Privacy Policy

The short version: we keep what the game needs to work, and nothing we do not need. We do not sell anything to anyone.

What we hold

• Your account - email address, and the GitHub handle and avatar if you signed in that way. Held by Supabase, our database provider.
• Your game - cards, Commits, streak, quests, friends and trades. One row per player.
• Your public handle and showcase - these are deliberately public: that is what the showcase is for.
• Nothing about your card - purchases are sold and billed by Paddle.com, who holds the payment details. We are told that an order was paid, and for which account.
• A bug report, if you send one - what you wrote, the screenshot if you attached one, your browser, screen size, language and time zone, the page you were on, and your handle if you are signed in. It is delivered to us by email and kept only as long as the bug is open.

Playing without an account holds nothing on our side at all: the cards of a visitor live in that browser only, and follow you to an account if you create one.

Why

To run the game you asked to play - that is the contract between us, and contractual necessity is the legal basis for everything above. Audience measurement is separate: its basis is your consent, and nothing else.

Cookies and similar storage

DevDeck stores a sign-in session, your sound setting, and - without an account - your cards. These are strictly necessary: without them there is no game, and they are never shared.

Beyond that, PostHog measures how the game is played. It is loaded only if you accept - not loaded and then muted, but not loaded at all.

Your current choice: not yet made.

How long

Your game for as long as the account exists, and 30 days after you ask for deletion - the delay is there so an account deleted by mistake can be brought back. Audience measurement is kept 14 months at most.

Your rights

Access, correction, deletion, portability, and objection. Write to contact@devdeck.fr and you will have an answer within one month. If that answer does not satisfy you, you can complain to your national data protection authority - in France, the CNIL.

Who else sees it

• Supabase - the database and the sign-in service.
• Vercel Inc. - the servers the game runs on.
• GitHub - only if you sign in with it.
• Paddle.com - only if you buy Commits. It bills you, works out the tax, and screens the payment for fraud.
• PostHog - only with your consent, and only to see how the game is played.

The service that emails us your bug reports sees them on the way. No one else. Nothing is sold, and nothing is used for advertising.

Some of these providers are based in the United States. Where your data leaves the European Union, the transfer relies on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses, as each provider's data processing terms set out.