What Arcana knows about you

Creating an account stores your email address, your chosen username, and your password — kept only as a one-way hash, never as the password itself. If you sign in with Google instead, there is no password at all: we store the stable account id Google presents and the email address Google has verified, and nothing else from your Google account.

Your email address is used to sign you in, to confirm it belongs to you, and for nothing else. There is no newsletter, no marketing mail, and no list anyone else can buy. Your username is public — it is how opponents, the leaderboard and the forum name you.

Playing writes the records a game needs: your card collection, decks, match results, ranked rating, campaign and quest progress, in-game currencies, cosmetic choices, which days you played, and anything you post on the forum. None of that identifies you beyond the username you chose.

That is the whole list. No real name, no address, no phone number, no payment details — the game has nothing to sell, so it has no reason to ask.

Our own counting. The public pages report a handful of steps — a page was seen, the button was pressed — to our own server. To tell two visitors apart for a single day, the server hashes your IP address and browser signature with a secret that changes every day, and stores only the hash. The address and the signature themselves are never stored, the hash cannot be reversed, and once the day's secret is gone the same person on two days is two unrelated strangers — to us and to anyone else. These rows are deleted after 180 days. Nothing is written to your device for this, which is why there is no cookie banner.

Google Analytics. The game also reports usage events to Google Analytics — which screens are visited, that a match was played or a pack opened, the kind of device and browser, and the approximate (city-level) region Google derives on its side. It never receives your email address, your username, or anything you write. Google describes its handling in its own privacy policy. If your browser blocks it — many do — the game neither notices nor minds.

Signing in sets one session cookie, which is what keeps you signed in. It is essential, unreadable by scripts, and holds no more than your session. Google Analytics sets its own cookies to tell returning visitors apart; blocking them breaks nothing.

The game keeps a few preferences on your device — such as which news entries you have already seen — that never leave it. In the Android and iOS apps, your sign-in token is stored on the device so the app can keep you signed in; deleting the app deletes it.

The game runs on Fly.io in Amsterdam, and its database is hosted by Supabase in Ireland — your data stays in the European Union. Cloudflare sits in front of the game and sees traffic the way any doorman sees visitors. Resend delivers the email-verification messages, so it sees your address when one is sent. Google provides the analytics described above and, only if you choose it, the sign-in.

Each of these processes data on our behalf and only what its job requires. Nobody is given your data for their own purposes, and nothing is sold — there is no advertising in the game and no data broker behind it.

Account data is kept for as long as the account exists, because it is the account. The anonymous counting rows are deleted after 180 days. Email-verification links are single-use and expire on their own. Server logs are operational and short-lived.

You can delete your account from inside the game: open Profile, choose Delete account, and confirm. It works the same in the browser at arcanaplay.com and in the apps, it takes effect immediately, and it cannot be undone.

Deletion erases your collection, decks, currencies, ratings, progress, and every personal field: your email address and username are released as if they had never been used, your password hash and any Google link are destroyed, and no way of signing in to the account survives.

Two kinds of record remain, stripped of you. Forum posts stay so conversations keep making sense, shown as written by a departed player with no name attached. Match results stay as entries in other players' match histories, pointing at an account that no longer says anything about anyone. Neither can be traced back to you.

If you cannot sign in to delete the account yourself, write to [email protected] from the account's email address and we will do it for you.

Under the GDPR you can ask what we hold about you, have it corrected, or have it erased. Most of that you can do yourself — your profile shows and edits what the account holds, and deletion is a button — but every right can also be exercised by writing to [email protected]. If you believe we have handled your data wrongly, you also have the right to complain to your local data protection authority.

Arcana is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has created an account, write to us and it will be deleted.

If what the game collects ever changes, this page changes with it and the date at the top moves. Anything a player would actually care about is also announced in the news.