Privacy Policy

Last Updated: October 24, 2026

Important — Please Read Carefully

This Privacy Policy explains how Riftborn Tactics collects, uses, shares, and protects your personal information. By accessing or using Riftborn Tactics — including the website, the game you play there, and all related services — you acknowledge that you have read and understood this Privacy Policy. We encourage you to read this document in its entirety so that you are fully informed about your rights and the choices available to you.

1. Introduction

Riftborn Tactics (“we,” “us,” or “our”) is an online trading card game. We are committed to protecting and respecting your privacy. This Privacy Policy describes the types of personal information we collect, how we use and safeguard that information, and the choices you have regarding your data.

1.1 Scope.

This Privacy Policy applies to the Riftborn Tactics website at riftborntactics.com, including the game you play in your browser (and the same site if you install it to your device), in-game chat, the support form and the emails we send you (together, the “Services”).

1.2 Agreement.

By creating an account or otherwise accessing the Services, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Services.

1.3 Supplemental Notices.

In some cases, we may provide additional or supplemental privacy notices specific to certain services, regions, or features. Those notices will supplement — and, where they conflict, will take precedence over — this Privacy Policy.

2. Information We Collect

We collect information in several ways: directly from you, automatically when you use our Services, and from the services you choose to use with them. The categories below describe the information we collect.

2.1 Information You Provide

• Account Details: your username, email address and password. We store only a secure one-way hash of your password, never the password itself. When you choose a password, or sign in with one, we check whether it has appeared in leaks from other websites, using Have I Been Pwned's public list: only the first five characters of a one-way code made from it are sent, never the password itself or anything else about you. If you sign up or sign in with Google or Discord, we receive your account ID, email address and name from that service. When you agree to our Terms of Service and this Privacy Policy, we record when you agreed and which versions.
• Profile Picture: an image you choose to upload.
• Purchases: purchases are handled by our payment provider, Paddle. We receive and keep the transaction ID, the item, the amount, the currency and whether the payment succeeded. We never receive your card number or other payment details.
• Support Requests: the category and text of what you send us, and your email address if you contact us without an account.
• Chat: messages you send to friends and in the global chat channel, and match invitations you send to friends. How long each is kept is described in Section 6.
• Things You Create or Send: deck names, decks you publish to the deck library, reports you make about other players, and bug reports you send from a match.

2.2 Information Collected Automatically

• Gameplay: your matches and results, decks, cards, in-game currency, ratings and ranks, quest progress, and lifetime game statistics such as cards played and games won.
• Sign-In and Session Records: a session record that keeps you signed in (up to 7 days), and a log entry each time you sign in.
• IP Address: used to protect sign-in and sign-up from abuse, and recorded in our web server's access logs. Those logs are limited in size, so older entries are deleted automatically as newer ones replace them. We do not use your IP address to find your location.
• Browser Details: your browser's user-agent string, if you turn on push notifications, send a bug report, or your browser reports an error to us.
• Invitations: if you joined through a friend's invite link, which player invited you.
• Activity and Errors: the days on which you used the Services, and reports of technical errors in your browser (the page, the match, your browser and the error message), so we can fix problems and see how players move through the game.

2.3 Information from Other Services

• Google and Discord: if you choose to sign in with them, your account ID, email address and name.
• Discord rank role: if you choose to share your rank with our Discord server, your Discord account ID and name, and the access Discord gives us to keep your rank there up to date.
• Paddle: confirmation of each payment, with its amount and currency.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Providing and Maintaining the Services. To operate, deliver, and improve Riftborn Tactics, including creating and managing your account, enabling gameplay features, and delivering purchased content.

3.2 Processing Transactions. To process in-game purchases, verify transactions, and provide purchase confirmations and digital receipts.

3.3 Matchmaking and Game Balance. To pair you with appropriate opponents based on skill level, to analyze gameplay patterns for balancing card mechanics, and to maintain competitive integrity across ranked and casual modes.

