1. Who is responsible
STACK Card Games is an independent project operated by Miguel Carvalho in Portugal. For the website and STACK Online account features, Miguel Carvalho is the controller of the personal data described here. Contact: stackstudios.dev@gmail.com.
This policy covers this official website, feedback and contact submissions, and STACK Online when those features are made available. STACK Online is available through the Online page and continues to receive improvements.
2. Information we handle
- Accounts: player name, email address, account identifier, email-confirmation status, sign-in information and preferences such as difficulty, hints and sound.
- Email and password: authentication is handled by Supabase Auth. Passwords are not stored in our marketing list and are not available to us as readable passwords.
- Google sign-in: Google supplies basic identity information, such as name, email address, account identifier and profile picture where provided. We use the information needed to authenticate and identify your player account. We do not request access to your Gmail messages, contacts, Drive files or Google password.
- Marketing choices: whether you accepted STACK news and offers, the consent wording version and dated changes to that choice.
- Technical information: hosting and authentication providers process connection and security information, such as IP addresses, browser/device details, request times and authentication logs. Analytics and advertising may involve additional information as described below.
- Messages and feedback: the contact information and content you choose to submit. Please do not send passwords or sensitive personal information. In-game problem reports include your account identifier, your message, up to two optional screenshots, the game version and limited technical game context used to diagnose the problem. Reports are stored privately in Supabase for support; they are not published or sent automatically to advertising providers. While you are signed in, technical errors are also sent automatically to our private Supabase diagnostics table, with the game version, error time, limited game state and recent game actions. These diagnostic payloads exclude account names, emails, passwords, authentication tokens and screenshots; the server associates them with your authenticated account for troubleshooting. Repeated errors and submission volume are limited.
3. Why we use it
We use account information to create and manage your account, sign you in, save settings, and send confirmation, recovery and essential service messages. The legal basis is performance of the account service you request. Required account details are necessary to provide that service; browsing the public information pages does not require an account.
We use proportionate security and support information for our legitimate interests in preventing misuse, diagnosing problems and answering requests. Information required by law is processed to meet the relevant legal obligation. Optional marketing, analytics storage and advertising storage or personalisation rely on consent where required.
4. Marketing is optional
Creating an account or using Google sign-in does not by itself subscribe you to marketing. The news-and-offers checkbox is optional. We use the subscriber list for STACK updates and offers only where you have opted in, and the active list includes confirmed email addresses.
Withdraw your choice in the game's OPTIONS → Receive STACK news and offers, or email us. You can also reply to a STACK marketing email asking to unsubscribe. Withdrawal does not affect earlier lawful processing or essential account emails. We do not sell the subscriber list or provide it to advertising networks for audience targeting.
5. Cookies, local storage and analytics
The site uses Google Analytics to understand visits and interactions, including links to the physical editions, merchandise and support pages. With analytics consent, STACK Online also records match starts, finishes, restarts and exits, difficulty, win or loss and elapsed match duration. These game events do not include your player name, email address or STACK account identifier. Google may process device and browser information, pages viewed, referrals, interactions and network information.
The consent banner offers Accept and Reject. Analytics storage, advertising storage, advertising user data and personalisation default to denied until your saved choice is applied. Google Consent Mode may still send limited cookieless measurement and consent signals when storage is denied; Reject does not mean that no network request reaches Google.
The current site's affiliate banner resources are loaded after acceptance. Account-session storage, game settings, recent local match history and the stored privacy choice serve separate functions. Authentication session tokens and recent history may remain in your browser until you sign out or clear site data. This is not consent to marketing.
These controls reload the page to apply your selection. They affect this browser and site; use your browser settings to remove cookies or other data already stored. External websites have their own controls.
6. Website advertising and affiliate links
Some placements are advertisements or affiliate links. STACK may receive a commission if you complete the advertiser's qualifying action or purchase. Simply viewing or clicking a particular offer does not necessarily earn a commission.
Affiliate banner images are hosted on this website. Static alternatives remain visible without optional consent; displaying these local images does not contact the affiliate provider. Google Analytics is loaded only after you accept. With consent, this website can also request a country code from its hosting service to select eligible offers. Affiliate links use MaxBounty tracking for offers including Star Trek Fleet Command, War Thunder, Kinguin, Keycense, Arcade.Online, Surveoo and NordVPN. When you follow a link, providers may receive technical data, tracking identifiers and conversion information and use cookies under their own terms. See MaxBounty’s privacy policy. A Tally referral link is also available.
We do not attach your STACK account email, password or marketing list to these links. Campaign identifiers describe placements, not your account. Advertisers and merchants are responsible for their own services, eligibility, age and country restrictions, prices and privacy notices.
7. Advertising inside STACK Online
We intend to support the browser game with advertising, which may include video breaks between games or when starting another game. No in-game video advertising provider is currently active.
Before activating one, we will identify the provider and its data practices here and provide the notices and choices required for that integration. Advertising may involve device identifiers, network information, ad interactions and cookies or similar technology. Accepting these Terms or creating an account is not, by itself, consent to advertising tracking or personalised ads. Rewarded-ad conditions, if introduced, will be explained before the optional action.
8. Service providers and external services
Cloudflare delivers the website. Supabase provides online authentication and account storage. Google provides optional sign-in, Analytics and the Gmail SMTP service currently used to deliver account emails. These providers receive the information needed for their functions. Feedback forms opened on Tally, purchases on MakePlayingCards or Fourthwall, Buy Me a Coffee, social networks and affiliate destinations are separate services with their own notices.
Our Supabase account database is configured in Europe. This does not mean every provider processes data only in Europe: support, email, authentication, analytics and global infrastructure can involve other countries. Transfers subject to European data-protection rules must use an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses. Contact us for information about the safeguards relevant to your data.
Provider information: Supabase data processing terms, Google Privacy Policy and Cloudflare Privacy Policy.
9. Retention and security
Account details and preferences are kept while needed to provide your account and deal with related support or security matters. Contact us to request account deletion; signing out or clearing browser data does not delete the server-side account. Local recent-match history stays in that browser and is not a public leaderboard.
Marketing details remain active until you withdraw consent or they are no longer needed. A limited consent history or suppression record may be retained where necessary to demonstrate choices, prevent further messages, meet a legal duty or address a claim. Provider logs and backups follow the relevant service's retention arrangements. We do not set a single retention period for every category; necessity, your requests and applicable obligations determine it.
Access controls, authentication and per-user database permissions help protect account information. No internet service is risk-free. Never share your password or recovery links.
10. Your choices and rights
Where applicable, you can request access, correction, erasure, restriction, portability or object to processing. You can withdraw consent without affecting the lawfulness of processing before withdrawal. Contact stackstudios.dev@gmail.com; we may need proportionate information to confirm your identity. We respond within the applicable legal deadline, normally one month under the GDPR.
You may complain to your local data-protection authority or to Portugal's CNPD. We do not use account information to make solely automated decisions with legal or similarly significant effects on you. CPU opponents make game moves, not decisions about your legal rights.
11. Children and changes
The physical game's age recommendation is not permission for a child to create an online account or submit personal information. Where parental authorisation is required, a parent or guardian must be involved. Contact us if you believe a child has provided information without the required authorisation so we can investigate and handle deletion as appropriate.
We will update this page when practices change, including before activating a new in-game ad provider. Material changes affecting existing accounts will be communicated where required. A policy update does not automatically give consent to a new marketing or tracking purpose.