private, and tell us if you think someone has accessed your account.

We will update this page when our practices change and revise the date above. Where a change requires further notice or consent, we will provide it before relying on that consent.