Privacy

Last updated: 23 October 2026

TCG Rift is a free game, with no ads and no purchases. It only keeps what it needs to run your account and your collection. This page says exactly what, why, for how long, and how to have it erased. It follows the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR).

In short

• No password, no email, no real name: we never ask for them.
• No ads, no analytics, no trackers. The site loads nothing from another domain: fonts, images and sounds come from TCG Rift itself.
• Your data stays in Switzerland, with our host.
• You delete your account yourself, at any time, from the Account page. It is immediate and final.

Data controller

Steve Correia, publisher of TCG Rift. For any question about your data: hello@tcg-rift.com.

What we keep

Without an account

You can open a trial pack without signing in. It is stored with no link to your identity: only your session cookie lets us hand it back to you if you create an account right after. To prevent abuse, your IP address is reduced to a fingerprint (SHA-256 hash) that counts trial packs: three at most in 24 hours, then the fingerprint is erased.

Your account

You sign in with Google or Discord. We ask that service for the bare minimum (Google: openid; Discord: identify) and we only keep:

• the name of the service (Google or Discord);
• the technical identifier of your account there, a number that says nothing about you.

Anything else the service may send back (display name, profile picture…) is ignored and never stored. You can link several services to the same account.

Then we keep what you do in the game:

• your username, the site language when you signed up, and the date the account was created;
• your avatar (a champion portrait or one of your cards), your title, your card back, your showcase backdrop, your profile frame, and whether your profile is public or private;
• your collection: each card you own, how many copies, and the date of the first one;
• your packs and fusions: cards obtained, XP, combos, date and time; the state of your 12-hour batch;
• your XP, level, Loyalty packs, achievements and their dates, your weekly challenges and their progress;
• your showcase (pinned cards) and your wanted cards;
• your friends, friend requests, the players you block, and your invite code;
• your notifications: friend requests, reactions received, pull of the week, completed challenges, batch ready;
• the preview images of your shared links (a pull or your showcase), drawn the first time they are requested.

Reactions between friends (the ten stickers) are delivered live; the ones you receive also stay in your notifications, for 30 days at most.

What others can see

• Public profile, the default setting: anyone can see your /u/username page (username, avatar, level, title, join date, showcase, achievements, collection and wanted cards) and the pages of your shared pulls. Public profiles are listed in the sitemap and may appear in search engines.
• Private profile: only your friends can see these pages. For everyone else, they do not exist.
• Your friends also see your pulls from the last 24 hours, your big cards live, your score in the friends leaderboard and the comparison of your collections.
• Your invite link shows your username and avatar to whoever opens it.

Your name and email appear nowhere: we do not have them.

Server logs

• Errors: when something breaks, the server writes a technical message (what failed, and where) and, if you were signed in, your internal account number. These logs do not contain your IP address, are not archived, and disappear when the site is redeployed.
• Visits: the web server keeps no log of pages viewed.
• Abuse limits: some actions (opening a pack, signing in, sending a friend request…) count towards a per-minute limit, tied to your account or, without an account, to a fingerprint of your IP address. These counters are erased after one minute.

Real time

Once you are signed in, your browser opens a WebSocket connection to our own server (Laravel Reverb) to receive your friends’ activity live. It uses a private channel that only you can listen to. The connection itself keeps nothing: messages pass through, then are forgotten (only your notifications stay in the database, see above).

Cookies and local storage

No advertising cookies, no analytics cookies, no cookies from other sites. Everything below is either strictly necessary or a choice you made yourself. That is why there is no consent banner.

Local storage never leaves your browser: we do not read it.

Why we keep it

• Running the game (account, collection, friends, profile): performance of the terms of use you accept when you sign in (Art. 6(1)(b) GDPR).
• Protecting the site and its players (abuse limits, trial-pack IP fingerprint, error logs): our legitimate interest (Art. 6(1)(f) GDPR).
• Your theme and sound preferences: at your request, when you click; they stay in your browser.

No profiling, no advertising, no selling.

How long

• Account and game data: as long as your account exists. When you delete it, everything is erased from the database at once: linked accounts, collection, packs, friends, achievements and share images.
• Notifications: the latest 50, for 30 days at most. Those from a player you block are erased.
• Session: 2 hours of inactivity. “Remember me”: 400 days, or until you sign out.
• Abuse counters: one minute for actions, 24 hours for the trial pack.
• Error logs: until the next redeployment of the site, with no archive.
• Trial pack never claimed: it stays in the database, with no link to anyone once the session has expired.
• Backups: a copy of the database is made every night and kept for 14 days at Swiss Backup, Infomaniak's backup service, in Switzerland. It is only used to recover from a failure. A deleted account therefore also disappears from the backups within 14 days.

Who receives your data

• Our host, Infomaniak Network SA (Geneva, Switzerland), which runs the server and the database in Switzerland on our behalf.
• Google or Discord, only if you choose to sign in with them. You then sign in on their side, under their own privacy policy; they confirm your identifier to us, and we send them nothing else about you.

No one else: nothing is sold, rented or shared for advertising.

Transfers outside Switzerland and the European Union

Your data is stored in Switzerland. The European Union recognises Switzerland as providing an adequate level of protection.

Google and Discord are companies based largely in the United States. When you sign in with them, they process your data under their own rules: Google, Discord. Our server only sends them the sign-in code they just gave you, and keeps nothing from their answer but your identifier.

Your rights

You have the right to access your data, have it corrected or erased, receive a copy in a readable file (portability), object to processing or ask for it to be restricted.

• Yourself: your profile and collection show everything we keep about you. On the Account page, you switch your profile between public and private, and you delete your account.
• By email, for everything else: hello@tcg-rift.com. Since we know neither your name nor your email, we will ask you to prove the account is yours, for example by changing a setting we tell you. Answer within 30 days, free of charge.
• Complaints: in Switzerland, to the Federal Data Protection and Information Commissioner (FDPIC); in the European Union, to the authority of your country, for example the CNIL in France.

Minors

TCG Rift is open from age 13 (see the terms of use). The data kept is the same, minimal, for everyone. If you think a child under 13 has an account, write to us: we will delete it.

Changes

If this policy changes, the date at the top of the page changes too. A significant change will be announced on the site.