Privacy Policy

OPTCG AI operates optcg.ai. For privacy questions or requests, contact the administrator at:

[email protected]

If you create an account, we store your email address, public nickname, chosen leader thumbnail, language and gameplay preferences, account creation and last-login dates, saved decks, and the matches attributed to your account.

When you browse or play, we may process a signed anonymous browser identifier, route templates visited, referral host, limited campaign parameters, language, device category, game and replay data, and your IP address. IP addresses are used for security, capacity limits, and country-level statistics; they are never shown in public replays.

The composition of a custom deck used in a completed match may appear in the public Meta section alongside its Leader and play date. We also aggregate appearances of predefined Leaders used by human players. We do not display the player's account, nickname, email address, IP address, or match identifier in Meta.

If you report a problem from a match, we store your comment, the contact email if you provide one, the match and the exact point of the report, and technical data about the sender: account or anonymous identifier and IP address. We use them to investigate the problem and reply to you.

When scoring is enabled, the leaderboard publicly shows the nickname, avatar, optional flag, score and best winning streak of the season of every account with a rated match. This participation cannot be hidden. You can change or remove the flag. Deleting an account keeps its competitive results and positions under Deleted user, without its nickname, avatar or flag. Opponents keep their results.

One-time codes and request nonces are stored only as hashes. Session records contain identifiers and timestamps; the signed session cookie is HttpOnly, SameSite=Lax, and Secure in production.

Recent games is accessible from the menu and home page without an account. It lists up to 51 completed, non-abandoned games, including games played by guests, and links to their replays. Public information includes the Leaders, gameplay and deck composition shown in the replay, whether each opponent is human or AI, the AI difficulty when known, the result, date and number of turns. This helps the community discover how different Leaders are played.

The public listing and replay viewer do not display account nicknames, emails, IP addresses or links to player profiles. Chat messages are not included in the listing or replays. This does not mean all records are anonymous: internally, games may remain linked to the accounts that played them for the account history and the other purposes described in this policy.

Showing games in Recent games is enabled by default. Registered users can turn it off in their preferences after signing in. For a game linked to an account, visibility is decided when its completion is first saved: if either participant has turned the option off, the game is excluded from the public listing. Changing the preference does not change the recorded visibility of earlier games, including games previously hidden.

This preference only controls inclusion in the public listing. Replay links remain accessible, and the private account history and aggregate statistics are unaffected. The 51-game display limit is not a retention period and does not delete older replays. The rights and contact options described below remain available.

Recent games · Preferences

If you choose Sign in with Google, your browser obtains a Google ID token and sends it to OPTCG AI. The server verifies it locally and reads the stable Google account identifier (sub), email address, email verification status, and hosted-domain indicator. We store the stable identifier and email to create or link your OPTCG AI account.

We never receive your Google password, do not store the Google ID token, do not request a Google access token, and do not access Gmail, Drive, Calendar, contacts, or other Google services. Google may process data and use its own cookies when its optional sign-in components are loaded or used, under Google's own privacy terms.

If you choose Sign in with Discord, you are redirected to Discord to authorize OPTCG AI and return with a single-use code. The server exchanges it directly with Discord and reads your Discord account identifier, email address, and whether Discord has verified it. Discord also returns your public username and avatar, which we do not store. We store the identifier and email to create or link your OPTCG AI account; if that email already has an account, we send a code to confirm the email before linking it.

We never receive your Discord password. The access token issued by Discord is used only to read that data and is not stored. We do not read your servers, messages, friends, or other Discord data, and we never post on your behalf. Discord processes data on its own authorization screen under its own privacy policy.

We use the data to provide the game, authenticate and secure accounts, synchronize decks, show private match history and public replays, help users learn from community games, train and improve the game's AI with the matches played, apply game visibility preferences, enforce abuse and capacity limits, diagnose errors, produce aggregate service statistics, and comply with legal obligations. Depending on the applicable law, this processing is necessary to provide the service you request and is based on our legitimate interests in operating, improving and protecting it; we ask for consent where required.

We use essential cookies and browser storage for the signed anonymous identifier, language and gameplay preferences, the login-request nonce, session authentication, and locally saved guest decks. Guest preferences stay on that browser; when you sign in, supported preferences are also synchronized with your account. We do not use advertising cookies. Google may use its own cookies when its optional sign-in components are loaded or used.

We use Google Analytics to measure visits and usage with browser and device information and analytics cookies. Page URLs sent by this integration exclude parameters and fragments; game and replay identifiers are replaced with generic paths. Advertising features are disabled. We ask before loading Analytics for visitors in the EEA, the United Kingdom and Switzerland, or when the country cannot be determined. Elsewhere it loads unless you have rejected it. You can change your choice here at any time; explicit choices are remembered for 180 days. Google may process data under its privacy policy.

Google privacy policy

Change analytics preference

The Meta section, the Recent games listing and replay links make the gameplay information described above available to other visitors, including people without an account. We also share data as needed with providers that host the service or database, deliver login emails, and provide the optional Google and Discord sign-in flows, or when required by law. We do not sell or rent personal data and do not use Google or Discord user data for advertising profiles.

Account data, saved decks, and account match attribution are retained while the account exists or until a valid deletion request is completed. Operational game, replay, and analytics records may be retained for gameplay, history, security, error diagnosis, aggregate statistics, and AI training; they are not used for advertising.

Expired login codes are purged after 24 hours, inactive login-throttle rows after 48 hours, and expired or revoked sessions after 30 days. Active user sessions use a sliding 30-day expiry.

You may contact us to request access, correction, deletion, restriction, or objection where applicable. You can sign out to revoke the current session and use your profile to close other sessions.

For account access or deletion requests, we verify control of the email stored on the account by sending a one-time challenge to that address. A completed account deletion removes the user record, sessions, saved decks, and account-to-match attribution. Public replays do not display the account email or nickname and may remain available. Matches are kept without that attribution, and those already used to train the AI cannot be removed from the trained models.

We use HTTPS, secure and HttpOnly session cookies in production, signed identifiers, hashed one-time codes and nonces, rate limits, local verification of Google ID tokens, and restricted database access. No internet service can guarantee absolute security, so please contact us if you suspect misuse.

We may update this policy when the service or legal requirements change. The current version and its update date will always be published on this page.