PRIVACY // DRAFT FOR HK LAUNCH
Privacy policy
Last updated: 28 August 2026. This page describes the prototype’s current data handling; legal and retention-period reviews remain pending before public launch.
Data currently collected
Browsing and searching cards currently requires no account. This prototype does not sell personal data or create player-skill rankings, matchmaking, or win-rate analytics. The enquiry form stores the email address, enquiry type and content supplied by the sender, submission time, language, and notification delivery state so the team can respond and administer requests.
Enquiries and spam prevention
Each IP address may submit one enquiry per minute. The application does not store the raw IP address in the enquiry table; it stores a keyed, one-way hash used to enforce that limit. Enquiry details, including the sender’s email and message, are sent to the site team through a private Telegram bot chat. Telegram processes that copy under its own terms. A final enquiry and IP-hash retention period, and a deletion-request workflow, must be defined before public launch.
Google sign-in
Sign-in requests only basic Google identity scopes: a stable account identifier, email address and verification status, display name, and avatar URL. The site stores the linked Google account, account role, and revocable server-side session needed to recognize returning users. Google access, refresh, and ID tokens are removed before database writes.
Decks, retention, and deletion
Private decks will be accessible only to their account owner. Account and session data is retained while the account exists; expired sessions may be cleaned periodically. Before public launch, the site will add data export, self-service account and deck deletion, and a defined backup-retention period. Contact the site administrator to delete a test account for now.
Technical logs
The host may retain short-lived security and diagnostic logs, including request times, page paths, and error details. Logs must not contain database passwords, Azure connection strings, or complete OAuth tokens.
Third-party links
The site links to Riot Games, Google, and other official websites, each governed by its own privacy policy. Controller contact details and notices required under Hong Kong’s Personal Data (Privacy) Ordinance will be added before public operation.