Privacy Policy

S. Goerlitz UG (haftungsbeschränkt), Werner-Bock-Straße 31, 33602 Bielefeld, Germany, runs RiftAtlas and is responsible for your data. Contact: hello@riftatlas.com.

An account needs only an email address or a Google, Discord or Twitch sign-in, and a player name. We never need your real name.

We use your data to provide the features you use (Art. 6(1)(b) GDPR), to keep billing records the law requires (Art. 6(1)(c)), to send update emails you agreed to (Art. 6(1)(a)), and to keep RiftAtlas safe and working, which is our legitimate interest (Art. 6(1)(f)).

• Visiting: your IP address and browser details, to deliver pages, pick your language and region, and stop attacks. We count page views from a small sample of browsers that don't send Do Not Track or Global Privacy Control.
• Account: email address, password hash, player name, sessions (IP address and browser), linked sign-ins, profile picture links, sign-in and activity records, language preference, and your update-email choice.
• Playing: decks, games, chat, replays, friends, private messages, customization, post-game ratings and opponent ratings by or about you.
• Community help: rules questions, answers and bug reports, optional screenshots and diagnostics, and your Discord ID and name if you link Discord.
• Memberships: your Metafy ID and membership status, or the Stripe IDs and status of a membership bought through Link. We never see card details.
• Contact: your name, email address, messages and our replies, and a hashed IP address for 30 days.
• Safety: reports by or about you, with chat or messages as evidence, plus moderation records and appeals.
• Your device: cookies keep you signed in and secure and remember your preferences. Your browser stores settings, decks, drafts, game state, an analytics sampling number, and Simulator crash details with random IDs.

OpenAI checks rules questions and bug reports with the sender's name, names used in public matchmaking, reports and published decks, and the chat and messages of reported players, for spam and severe abuse. Clear severe abuse leads to an automatic 7-day ban. You can appeal from the sign-in page or the ban notice while the ban lasts; appeals go to a moderator.

• Players and spectators: your name, tier emblem and cosmetics. Opponents also see your Legend and score in their game history and, unless your deck is private, your deck and the whole game, hand included, in replays they can share or make public. Any signed-in player can watch a public replay, with your name unless your deck was private, and read the comments posted on it under public names.
• Friends: your friend code, tier, when you were last online, and the lobby or game you're in.
• Everyone: decks and comments you publish under your public name, and your Discord name on the Judges leaderboard if you answer rules questions.
• Our Discord server: rules questions with your name, Private ones included, bug reports without it, and your member role if you link Discord.

We use Cloudflare (hosting, servers, analytics, bot checks), PlanetScale (databases), Resend (email), OpenAI (automated checks, titles, translations), Discord (community help, member roles) and TypeSafe (deck Fit scores, from cards only). Our former provider Clerk keeps older copies until we delete them. Google, Twitch, Metafy and Link (Stripe) handle your data under their own policies when you use them.

Some of these providers process data outside the EU, mostly in the US. These transfers rely on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses; ask us for a copy.

We keep account data until you delete your account in Manage account. Within a day, that removes it and your name and deck from other players' game history; their replays stay until they expire. We keep your sign-in, Discord and Metafy IDs and a hash of your email address so they can't be used to sign up again.

• Sessions: 31 days. Private messages: 30 days. Game history and opponent ratings: 180 days. Sign-in and activity records: 13 months.
• Replays: 6 hours, or 90 days if a player in the game is a paid member; a public replay, its view count and its comments go with it. Bug report screenshots and diagnostics: 14 days.
• Unused checkouts and payment notices: 90 days. Billing records: as long as tax law requires.
• Community help, reports, moderation records, Discord links, post-game ratings, emails and email-list entries: until we delete them, even after you delete your account.

Email us to get a copy of your data or to correct, delete, restrict or export it. You can object at any time, on grounds relating to your situation, to uses based on our legitimate interests. You can withdraw consent to update emails at any time in Manage account; earlier use stays lawful. You can also complain to a data protection authority, such as the one where you live or ours in North Rhine-Westphalia.