Tietosuojaseloste

Who answers for your data

Wesh Oy, Helsinki, Finland, runs Wiki67 and answers for the data in it. Write to [email protected], the same address as everything else, and we answer in English.

What we hold, and why

Your account: the email address you signed up with, your player name, whether that email is confirmed, and your password as a one-way scramble that nobody, us included, can read back. Sign in with Google, and Google gives us your name, your email address and an account identifier, never your password. We need this to give you an account and keep it safe: it is the contract between us.

Your game: the packs you opened, the cards you hold, your coins, your listings, your albums, your achievements, your membership, your friends and the players who joined through your link. Without it there is no game: the contract again.

Your purchases: what you bought, when, for how much, and the payment's references at Stripe, which keeps your email with them. We need them to deliver what you paid for and to keep the accounts the law asks of us.

Your settings: the switches you set, sensitive pictures on or off, whether your profile is public, and when the game was last open, which is how your friends see you online. We apply them because you set them.

Your age, as you told us: when you signed up confirming you are 15 or older, with the version of the terms you accepted, and when you ticked that you are 18 or older. Never a date of birth or an ID. We keep it to apply the age limits and to show what you agreed to.

Where you came from: when you sign up after clicking an ad or an invite link, we keep the link's tags (source, campaign, ad) with your account, the site that sent you, and the click identifier Google, Meta or TikTok added to an ad's link. We count which ads bring players, and send nothing back to the ad platforms. This rests on our interest in knowing what our ads are worth.

Notifications: turn them on and we keep the address of your browser's notification channel, on that device, so we can tell you your packs are full. That is your consent: turn them off in Settings or in your browser whenever you like.

Security: a signed-in device keeps the IP address and the browser it used, as part of the session, and our servers keep technical records of requests and errors. The names you write go through moderation, and we keep what we need to handle a report, an appeal or a ban. This rests on our interest in a game that works and stays clean.

Visits: when you open our home page without an account, we count you once a day with a code made from your IP address and your browser. The code changes every day, and we keep neither your IP address nor your browser with it. This rests on our interest in knowing what brings players to the game.

Your messages: what you write to our address, to answer you and settle what you ask.

That is all. We do not sell your data, we build no advertising profile about you, we send you no promotional email, and we run no tracker of anybody else's on the site.

What other players see

Other players see your player name and your place on the leaderboard. A public profile, which is the default today, also shows your showcase cards and your albums to anyone; switch it to private in Settings and only your friends see them.

What you list on the market shows the card and its price, not who sells it. Your email address is never shown to anyone.

Who else sees it

These companies work for us, each only for its own part. Hetzner Online GmbH keeps the servers and the database in Germany, and the backups in Germany. Resend sends our emails, so it sees your address and what we write to you. OpenAI checks the names you write against its moderation service, which answers allowed or not: it gets the name, nothing else. Proton keeps our mailbox, with the messages you send us. Your browser's maker (Google, Apple or Mozilla) carries the notifications you turned on. Google signs you in if you choose it. Stripe handles payments: it gets your email, your account id and what you buy, takes your card, and keeps it for your next purchase only if you tick the box.

The two of us can see accounts, collections and listings in our dashboard; nobody else gets that access. We hand data to an authority only when the law makes us, or when we need it to defend a claim.

Resend, OpenAI, Google and Stripe can handle data in the United States, Proton in Switzerland. OpenAI is used only to check player names for sensitive content, and Google only to sign in with Google. Those transfers rest on the European Commission's adequacy decisions, including the EU-US Data Privacy Framework, or on the Commission's standard contractual clauses in our agreements with them.

How long we keep it

Your account and your game stay until you delete the account. Delete account in Settings erases them from the game at once. The database backups keep a copy for up to 14 days before it is gone for good; if we ever restore one, we delete your account again before anything uses it.

Payment records stay after you delete your account, no longer tied to it in the game: Finnish accounting law makes us keep them for six years after the year of the payment. Server records of requests and errors are kept for up to 30 days. Your messages to us are kept until the matter is settled, and longer only when we need them to answer a claim.

Cookies and your browser

Our own cookies only: one keeps you signed in, the other remembers the language you picked, for the browser session only. No advertising cookie, no analytics cookie, no tracker of anybody else's, so there is no banner to click.

Your browser also keeps a few of your choices on your device, like sound and animations off, a prompt you closed, or that you opened the demo pack. They never leave it.

Automatic checks

The names you write are checked automatically against our word list and, where it is on, OpenAI's moderation. A name that is refused is just refused: change it, or write to us and one of us looks at it. No other decision about you is made by a machine alone.

What you can ask for

Ask what we hold about you, have it corrected, have it deleted, take a copy of it with you, have us stop using it while we check something, or object to a use that rests on our interest. Withdrawing a consent is just as easy as giving it.

Write to us and we answer within a month. If a request is complex and needs more time, we tell you within that month. We may ask you to write from your account's email address, to be sure it is you.

You can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or to the authority of the country where you live or work, without writing to us first.

Age

The game is for people aged 15 and older, and buying and sensitive pictures are for adults. You tell us your age; we do not check it. If we learn that an account belongs to someone under 15, we delete it, with everything in it; a parent or guardian can write to us.

When this notice changes

A change shows up on this page before it applies, and we tell you about a change that matters. A new use that needs your consent waits until you give it.