3.4 Fair Play. To run every match on our servers, enforce the game's rules, and investigate cheating, exploits and other breaches of our Terms of Service.

3.5 Customer Support. To respond to your inquiries, troubleshoot technical issues, resolve disputes, and administer your account.

3.6 Settings. To remember your settings, such as sound, music and visual effects.

3.7 Understanding and Improving the Game. To understand how players use the Services (for example, how many new players finish the tutorial or come back a week later) and to find and fix errors. We do this with records kept in our own systems; we do not use third-party analytics services.

3.8 Emails. To send account emails (address verification, password reset, account deletion) and, unless you turn them off in your profile, notification emails such as friend requests, match invitations and the outcome of reports or support requests. We do not currently send marketing emails.

3.9 Legal Compliance. To comply with applicable laws, regulations, and legal processes, including responding to lawful requests from public authorities.

3.10 Safety and Security. To protect the safety, rights, and property of Riftborn Tactics, our users, and the public, including investigating potential violations of our Terms of Service and preventing fraud, abuse, and other harmful activities.

4. Cookies and Storage on Your Device

4.1 Cookies. We use two cookies, both essential. A session cookie keeps you signed in and protects our forms; it lasts up to 7 days, or 1 day if you are not signed in. A security cookie remembers which accounts have signed in on your browser, so that if someone else is locked out for guessing your password, you can still sign in; it lasts up to one (1) year. Neither is used for advertising or to track you on other websites.

4.2 Storage on Your Device. We store some information in your browser's local storage so the game works the way you left it: sound and music volume, visual effects quality, that you have seen the cookie notice and certain introductions, and a cache of card images that makes pages load faster. This stays on your device and you can clear it in your browser settings at any time.

4.3 No Advertising or Third-Party Analytics. We do not use analytics or advertising cookies, third-party analytics services, tracking pixels or web beacons, on the site or in our emails.

4.4 Payments. When you open the Store, our payment provider Paddle loads its checkout on that page and may use its own cookies or storage there under Paddle's privacy policy.

4.5 The Cookie Notice. Our cookie notice tells you about these cookies. Because we use only essential cookies there is nothing to switch off; you can view the notice again from the “Cookie Settings” link in the footer.

5. How We Share Your Information

We do not sell your personal information. We may share your information with third parties only in the following circumstances:

5.1 Service Providers. We share personal information only with the providers we need to run the Services, and only for that purpose:

• DigitalOcean: hosts our servers and database.
• Cloudflare: stores our backups.
• Paddle: processes purchases as our reseller (merchant of record).
• Resend: sends our emails.
• Google and Discord: only if you choose to sign in with them.
• Discord, if you choose to share your rank with our Discord server: your username and your best rank in ranked play, updated after each ranked match, which Discord can show to members of the server with your rank role. We keep your Discord account ID and name, and the access to update your rank (encrypted), until you stop sharing in your profile's Account Settings, or your account is deleted or banned.
• GitHub: receives bug reports you send from a match: your username and user ID, the user IDs of both players, the match number, the time you sent it, your message and your browser's user-agent. They are kept there until we delete them.
• Your browser's push service (for example Google, Mozilla or Apple): only if you turn on push notifications.

5.2 Legal Obligations. We may disclose your information if required to do so by law or in response to valid legal process, including subpoenas, court orders, or government requests. We may also disclose information when we believe in good faith that disclosure is necessary to protect our rights, your safety, the safety of others, or to investigate fraud or respond to a government request.

5.3 Business Transfers. In the event that Riftborn Tactics is involved in a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our Services of any change in ownership or uses of your personal information, as well as any choices you may have regarding your information.

5.4 With Your Consent. We may share your information with third parties when you have given us your explicit consent to do so, including when you choose to connect your account with third-party services or platforms.

5.5 Aggregated and De-Identified Data. We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you. Such data may be used for industry analysis, research, marketing, and other purposes without restriction.

