Chaotic Tracker Icon
CHAOTIC TRACKER

LEGAL & DATA GOVERNANCE

Privacy Policy

Last Updated: August 19, 2026 · Effective Immediately

1. Core Commitment & Philosophy

Chaotic Tracker ("we", "us", or "the platform") is a community-built digital companion and deckbuilding suite for the Chaotic Trading Card Game. We are built on the principle of strict data minimization: we only collect the minimum amount of information required to provide deckbuilding, collection inventory management, and match history services.

We do not sell, monetize, rent, or trade your personal data. We do not use your game data or collection records for third-party automated profiling or behavioral ad retargeting.

2. Information We Collect

A. Account & Identity Data

When you create an account or authenticate via OAuth (Google or Discord), we collect:

  • Email address (for authentication, verification, and password resets).
  • Public username and optional display name.
  • Selected favorite tribe preference and avatar identifier.
  • Authentication provider ID and account creation timestamp.
  • Discord and Google profile information (e.g., username, avatar) when you authenticate via these providers.

B. Game, Deck & Collection Data

When using the platform features, we store user-associated records including:

  • Decks: Deck names, army size, card compositions (creatures, battlegear, mugic, attacks, locations), and optional notes.
  • Collection Inventory: Scanned or manually entered card instances, foil/variant tags, recorded rolled stats (Courage, Power, Wisdom, Speed, Energy), and acquisition timestamps. We do not store card digital codes and never will.
  • Match Logs: Match outcomes (win/loss/draw), opponent usernames, formats played, turns, and optional tactical match notes.

C. Payment & Subscription Data (Pro Members)

If you subscribe to the optional Pro Tier, payment transactions are processed directly by our payment processor, Stripe.

  • Chaotic Tracker never collects, processes, or stores your credit card number, CVV, or banking details on our servers.
  • We only store tokenized identifiers provided by Stripe in order to provision your Pro account features.

3. Child Privacy & Minimum Age (COPPA & Age Gate)

Chaotic Tracker is designed and intended strictly for users who are 13 years of age or older. In compliance with the Children's Online Privacy Protection Act (COPPA) and international youth privacy standards:

  • We do not knowingly collect, store, or solicit personal information from individuals under the age of 13.
  • Registration requires explicit affirmative confirmation that the user is at least 13 years old.
  • If we discover that a user under 13 has created an account, all associated records will be promptly purged from our database.

4. Subprocessors & Service Providers

We rely on trusted technical infrastructure partners to securely operate the platform:

Supabase (PostgreSQL & Auth)

Provides secure database hosting, Row Level Security (RLS) isolation, and encrypted authentication storage.

Cloudflare (Turnstile & CDN)

Provides bot prevention, DDoS protection, and privacy-first CAPTCHA verification without cross-site tracking cookies.

Stripe (Payment Processing)

PCI-DSS Level 1 certified payment processing for optional Pro subscriptions and customer portal billing management.

5. User Rights, Self-Service Account Deletion & Data Purge

You maintain full ownership and control of your data at all times:

  • Access & Export: You can view your complete deck, match, and collection records at any time directly through your dashboard.
  • Self-Service Account Deletion: You can permanently delete your account and all associated records directly from your Profile Settings.
  • Instant Purge Cascade: Account deletion executes a strict database cascade, permanently erasing your profile, user card instances, saved decks, likes, and match history.

6. Security & Encryption

All network communication is strictly encrypted in transit via HTTPS/TLS. Database records are protected by database-enforced Row Level Security (RLS) policies ensuring that private deck and collection instance data is inaccessible to unauthorized third parties or unauthenticated visitors.

7. Contact & Privacy Requests

For privacy inquiries, data deletion assistance, or security disclosures, please reach out via our contact channels.