Privacy Policy

Who handles your data

L9sneaky, operating DCGA (Digimon Card Game App) from Saudi Arabia, is responsible for the personal data handled by the app service. For privacy questions or requests, email sneakystarfrost@gmail.com.

Information we use and why

Account information: the username or email you enter, an account identifier, securely hashed password information on the authentication server, and authentication/session records. We use these to create and secure your account and sign you in. We also record the version of the signup documents you accept and the server time of acceptance.

Deck information: deck names, selected cards, quantities and sync timestamps associated with your account. We use these to save and synchronize your decks. Search preferences, downloaded cards and images, and other app settings are also stored on your device.

Purchase information, when billing is available: account identifier, product and transaction identifiers, purchase history and verified supporter status. We use these to validate purchases, restore access and respond to refunds or revoked transactions. Apple or Google processes your payment; DCGA does not receive your full payment-card details.

Optional reveal alerts, when available: if you enable notifications, the service uses your account identifier, device push token or browser push subscription, notification preferences and delivery records to send new-reveal alerts. The signup checkbox does not enable notifications or give notification permission.

Service and support information: network requests can include your IP address and technical request details in server/provider logs. Emails you send contain the information you choose to provide. These are used to operate and protect the service, troubleshoot problems and respond to requests. Do not send your password or full payment-card details to support.

Account, sync and purchase processing is used to provide the services you request. Security, legal recordkeeping and support processing must have an applicable lawful basis. Where processing requires your consent, we will request it separately for the stated purpose. Refusing necessary account information prevents us from creating or operating that account.

Providers and processing locations

DCGA uses a self-hosted Supabase-based account and database service. Hosting and network providers process requests needed to reach the service; the current shared preview uses ngrok. The Expo development/update infrastructure may process requests needed to load or update the app.

When native billing is configured, RevenueCat processes the app account identifier and store purchase information to validate purchases and maintain supporter access. Apple and Google also handle purchases under their own privacy policies. Sending a support email uses your email provider and the support mailbox provider.

If you enable reveal notifications, Expo and the push-notification provider for your device or browser process the delivery destination and notification contents to deliver the alerts you requested. You can revoke notification permission in your device or browser settings.

These providers may process data outside Saudi Arabia. International transfers must meet applicable data-protection requirements; accepting the Terms of Use is not blanket consent to international transfers. Contact us for information about the providers and safeguards relevant to your request.

The current app has no advertising SDK or advertising-tracking feature. We do not sell your personal data. This policy must be updated before adding different data uses or providers.

Storage, retention and security

Data is stored in the account database, on your device, and by the providers described above as needed for their functions. Native authentication sessions use secure device storage; the web app uses browser storage. Protect access to your device and browser.

Account and cloud deck records are kept while your account is active. Deleting your account removes its active account, cloud deck, signup-acceptance and local supporter-status records from DCGA's database. Cached data on other devices or exported files may remain until you remove them.

Service logs, backups, notification registrations and delivery records, support correspondence and provider purchase records may have separate retention requirements. Records retained for a legal, security or fraud-prevention need are limited to that purpose. Contact us to request deletion or details of any remaining records. No system can guarantee absolute security.

Your rights and account deletion

You may request information about processing, access to or a readable copy of your personal data, correction, and deletion, subject to applicable law. Where consent is the basis for processing, you may withdraw it. Contact sneakystarfrost@gmail.com to exercise these rights; we may need to verify that the request concerns your account. You may also raise a complaint with the relevant data-protection authority.

To delete your DCGA account, use Settings > Delete Account. You can also email sneakystarfrost@gmail.com with the subject 'DCGA account deletion' to request deletion without reinstalling the app. Include your username or account email, but never your password. We will explain any data that must be retained and why.

Store purchase records are handled separately by Apple, Google and, when used, RevenueCat. Contact us about deletion of provider-held data associated with DCGA. A deletion request is separate from a request for a store refund.

Permissions, young users and updates

If you export a deck image to your photo library, the app may ask for the device permission needed to save that image. You can manage permissions in your device settings. The signup checkbox does not replace those permission choices.

Parents or guardians should contact us if a child has provided personal data without any authorization required by applicable law. We will review requests to remove that information.

We will update this policy when our practices change and provide additional notice or request consent where required. The effective date identifies the version you are reading.