Privacy and cookies

Without an account

Without signing in you can read the landing, this policy and the terms; nothing about you is sent to us for that, and the language you choose stays in your browser (see In your browser). Everything else needs an account. Like every website, our server sees your IP address with each request (see Server logs).

Your account

You sign in with Google or Discord; there are no passwords. They send us your name, your email address and the address of your profile picture, and we keep only the email: to recognise you when you sign in again (and to link the two providers if they share it), never to write to you. Your name and picture are discarded.

• Your public name: what rivals, spectators and leaderboards show. It starts as a random captain's alias, such as «Captain Luffy 4821», never as your real name, and you can change it in your profile. No two players share one.
• Sessions: for each device you sign in on, the session's expiry, its IP address and the browser it came from, so a session can be checked and abuse traced.
• Activity: when you last had the site open and in which part of it, and the days you used it (kept for 13 months), so we can see how the site is used. Only the people who run it see it.
• Decks you build or import.
• Online matches: who played, the decks, every action and the result, so a match can be resumed after a restart and replayed. Replays are deleted after 90 days unless one of the players shares them; a shared replay stays while it is shared.
• Ranked ratings and tournament results.
• Reports and moderation: reports you file or that are filed about you, with their note and the match, and the decisions moderators take, such as a ban and its reason.

We use this to run your account and the matches you ask for (the service you sign up for), and to keep play fair and safe (our legitimate interest in preventing cheating and abuse). We do not sell it, show ads, or use it for profiling.

Who else handles it

• Google and Discord, when you choose to sign in with them, under their own privacy policies.
• Our hosting provider, whose servers store the data and run the site for us, under a data processing agreement.

Other players see your public name, your matches against them, and your ratings and tournament results.

In your browser: cookies and storage

Grand Table sets only the cookies it needs to work, so it does not ask for consent: the session cookie that keeps you signed in, a short-lived signed copy of your session that saves a database read, the temporary values a Google or Discord sign-in needs, and a cookie that remembers the language you choose. There are no analytics, advertising or third-party cookies.

The browser's own storage keeps your settings, your lesson and puzzle progress and the sandbox games you save, and copies of the site's files and card images so it loads faster and can be installed as an app. None of it is sent to us; clearing the site's data in your browser removes it.

Server logs and backups

Our web server records each request: the IP address, the page, the time and how it was answered, without the query or the browser. The logs are rotated automatically and read only to investigate errors and abuse. The database is backed up daily, and each backup is kept for up to five weeks: what you delete leaves the backups as they are replaced.

Deleting your account

You can delete your account at any time at the end of your settings. Your sessions, sign-in links, decks, ratings and activity are deleted, and you leave any tournament you are in. Matches, replays, reports and tournament results stay for the other players, under «Deleted player», with nothing that identifies you. If you are banned at the time, the ban stays, together with a one-way fingerprint of your email until it ends, so the same email cannot sign up again to get around it.

Your rights

You can ask for a copy of your data, have it corrected (your public name you can change yourself) or deleted, object to how we use it, and complain to your data protection authority. Write to legal@grand-table.com; we answer within a month.