Privacy policy
What data we process, why, for how long, and how to exercise your rights. No advertising, no selling of data.
Updated Oct 2, 2026- Data controller
- Data we process
- Why, and on what basis
- Retention periods
- Recipients
- Cookies and local storage
- Your rights
- Security
- Minors
- Changes to this policy
Data controller
The data controller is MBEN DEV, 60 rue François Ier, 75008 Paris, France. For any question or request: contact@wiki-deck.com.
Data we process
- Account: email address, display name, username, language. Your password is never stored in clear: only a hash is. If you turn on two-step verification, its secret is stored encrypted.
- Google sign-in, if you use it: your Google identifier, your email address and your profile picture.
- Discord sign-in, if you use it, on the site or in the Discord activity: your Discord identifier, your email address, your name and your profile picture. In the activity, if you ask for it, your Discord friends list is used to find those who already play: it is not kept.
- Profile picture, if you add one or sign in with Google or Discord: the image, cropped to a square. It is checked automatically before other players see it, then hosted by us.
- Game: collection, pack openings, albums, wishlist, friends, trades, auctions, wallet, notifications.
- Purchases: the payment reference, the offer and the amount. Your bank details stay with Stripe.
- Security: your IP address is used to limit abuse, but it is never stored in clear. We only keep an irreversible fingerprint of it, at sign-up and in the security log.
- Statistics: anonymous audience measurement, with no cookie, no IP address and no link to your account.
- Technical errors: error reports with no cookie, no header, no request content and no identity.
Why, and on what basis
| Purpose | Basis |
|---|---|
| Create and manage your account, run the game, the market and trades | Performance of the contract |
| Process your purchases and your subscription | Performance of the contract |
| Send service emails: verification, sign-in link, password | Performance of the contract |
| Fight bots, fraud and multiple accounts | Legitimate interest |
| Measure the audience anonymously and fix errors | Legitimate interest |
| Keep proof of purchases | Legal obligation |
We send no marketing email.
Retention periods
| Data | Period |
|---|---|
| Account and game data | As long as the account exists. On deletion, the account is anonymised at once: email, name, username, password, Google and Discord links and two-step verification are erased. |
| History of cards, trades and auctions | Kept after deletion in anonymous form, so that the history of the cards stays consistent for other players. |
| Sign-in, verification and reset links | Deleted 7 days after they expire. |
| Unclaimed trial booster | Deleted 30 days after it expires. |
| IP address fingerprints | Erased after 12 months. |
| Proof of purchases | 10 years, as required by law. |
Recipients
Only the game's team accesses your data. Your display name, your username and your public collection are visible to other players. Your friends, and only they, also see whether you are playing right now.
We rely on a few providers, each for a specific task:
| Provider | Role | Data |
|---|---|---|
| Stripe and Link | Payments, as merchant of record | Email, name, billing address, payment data |
| Resend | Sending service emails | Email address |
| Cloudflare (Turnstile) | Blocking bots | IP address, technical browser signals |
| Sign-in, only if you choose it | Google identifier, email, picture | |
| Discord | Sign-in and activity inside Discord, only if you choose them | Discord identifier, email, name, picture |
| OpenAI | Automatic check of profile pictures before they are published | The image sent, without your name or address |
| Cloudflare (R2 storage, European Union) | Hosting of profile pictures | The published profile pictures |
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (+49 9831 505-0) | Hosting | All the service's data |
| Cloudflare (R2 storage, European Union) | Backups | Copy of the service's database |
Card images are loaded directly from Wikimedia's servers: your browser therefore sends them your IP address, just as when you read Wikipedia.
Audience statistics and error reports are processed on our own servers, with no outside provider.
Some providers are established outside the European Union. Transfers are then covered by the safeguards the GDPR provides.
Cookies and local storage
The site only uses cookies it needs to work. It sets no advertising tracker, which is why there is no consent banner.
| Name | Role | Lifetime |
|---|---|---|
| wd-session | Keep you signed in | 7 days |
| remember_web | “Stay signed in” option | 30 days |
| XSRF-TOKEN | Protect forms against forged requests | Session |
| wd_guest | Find your trial booster again | 30 days |
| wd_locale | Remember the interface language | 1 year |
| wd_node | Stay on the same server during an update | Session |
The browser's session storage remembers the pack opening in progress, so that reloading the page does not replay it. It is cleared when the tab is closed.
In the Discord activity, the game is shown in a frame where cookies may be refused: your session and the protection of forms are then kept in that frame's session storage, with the launch parameters Discord provides. Local storage there only remembers that you agreed to the Discord friends search.
Stripe's payment page uses its own cookies, under its own policy.
Your rights
You can access your data, have it corrected, have it erased, restrict its processing, ask for a copy, and object to processing based on our legitimate interest.
You can edit your profile and delete your account from the settings. For anything else, write to contact@wiki-deck.com: we answer within one month.
If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL: cnil.fr.
Security
Exchanges with the site are encrypted. Passwords are hashed, sign-in links work only once, and payments are handled entirely by Stripe. Access to the administration requires two-step verification, and every action there is logged.
Minors
The game is for people aged 15 and over. If you believe a younger child has created an account, write to us: we will delete it.
Changes to this policy
This policy changes with the game. A significant change is announced in the game, and the date of the last update is shown at the top of the page.