Chaotic Tracker Icon
CHAOTIC TRACKER

LEGAL & DATA GOVERNANCE

Privacy Policy

Last Updated: August 26, 2026 · Effective Immediately

1. Core Commitment & Philosophy

Chaotic Tracker ("we", "us", or "the platform") is a community-built digital companion and deckbuilding suite for the Chaotic Trading Card Game. We are built on the principle of strict data minimization: we only collect the minimum amount of information required to provide deckbuilding, collection inventory management, and match history services.

We do not sell, rent, or trade your personal data. We may use your decks, match history, collection records, and other game data for our own internal analytics, such as understanding feature usage and improving the platform. We do not use this data to build advertising profiles, serve targeted ads, or enable third-party behavioral ad retargeting. PostHog may process limited pseudonymous analytics data, including selected product-usage events, and Google AdSense may process advertising-related data as described below.

2. Information We Collect

A. Account & Identity Data

When you create an account or authenticate via OAuth (Google or Discord), we collect:

  • Email address (for authentication, verification, and password resets).
  • Public username and optional display name.
  • Selected favorite tribe preference and avatar identifier.
  • Authentication provider ID and account creation timestamp.
  • Discord and Google profile information (e.g., username, avatar) when you authenticate via these providers.

B. Game, Deck & Collection Data

When using the platform features, we store user-associated records including:

  • Decks: Deck names, army size, card compositions (creatures, battlegear, mugic, attacks, locations), and optional notes.
  • Collection Inventory: Scanned or manually entered card instances, foil/variant tags, recorded rolled stats (Courage, Power, Wisdom, Speed, Energy), and acquisition timestamps. We do not store card digital codes and never will.
  • Match Logs: Match-related information, which may include outcomes (win/loss/draw), opponent usernames, formats played, turns, game settings or conditions, and optional tactical match notes. We may add other match-related fields as the game and platform features develop.

C. Payment & Subscription Data (Pro Members)

If you subscribe to the optional Pro Tier, payment transactions are processed directly by our payment processor, Stripe.

  • Chaotic Tracker never collects, processes, or stores your credit card number, CVV, or banking details on our servers.
  • We only store tokenized identifiers provided by Stripe in order to provision your Pro account features.

The Free Tier includes up to 20 saved decks and up to 300 card instances. The Pro Tier currently provides unlimited saved decks and collection slots, tabletop proxy sheet export, and an ad-free Scanner interface. Planned features, including stat percentile analysis, collection-to-deck matching, extended match retention, and expanded format or era analytics, are not available yet and are designated as coming soon/TBD.

3. Child Privacy & Minimum Age (COPPA & Age Gate)

Chaotic Tracker is designed and intended strictly for users who are 13 years of age or older. In compliance with the Children's Online Privacy Protection Act (COPPA) and international youth privacy standards:

  • We do not knowingly collect, store, or solicit personal information from individuals under the age of 13.
  • Registration requires explicit affirmative confirmation that the user is at least 13 years old.
  • If we discover that a user under 13 has created an account, all associated records will be promptly purged from our database.

4. Subprocessors & Service Providers

We rely on trusted technical infrastructure partners to securely operate the platform:

Supabase (PostgreSQL & Auth)

Provides secure database hosting, Row Level Security (RLS) isolation, and encrypted authentication storage.

Cloudflare (Turnstile & CDN)

Provides bot prevention, DDoS protection, and privacy-first CAPTCHA verification without cross-site tracking cookies.

Stripe (Payment Processing)

PCI-DSS Level 1 certified payment processing for optional Pro subscriptions and customer portal billing management.

Upstash Redis (Rate-Limit Enforcement)

Provides short-lived, in-memory rate-limit counters associated with request or user identifiers to help prevent abuse and enforce API and account-action limits. It is not used for session storage or advertising.

PostHog (Product Analytics)

Provides product analytics such as page views, frontend interactions, performance signals, browser/device details, and analytics identifiers. Session recordings are currently disabled.

Vercel (Web Analytics)

Provides aggregated website usage and performance metrics, including web vitals, to help us operate and improve the platform.

Google AdSense (Advertising)

Provides advertising services. Google may use cookies, device identifiers, approximate location, and browsing activity to measure ads and, where permitted and enabled, personalize advertising.

5. Analytics & Similar Technologies

We use PostHog and Vercel Web Analytics for product and website analytics. Depending on your browser and applicable regional law, these services may use cookies, local storage, or comparable identifiers and may process information such as page views, clicks, navigation events, browser and device characteristics, approximate location derived from network information, performance measurements, and selected events related to game features. We use this information for our own internal analytics to understand feature usage, diagnose problems, improve usability, and monitor site performance. We do not use PostHog or Vercel to build advertising profiles, serve targeted ads, enable advertising retargeting, or record sessions; PostHog session recordings are disabled.

We use Google AdSense to display advertisements on eligible pages. Google and its advertising partners may use cookies, device identifiers, approximate location, and browsing activity to measure and personalize advertisements, subject to applicable law and your available privacy choices. We do not provide your decks, match history, collection records, or other game data to Google AdSense for advertising targeting.

Analytics are enabled by default where permitted by applicable law. Where prior consent is required, analytics remain disabled until you provide consent through our consent controls. You may withdraw consent or manage analytics preferences from the Profile settings page. Disabling analytics does not prevent you from using core account features.

You can manage Google personalized advertising through Google Ads Settings or opt out through the Digital Advertising Alliance. For more information, review the privacy policies of PostHog, Vercel, and Google.

6. User Rights, Self-Service Account Deletion & Data Purge

You maintain full ownership and control of your data at all times:

  • Access & Export: You can view your complete deck, match, and collection records at any time directly through your dashboard.
  • Self-Service Account Deletion: You can permanently delete your account and all associated records directly from your Profile Settings.
  • Instant Purge Cascade: Account deletion executes a strict database cascade, permanently erasing your profile, user card instances, saved decks, likes, and match history.
  • Backup Retention: Cascade deletion removes your records from live databases immediately. Automated system backups may retain encrypted copies temporarily and cycle out through our normal backup schedule, with full purge targeted within 30 days.

Regional Privacy Rights: Where applicable, EU/EEA and UK residents may have rights under the GDPR, including access, correction, portability, restriction, objection, and deletion of personal information. California residents may have rights under the CCPA/CPRA, including access, correction, deletion, and information about the use or disclosure of personal information. We will not discriminate against you for exercising applicable privacy rights. To submit a request, please use the contact channels below.

7. Security & Encryption

All network communication is strictly encrypted in transit via HTTPS/TLS. Database records are protected by database-enforced Row Level Security (RLS) policies ensuring that private deck and collection instance data is inaccessible to unauthorized third parties or unauthenticated visitors.

8. Contact & Privacy Requests

For privacy inquiries, data deletion assistance, or security disclosures, please reach out via our contact channels.