1. Who we are
This website is maintained by Voidscript Studios (Brazilian company registration CNPJ 63.153.004/0001-20), developer of Arcanum Card Game. For any privacy questions, write to voidscriptstudios@arcanumcg.com.
2. What data we collect
We collect only the bare minimum:
- Account data. Only if you create an account: display name, email, sign-in method (email and password or Google), creation date and account type (user or administrator). Your password is kept by Firebase Authentication, protected by encryption; we have no access to it. If you choose to, also a profile photo: before it is uploaded, it is resized on your own device and stripped of file metadata (such as the location where it was taken). Before it appears to other people with an account on the site, the photo goes through an administrator's approval; until then, only you and the administrators can see it, and if it is not approved it is deleted. You can change or remove it whenever you want. Notices about your account (such as photo approval) are kept for 15 days and then deleted. If you link your account to a ranked player, that link is stored with your profile after an administrator confirms it; the rankings keep showing only the player name.
- Anonymous browsing data. Pages visited, time on page, device, browser and approximate location (city/state). Collected through Google Analytics 4 (Firebase) only if you consent.
- Contact data. Only when you send us a message (your email and whatever you write).
- Essential cookies. Small identifiers that keep the site working, such as your cookie choice.
We don't collect payment data, ID numbers or documents.
3. What we use the data for
- Creating and maintaining your account and unlocking the site features that require signing in.
- Understanding which content is most relevant and improving the site.
- Replying to messages you send us.
- Meeting legal obligations when applicable.
4. Legal basis (LGPD, Brazil's data protection law)
We process your data based on:
- Consent (art. 7, I) for analytics and statistics cookies.
- Legitimate interest (art. 7, IX) for cookies essential to the site's operation.
- Performance of a contract or preliminary procedures (art. 7, V) when you create an account or send us a message.
5. Cookies
We use two categories of cookies:
- Essential. Always on. They store, for example, your cookie choice and, if you sign in, your login session.
- Analytics (optional). Google Analytics 4 / Firebase Analytics. Only enabled if you accept them in the banner.
You can change your choice at any time by clicking .
On the Competitive page, the Google Maps map shown with tournaments is loaded from Google's servers, which may set their own cookies in your browser under Google's privacy policy. We don't control those cookies.
6. Sharing
We don't sell your data. Anonymous browsing data is processed by Google (Google Analytics 4) under Google's terms. When legally required, we may share data with the competent authorities.
Some parts of the site rely on third-party services. To work, they receive technical data about your connection, such as IP address, browser and referring page:
- Google Firebase (Authentication and Cloud Firestore). Handles sign-in and stores your account data. If you use "Continue with Google", Google shares your name and email with us.
- Google Maps. Map with tournament locations on the Competitive page.
- OpenStreetMap. Map imagery for "Where to play" on the Competitive page. Doesn't use tracking cookies.
- jsDelivr. Delivers the Leaflet library, used to build the "Where to play" map. Doesn't use cookies.
These services are only called when the corresponding map appears on screen, and each one handles this data under its own privacy policy.
7. Retention
Anonymous browsing data is kept for up to 14 months in Google Analytics. Contact messages are kept as long as needed to reply and meet legal obligations. Account data is kept while the account exists. You can delete your account at any time on the My account page, and its data is erased immediately.
8. Your rights
Under the LGPD, you may request at any time:
- Confirmation that your data is being processed.
- Access to the data.
- Correction of incomplete or outdated data.
- Anonymization, blocking or deletion of unnecessary data.
- Portability.
- Withdrawal of consent.
You can view, correct and delete your account data yourself on the My account page. To exercise any of these rights, write to voidscriptstudios@arcanumcg.com.
9. Security
We apply reasonable technical and organizational measures to protect your data, including mandatory HTTPS, security headers (HSTS, CSP) and the principle of least privilege.
10. Children
The site is not directed at children under 13. If we become aware that data from a child or teenager was collected inadvertently without proper authorization, we will get in touch to take the appropriate steps.
11. Changes to this policy
We may update this policy from time to time. The date of the last update appears at the top of the document. Significant changes will be flagged on this page.
12. Data Protection Officer (DPO)
As a small operation, Voidscript Studios' legal representative acts as the point of contact for privacy matters. Use the email voidscriptstudios@arcanumcg.com.