Legal
Privacy Policy
This policy explains what data Tricklora collects, why we collect it, how long we keep it, and how you can have it deleted.
Who we are
Tricklora is a free browser-based card game platform. We are the data controller for the personal data described on this page. You can reach us at any time at stoanovanton011@gmail.com.
What data we collect
We collect the minimum needed to run matches, ranked progression and friend lists.
- Account data: your email address, your password stored only as a bcrypt hash, your display name, and an optional avatar image URL.
- Existing guest data: previously created guest accounts may be identified by a device id and a browser fingerprint hash - a hash built from coarse browser properties such as language, screen size and time zone. We do not store the raw fingerprint values and we do not store your IP address in that record.
- Gameplay data: match results, XP, level, ranked LP, game history, friendships and game invitations.
- Technical data: your browser user agent string, stored with the guest device record so we can detect automated abuse.
What we store on your device
We use your browser's localStorage, not tracking cookies, to keep you signed in. It holds a JWT access token, a refresh token, a cached copy of your profile, your device id, your cookie consent choice, and local preferences such as theme and sound. None of this is shared with third parties. Clearing your browser storage signs you out and, for guest accounts, disconnects you from your progress.
Analytics and cookies
We load Google Tag Manager and Google Analytics 4 to see which pages and game modes are actually used, and Google AdSense shows ads on our public pages. In the EEA, the UK and Switzerland, Google's consent message asks for your choice first: until you agree, Google Consent Mode stays denied and no analytics or advertising identifiers are written. Elsewhere analytics and ads are on by default, and you can turn them off in Cookie settings.
Strictly necessary storage - your session and your consent choice - is always active, because the game cannot function without it. You can change or withdraw your consent at any time in Cookie settings, linked at the bottom of every page; in the EEA, the UK and Switzerland it reopens Google's consent message.
Legal basis for processing
Account and gameplay data are processed to perform our contract with you, which is providing the game. Guest device identifiers are processed on the basis of our legitimate interest in preventing abuse and letting you keep progress without registering. Analytics and advertising data are processed on the basis of your consent in the EEA, the UK and Switzerland, and elsewhere on the basis of our legitimate interest in measuring and funding the service, which you can object to in Cookie settings.
Who we share data with
We do not sell personal data. Data reaches only the providers needed to operate the service: our hosting and database provider, our transactional email provider for verification and password reset messages, and Google for analytics and advertising, as your consent choice allows. Other players can see your display name, avatar, level, title and rank.
How long we keep data
Account data is kept for as long as your account exists. Refresh tokens expire 365 days after they are issued and password reset tokens expire after one hour. When you delete your account, all data listed on the deletion page is erased immediately; aggregated match statistics may remain, but without any identifier that links them to you.
Your rights
Under the GDPR and comparable laws you have the right to:
- Access - ask us for a copy of the personal data we hold about you.
- Rectification - correct inaccurate data. You can edit your name, email and avatar yourself in Settings.
- Erasure - delete your account and its data, which you can do yourself at any time.
- Portability - receive your data in a structured, machine-readable format.
- Objection and restriction - object to processing that is based on our legitimate interest.
- Complaint - lodge a complaint with your national data protection authority.
Deleting your account
You can delete your account yourself at any time from Settings, in the Danger Zone. Deletion is immediate and permanent: your profile, email address, password hash, device fingerprints, friendships, game invitations, notifications, ranked progression and game progress records are erased and cannot be restored. If you cannot sign in, write to stoanovanton011@gmail.com from the email address on the account and we will complete the deletion within 30 days.
Children
Tricklora is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has created an account, contact us and we will delete the account and its data.
Changes to this policy
If we change how we handle data, we will update this page and the date shown above. Material changes will also be announced inside the game before they take effect.
Contact
For any question about this policy, or to exercise any of the rights listed above, write to us at: