Privacy Policy

This Privacy Policy explains what personal data the Star Cards mobile game for Android (package name win.starfleet.cards, the “App”) collects, why it collects it, who it is shared with, how long it is kept and how you can have it deleted.

Please read it together with our Terms of Service. By downloading or using the App you accept the practices described here.

1. Who we are

The App is developed and operated by Adrian Duardo, an individual developer (“we”, “us”). For the purposes of the EU and UK General Data Protection Regulation (GDPR), we are the data controller for the personal data described in this policy.

You can reach us at any time at aduardoyanes@gmail.com. This is also the address for privacy questions, data access requests and account deletion requests.

This policy covers the Android App and the game servers behind it. It does not cover third-party services you reach from the App, such as the Google Play Store, which are governed by their own privacy policies.

2. Data at a glance

The table below is a summary. The detail — including what we deliberately do not collect — follows in sections 3 and 4.

3. What we collect

3.1 Account information from Google Sign-In

Signing in with Google is the only way to create an account in the App. We do not operate passwords for player accounts. When you sign in, Google gives the App an identity token, and we read exactly four pieces of information from it:

• your Google account identifier (a stable, Google-generated ID), which is how we recognise you on every later sign-in;
• your email address, used as the unique key of your account;
• your display name as set on your Google account;
• the URL of your Google profile picture.

The App does not request any additional Google permissions or scopes. We have no access to your Gmail, Drive, contacts, calendar or any other Google service. Your email address and display name are never shown to other players.

We also record the date and time of your most recent sign-in and your language preference.

3.2 Player profile and gameplay data

After signing in you choose a nickname (3 to 12 characters, letters, numbers and underscores only). From then on, our servers store the data the game needs to work:

• your nickname, skill rating, wins, losses and account creation date;
• your match history, including the cards played each turn and the reveal log used to rebuild replays;
• your decks and the names you give them, and your card collection progress;
• your balance and full transaction history of Stardust, the in-game currency, plus the cosmetic items you own and have equipped;
• your mission progress, daily login streak and end-of-season results.

3.3 Information stored on your device

The App stores the following locally on your phone. It is not transmitted anywhere except as described elsewhere in this policy, and it is removed when you uninstall the App:

• Sign-in tokens, so you do not have to sign in every time you open the game;
• preferences: interface language, sound and music volume, card-hand layout, and flags recording whether you have already seen the tutorial and the onboarding tips.

3.4 Advertising

The App is free and is funded by a single banner advertisement displayed at the top of some menu screens (the lobby, collection, ranking, history and profile tabs, and the matchmaking screen). There are no full-screen advertisements, no rewarded video and no advertisements during a match.

Advertisements are served by Google AdMob. To do that, the Google Mobile Ads SDK embedded in the App may access your device's Advertising ID (a resettable identifier provided by Android) along with technical information about the device and the ad request, in order to serve advertisements, measure their performance and detect fraud. This data is processed by Google as an independent controller under Google's Privacy Policy.

The App requests non-personalised advertisements by default. Where required by law — in the European Economic Area, the United Kingdom and Switzerland — the App shows Google's consent form (the User Messaging Platform) before requesting any advertisement, and does not request advertisements until your consent choice allows it. You can change or withdraw that choice at any time, and you can reset or delete your Advertising ID in Android Settings → Privacy → Ads.

3.5 Technical data

When your device talks to our game servers, your IP address is processed transiently in order to apply rate limits and block abuse. It is not written to our database and we do not build any profile from it. Standard server logs may briefly record request metadata for operational and security purposes.

4. What we do not collect

We think this list is as important as the one above. As of the date at the top of this page, the App does not:

• contain any analytics, telemetry or crash-reporting SDK — there is no Google Analytics, no Firebase, no Crashlytics and no third-party analytics of any kind;
• access your location, camera, microphone, contacts, calendar, call logs, SMS, photos or files;
• collect device identifiers other than the Advertising ID used by AdMob (section 3.4);
• send push notifications;
• offer in-app purchases or process any payment — there is no way to spend real money in the App, and we never see payment or card details;
• include player-to-player chat, voice chat or private messaging;
• sell, rent or trade your personal data to anybody, for any purpose.

The App declares only two Android permissions of its own — internet access and network state — plus the advertising identifier permission added automatically by the Google Mobile Ads SDK.

5. How and why we use your information

Under the GDPR, we rely on the following legal bases:

• Performance of a contract (Article 6(1)(b)) — creating and maintaining your account, matchmaking, saving your decks and progress, running seasons and awarding in-game rewards. Without this data the game cannot function.
• Legitimate interests (Article 6(1)(f)) — keeping the service secure and available, enforcing fair play, preventing cheating and abuse, and diagnosing faults. We have balanced these interests against your rights and limited the data to what is strictly needed.
• Consent (Article 6(1)(a)) — personalised advertising, where you have given it through the consent form described in section 3.4. You can withdraw it at any time.
• Legal obligation (Article 6(1)(c)) — where we must retain or disclose data to comply with the law.

We do not use your personal data for automated decision-making that produces legal effects concerning you, and we do not profile you for marketing purposes.

6. What other players can see

Star Cards is a competitive multiplayer game, so part of your profile is public to other signed-in players. This includes your nickname, skill rating, wins and losses, ranking position, the month and year you joined, and the cosmetic items you have equipped. This information appears on the leaderboards and on your public profile page inside the game.

In addition, matches in progress can be watched live by other players from the in-game lobby, and finished matches can be replayed from a shareable link. Your nickname and rating appear in the match history of the opponents you played against.

