Privacy Policy

Effective date: 19 July 2026

CardForge Games UK Ltd ("CardForge", "we", "us") operates the CardForge platform for playing and creating card games. This policy explains what personal data we collect, why, and the rights you have over it. We are the data controller for the purposes of the UK GDPR and the Data Protection Act 2018.

1. Who we are

CardForge Games UK Ltd, a company registered in England & Wales. If you have any questions about this policy or your data, contact us at admin@cardforge.uk.

2. Data we collect

Account information. When you create an account we store your email address, a display name, and your date of birth. We ask for your date of birth so we can apply age-appropriate content filtering and confirm you are old enough to use the service — we store the date itself, not just your age.

Sign-in information. You can sign in with Google, Microsoft or Discord, or with a one-time code sent to your email. When you use a third-party provider we receive a unique identifier and the email address associated with that provider so we can recognise your account. We do not receive your password for those services.

Games and gameplay. We store the games you create, your saved and resumable game progress, and games you choose to share via a share link. If you play online, your display name is visible to the other players in that room.

Coins and purchases. We store your coin balance and a record of coin claims. If you buy coins, payment is processed by Stripe; we receive confirmation of the purchase but we do not store your full card details.

Technical data. Like most websites we process basic technical data (such as device and browser information and approximate activity) needed to operate the service securely, and we store some preferences and session data in your browser's local storage.

3. How we use your data

• To create and maintain your account and keep you signed in.
• To provide core features: creating, saving, sharing and playing games, and synchronising your library across your devices.
• To apply age-appropriate content filtering based on your date of birth.
• To manage your coin balance, weekly claims and purchases.
• To keep the service secure, prevent abuse, and fix problems.
• To send you service-related email, such as one-time sign-in codes.

4. Legal bases

We rely on the following legal bases under the UK GDPR: performance of a contract (providing the service you sign up for), legitimate interests (keeping the service secure and working well), legal obligation (for example, retaining transaction records), and consent where required, which you can withdraw at any time.

5. Who we share data with

We do not sell your personal data. We share it only with service providers who help us run the platform, and only as needed:

• Supabase — database, authentication and hosting.
• Stripe — payment processing for coin purchases.
• Google, Microsoft and Discord — where you choose them to sign in.
• Our email provider — to deliver sign-in codes and service messages.

Other players can see your display name during online play and on games you choose to share.

6. Data retention

We keep your personal data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must retain certain records (such as purchase records) to meet legal obligations.

7. Your rights

Under UK data protection law you have the right to access, correct, delete, or restrict the processing of your personal data, to object to certain processing, and to data portability. You can update your display name and date of birth from your profile page. To exercise any other right, contact us at admin@cardforge.uk. You also have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk.

8. Children

CardForge is not intended for young children. We use your date of birth to filter age-inappropriate content and to confirm eligibility. If you believe a child has provided us with personal data without appropriate consent, contact us and we will remove it.

9. International transfers

Some of our service providers may process data outside the UK. Where that happens, we rely on appropriate safeguards (such as adequacy decisions or standard contractual clauses) to protect your data.

10. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the effective date above and, where appropriate, notify you within the service.

11. Contact us

Questions or requests about your data? Email admin@cardforge.uk.