| Data | When | Why (purpose) | Legal basis (GDPR) |
|---|---|---|---|
| A random player ID (and, if you link Steam, your 64-bit Steam ID; if you add an email or third-party login (currently Google, with others possible over time), the email address or account identifier that provider shares) | When you use online features / create or link an account | Operating your account and profile across devices; one-account-per-player fairness | Contract (Art. 6(1)(b)) |
| Your handle, avatar, ratings, statistics, and scores | Online play with the public-profile consent enabled | Leaderboards, matchmaking, and showing opponents who they're playing | Consent (Art. 6(1)(a)) for public display; contract for matchmaking |
| Match records and move logs (the cards played, seeds, timestamps) | Online multiplayer, ranked, and daily-challenge play | Running the game between players; server-side verification that results are genuine (anti-cheat); the fairness receipts we publish to you | Contract; legitimate interest (Art. 6(1)(f)) in fair competition |
| Error and crash logs | Only if you choose to send them | Fixing bugs | Consent |
| IP addresses, on our side | Transiently, in our hosting provider's infrastructure logs when your Game talks to our servers | Network delivery, security, abuse prevention | Legitimate interest |
| Network connection data exchanged with your opponent — on a direct connection, this includes each player's IP address being visible to the other's machine | Online multiplayer and Local Network (LAN) play, whenever the two machines connect directly rather than through Valve's relay | Carrying the match between the two players. This passes between your machines; we do not receive, log, or store it | Contract (Art. 6(1)(b)) |
| Your Steam persona name and 64-bit Steam ID, shared with your opponent | Steam multiplayer (Steam's networking addresses players by Steam ID, so a match cannot be set up without it) | Connecting the two players and showing each of you who you're playing | Contract (Art. 6(1)(b)) |
Saved games and settings stay on your device (and in your Steam Cloud, under Valve's terms, if enabled). If you use online features, a sign-in token is also stored locally on your device (like a browser staying logged in) so you don't have to sign in every launch; deleting the Game's user data folder removes it. We collect nothing during offline play, and we collect no advertising identifiers, contacts, location, or device fingerprints, ever.
Online data is stored with Google Firebase (Google LLC) in the United States, under Google's Cloud Data Processing Addendum, which incorporates the EU Standard Contractual Clauses for international transfers. Any third-party sign-in provider you choose to use (currently Google) authenticates you under its own privacy policy; we receive only the identifier needed to recognize your account. Steam account data is handled by Valve under its own privacy policy.
Steam multiplayer traffic — your plays and the state of the match — is carried by Valve's networking, including the Steam Datagram Relay, under Valve's own privacy policy. LAN play is carried by your own network and touches none of our servers.
Your opponents. Your handle and avatar, and the moves you play. On Steam, also your Steam persona name and Steam ID, because Steam's networking addresses players by Steam ID and a match cannot be set up without it. And, whenever the two machines connect directly instead of through Valve's relay, your IP address is visible to your opponent's machine — this is how peer-to-peer play works in any game that uses it, and it is not something we can see or prevent from our side. In Local Network (LAN) play the connection is always direct, and the Game deliberately shows and lets you copy your own IP address so you can send it to the person you want to play; only share it with people you intend to play with.
Public (with your consent setting on): your handle, avatar, ratings, and leaderboard entries. Our processors: Google (hosting), the sign-in provider you choose, and Valve (Steam platform). Nobody else. We do not sell or share personal data for advertising, and we disclose it otherwise only if the law requires. We do not use your data for advertising profiling or for automated decisions that produce legal or similarly significant effects about you.
Account and profile data: until you delete your account. Move logs and match records: 12 months, then deleted or irreversibly anonymized (retention exists for anti-cheat review and result disputes). Leaderboard entries of deleted accounts are removed with the account (hall-of-fame entries like perfect-29 records are anonymized instead). Opt-in error logs: 90 days.
You can delete your account and its data from inside the Game (Account → Delete my account); this removes your profile, handle, ratings, ladder rows, and logs. You can also ask us to access, correct, export, or delete your data, or object to processing, by emailing nathan@5catsgamestudios.com; we respond within 30 days. EU/UK residents may also complain to their data-protection authority.
Withdrawing consent. Where we rely on your consent (public-profile display on leaderboards, and opt-in crash logs), you can withdraw it at any time by turning the setting off in the Game. Withdrawing consent stops the future processing it covered; it doesn't undo processing we already did lawfully, and it doesn't affect data we keep on another basis (for example, match records retained for anti-cheat).
The online Services are not directed at children under 13, and we do not knowingly collect their data; if you believe a child under 13 has an account, contact us and we will delete it.
Online data is protected by server-side access rules (your private match data is readable only by you), authenticated writes, and server-authoritative verification of results. Peer-to-peer connections are made by Steam's networking, which authenticates and encrypts them between the two players. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant authority as the law requires.
We'll post updates to this policy at this address with a new effective date and announce material changes in-game.