Privacy policy

Data controller

The controller of your data is TCG Constructor (tax ID -), located at Perú. You can email us at tcgconstructor@gmail.com about any privacy matter.

What data we process

You can use almost the whole site without an account. If you sign up, we only process the data needed for what you use:

• Account: username, email address and password (stored as a hash; we never see it).
• Profile (optional): your avatar.
• What you save: your decks, your favorites and your progress in the "Learn to play" tutorials.
• Sessions: a session identifier (the database only keeps its hashed fingerprint) to keep you signed in.
• Security: the IP address of sign-in, sign-up and email requests, for a few minutes, to stop abuse.
• Server technical logs (IP, date and requested page), for security and to run the service.

Why and on what legal basis

• Providing the service (your account, saving decks and favorites, your progress): performance of the contract you accept when signing up (art. 6.1.b GDPR).
• Sending account emails (confirming your email, recovering your password): performance of the contract.
• Security, bot checks and abuse prevention: legitimate interest (art. 6.1.f GDPR).
• Personalized advertising, if active and you accept it: your consent (art. 6.1.a GDPR), which you can withdraw at any time.
• Answering your questions: your consent when you write to us.

How long we keep it

Your account data and what you save are kept while the account exists; if you delete it (email tcgconstructor@gmail.com), they're erased along with everything in it. If you don't confirm your email within the period shown when you sign up, the account is deleted automatically. Sessions and email links expire on their own, and security data is kept only as long as needed.

Who we share it with

We don't sell your data. It's processed on our behalf, with GDPR safeguards, by the providers we need to run the service:

• Website and database hosting.
• Brevo (Sendinblue SAS, France), which sends account emails.
• Cloudflare (Turnstile), which checks that the sign-up and sign-in forms are used by a person and not a bot.
• Google (AdSense), if advertising is active: it may use cookies to show and measure ads, and to personalize them only if you accept.

International transfers

Some of these providers (such as Cloudflare or Google) may process data outside the European Economic Area, under the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

Your public profile

Anyone can see your public profile: your username, avatar, when you joined, how many decks and favorites you have and for which games, and your "Learn to play" level. Your email and the contents of your decks aren't shown.

Your rights

You can access, rectify and erase your data, object to or restrict its processing, and request its portability. Some of this you can do yourself under "My account" (change your username, email, password or avatar, export your decks); for the rest, email tcgconstructor@gmail.com.

If you think we haven't handled your data properly, you can complain to your data protection authority (in Spain, the AEPD, www.aepd.es).

Minors

You must be at least 14 to sign up, the minimum age in Spain to consent to the processing of your data.