Privacy Policy.

1. Controller and contact

Petr Liška, trading as UNCStudio. Czech sole trader, IČO (business identification number): 19968248. Registered address: Krumsín 52, 798 03 Krumsín, Czech Republic.

This operator is the controller of the personal data described below. For privacy questions and requests, email [email protected] or write to the registered address. UNCStudio is the brand used for the shared account service.

2. Information we process

• Accounts: guest/account identifiers, authentication tokens (hashed on the server), player name and tag. If you link an UNCStudio Account, we process your email address, verification and account-linking records. The website processes your email and one-time code for sign-in and stores the verified account ID, name, tag and a separate website session; its forum database does not store game progress.
• Gameplay: saved collection, progression, trophies, decks, cosmetics, battle results and replay actions, including card placements, timings and emotes.
• Social and community features: friend and clan relationships, chat, forum topics and replies, reports, account restrictions and moderation records.
• Game improvement: matchmaking skill estimates and match measurements such as reaction time and elixir use. Gameplay copies used to improve computer opponents remove names and replace account identifiers with keyed hashes. These copies are pseudonymized, not assumed to be irreversibly anonymous.
• Technical and support information: request time, IP address and technical request details processed by hosting/security services; information you provide when contacting support. Apple may provide beta feedback and crash information through TestFlight.

Account data comes from you and your use of the service; authentication status comes from UNCStudio Account. We do not ask for contacts, precise location or payment-card details to use this website.

3. Purposes and legal bases

• Providing the requested service (GDPR Article 6(1)(b)): authentication, account recovery, saved progress, matches and the social/forum features you choose to use. Required account information is needed to provide these features; the public wiki can be read without an account.
• Legitimate interests (Article 6(1)(f)): securing the service, preventing fraud and abuse, moderating content, diagnosing problems and improving game balance and computer opponents. The interests are reliable gameplay and a safe community, balanced against players’ rights. You may object to processing on this basis.
• Legal obligations (Article 6(1)(c)): responding to valid legal requirements and applicable data-protection obligations.

If we introduce optional processing requiring consent, we will request it separately. Consent can be withdrawn without affecting the lawfulness of processing before withdrawal. Using the website is not consent to advertising tracking.

4. Visibility and recipients

Player names, tags, rankings and relevant battle/replay information can be visible to other players. Clan content is visible within its available social features. Forum posts, display names, tags and posting times are public and may be indexed by search engines. Do not post personal information you do not want made public. Reports and moderation records are restricted to authorized operators and moderators.

Service providers process the information needed to deliver hosting, network security and email. These include our VPS hosting provider, Cloudflare for traffic delivery/protection and Resend for account-code email, and hCaptcha (Intuition Machines, Inc.) for bot protection on the sign-in form. hCaptcha processes technical browser/device, network and challenge-interaction information to distinguish people from automated abuse; verification is required before sending an email code. Apple operates TestFlight under its own privacy terms. We do not sell personal data or use it for cross-app advertising tracking.

Providers may process information outside the European Economic Area. Applicable transfer arrangements depend on the provider and destination. Contact us for the current recipient, location and safeguard details and how to obtain a copy of applicable safeguards. Provider information: Cloudflare, Resend and Apple and hCaptcha.

5. Retention

Account and progression records are retained while the account is maintained, subject to erasure requests and any applicable legal exception. Public content remains available until removed or anonymized; hiding a post for moderation does not erase it from the database.

Website sessions expire after seven days or are revoked on sign-out; expired rows are removed during subsequent session creation. Rate-limit records expire according to their protection window and are cleaned on subsequent rate-limit checks. Recent replay history is pruned as new games are recorded, while shared replays and separate learning archives have different lifecycles.

There is currently no uniform automatic expiry for accounts, community content, moderation records or the separate gameplay-learning archive. Their retention must be assessed against the continuing purpose, deletion/objection requests and legal requirements. Technical logs and backups follow the relevant operator/provider lifecycle; where an erasure request affects them, we will explain any residual retention and applicable restrictions. Contact us for information about your records.

6. Your rights

Subject to GDPR conditions, you may request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. This includes an objection concerning gameplay data used to improve bots. You can withdraw any consent you have given. We may request proportionate proof of ownership to avoid disclosing or deleting someone else’s information.

Email [email protected]. Requests are normally answered within one month; legally permitted extensions will be explained within that month. See account deletion for the request process. Signing out or uninstalling alone does not erase server data.

You may complain to the Czech supervisory authority, Úřad pro ochranu osobních údajů (ÚOOÚ), or to the competent authority in your place of habitual residence, work or alleged infringement in the EU/EEA.

7. Automated game decisions

The game uses skill estimates and gameplay information to select opponents and improve bots. We do not use these systems to make decisions with legal or similarly significant effects about you. You can contact support about matchmaking concerns.

8. Children, cookies and security

Parents or legal guardians can contact us about a child’s information or request appropriate account action. We do not use this website for targeted advertising to children. Store content ratings and the legal conditions for a child’s use of an online service are separate matters.

We use access controls, encrypted connections and hashed server-side authentication/session tokens. No service can guarantee absolute security. See Cookies & local storage for essential session storage; the website does not include optional analytics or advertising trackers.

9. Updates

We update this notice when the service or its data practices change. The date above identifies this version. Material changes will be communicated through appropriate service channels.