Choose your nickname carefully. It is visible to everyone in the game, so do not use your real name, email address, phone number or any other information you do not want to be public. You can ask us to change it by writing to aduardoyanes@gmail.com.

Your email address, your Google display name, your Google profile picture and your deck names are never shown to other players.

7. Who we share your data with

We do not sell your personal data. We share it only with the following parties:

• Google (Sign-In) — the sign-in process happens between your device and Google. We receive the account information described in section 3.1. See Google's Privacy Policy.
• Google AdMob — receives the advertising data described in section 3.4 in order to serve the banner advertisement. See how AdMob uses data.
• Our hosting and infrastructure providers — the companies that host the game servers and this website process data strictly on our instructions, as processors, in order to keep the service running.
• Legal authorities — if we are legally required to disclose data, or where it is necessary to establish, exercise or defend legal claims.

If the App is ever transferred to another operator, we will inform you through the App or this page before your data is transferred, and the new operator will remain bound by this policy until it publishes its own.

8. How long we keep your data

• Account and profile data — for as long as your account exists. Uninstalling the App does not delete your account; see section 9.
• Match history and replays — kept while your account exists, so that you and your opponents can review past games.
• In-game currency ledger — kept while your account exists, because it is what guarantees your balance is correct.
• Sign-in tokens — access tokens expire after 15 minutes and refresh tokens after 30 days, or immediately when you sign out.
• Matchmaking queue entries and one-time tickets — seconds to minutes; they are deleted as soon as they are used or expire.

9. Deleting your account and your data

You can have your Star Cards account and the personal data attached to it deleted at any time, free of charge.

How to request deletion

1. Send an email to aduardoyanes@gmail.com with the subject “Delete my Star Cards account”.
2. Send it from the email address of the Google account you use to sign in. That is how we verify the request is really yours — we will not act on a request that comes from a different address.
3. Include your in-game nickname so we can find the right account.

What happens next

• We confirm receipt and verify the request.
• Your account is deleted within 30 days of verification, and we email you to confirm when it is done.
• Deletion removes your account record (Google account identifier, email address, display name and profile picture URL), your player profile and nickname, your decks, your collection progress, your Stardust balance and its transaction history, your cosmetic items, your mission and daily progress, and your season results.
• Records of matches you played may be retained in a form that no longer identifies you, so that the players you faced keep their own match history intact.
• Residual copies may remain in encrypted backups for a short period after deletion until those backups are rotated and overwritten.
• Deletion is permanent. Progress, rank and cosmetics cannot be restored afterwards.

If you only want to stop playing, you can simply uninstall the App — but note that this leaves your account and data on our servers. Only the request above deletes them.

You can also ask us for a copy of your data using the same address; see section 12.

10. Security

All traffic between the App and our servers travels over encrypted HTTPS connections. Sign-in uses short-lived access tokens paired with rotating refresh tokens: each refresh token can be used only once, and if a used token is presented again, the whole session family is revoked immediately as a theft-detection measure. Because player accounts are created through Google Sign-In, we hold no password for them.

Access to the production database is restricted to the developer. No method of transmission or storage is perfectly secure, but we take these measures seriously and will notify you and the competent supervisory authority of any breach affecting your data where the law requires it.

11. Children's privacy

The App is not directed to children. It is not part of the Google Play “Designed for Families” programme and it is not intended for anyone under 13 years old, or under 16 in countries of the European Economic Area where that is the applicable age of digital consent.

We do not knowingly collect personal data from children below the applicable age. If you are a parent or guardian and believe your child has created an account, write to aduardoyanes@gmail.com and we will delete the account and its data promptly.

12. International data transfers

Our servers and our service providers may be located outside your country of residence, including outside the European Economic Area. When personal data is transferred out of the EEA or the United Kingdom, we rely on appropriate safeguards recognised by law, such as the European Commission's Standard Contractual Clauses or an adequacy decision covering the destination country. Google, as described in section 7, publishes its own transfer safeguards in its privacy policy.

13. Your rights

Depending on where you live, you have some or all of the following rights over your personal data:

• Access — obtain a copy of the data we hold about you.
• Rectification — have inaccurate data corrected, including your nickname.
• Erasure — have your data deleted; see section 9.
• Portability — receive your data in a structured, machine-readable format.
• Restriction and objection — ask us to limit how we use your data, or object to processing based on our legitimate interests.
• Withdraw consent — withdraw your advertising consent at any time, without affecting processing carried out before you withdrew it.

To exercise any of these rights, write to aduardoyanes@gmail.com. We will respond within 30 days. We may need to verify your identity by asking you to write from the email address linked to your account.

If you are in the EEA or the UK and you believe we have not handled your data properly, you have the right to lodge a complaint with your local data protection supervisory authority.

California residents. We do not sell or share personal information as those terms are defined by the California Consumer Privacy Act, and we do not offer financial incentives in exchange for personal information. You may exercise your rights of access and deletion using the same contact address, and we will not discriminate against you for doing so.

14. Changes to this policy

We may update this policy when the App changes or when the law requires it. The Last updated date at the top of this page always reflects the current version. If a change materially affects how we handle your personal data, we will give notice inside the App before it takes effect. Continuing to use the App after a change means you accept the updated policy.

15. Contact us

For any question about this policy, about the data we hold, or to make a request under section 9 or section 13:

• Email: aduardoyanes@gmail.com
• Developer: Adrian Duardo
• Application: Star Cards (win.starfleet.cards)