5.6 Public Information. Some information is public by design: your username and profile picture, when you joined, the faction you play most, your ranks and ratings, your overall win and loss record, decks you publish to the deck library, tournaments you enter, and your place on the leaderboard. Each finished match against another player has a result page and a replay at a link that cannot be guessed and is not listed anywhere; either player can send it to anyone, and anyone with the link can open them. A replay shows the match as it was played, including every card each player played (face-down cards too), but not the cards left in either player's hand or deck. Replays are kept for each player's recent matches. You can hide your live matches from the spectate list in your profile; friends and moderators can still watch.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

6.1 Active Account Data. Information associated with your account (including profile data, gameplay history, the days you used the Services, and preferences) is retained while your account exists.

6.2 Deleting Your Account. You can delete your account at any time from your profile. It is deactivated straight away: you can no longer use it, and your name, profile and decks are removed from public pages. Where a match or tournament you played in is shown, you appear as “Deleted player”. Thirty (30) days later it is deleted permanently. Until then you can restore it by signing in again, or by contacting support@riftborntactics.com; if we deleted your account, contact support. After permanent deletion, copies may remain in our backups for up to thirty (30) more days, and in server logs until they are removed automatically.

6.3 Purchase Records. When an account is permanently deleted, we keep the records of its purchases, with its username and email address, for seven (7) years from each purchase, as tax and accounting rules require. Paddle keeps its own records under its own policy.

6.4 Safety Records. When an account is permanently deleted, we keep the player reports it was part of, with the usernames of the players involved, for two (2) years, to prevent abuse and repeat offences. If the account was banned, we keep its username, email address and the date of the ban for two (2) years, for the same reason.

6.5 Matches. Finished matches against other players stay in their match history after your account is permanently deleted, with your name replaced by “Deleted player”. The saved board and replay of those matches are deleted.

6.6 Messages. Messages sent to one player — direct messages between friends, match invitations and notices from us — are deleted automatically after fourteen (14) days. Closing a conversation with a friend clears it for you only: your friend keeps their copy until they close it too, or until the fourteen (14) days are up. Messages in the global chat channel are kept until a moderator removes them or the account that sent them is permanently deleted. Notifications (the bell) are deleted after thirty (30) days. Support requests sent without an account are deleted one (1) year after we resolve them.

6.7 Error Reports. Reports of technical errors in your browser are deleted automatically after ninety (90) days.

6.8 Anonymized Analytics Data. Data that has been fully anonymized and aggregated such that it can no longer be associated with an identifiable individual may be retained indefinitely for analytical, research, and service improvement purposes.

7. Data Security

We take the security of your personal information seriously and implement a range of technical and organizational measures designed to protect it against unauthorized access, alteration, disclosure, or destruction.

7.1 Technical Safeguards.

Connections to the Services are encrypted (HTTPS). Passwords are stored only as secure one-way hashes, and two-step sign-in secrets are encrypted. Our database and backups are stored on encrypted storage. Administrative access requires two-step sign-in, and only the people who run the game have it.

7.2 Reviews.

We review the security of the Services regularly and fix problems we find.

7.3 Incident Response.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and relevant supervisory authorities in accordance with applicable law, including information about the nature of the breach, the data involved, and the steps we are taking to address it.

7.4 No Guarantee.

While we strive to protect your personal information, no method of transmission over the Internet and no method of electronic storage is completely secure. We cannot guarantee the absolute security of your data. You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account.

8. Your Rights and Choices

Depending on your location and applicable law, you may have certain rights regarding your personal information. We are committed to honoring these rights and making it easy for you to exercise them.

8.1 Access and Portability. You have the right to request a copy of the personal information we hold about you in a structured, commonly used, and machine-readable format. To submit an access or portability request, please contact us at support@riftborntactics.com.

8.2 Correction. You have the right to request that we correct any inaccurate or incomplete personal information we hold about you. You may update certain account information directly through your account settings; for other corrections, please contact our support team at support@riftborntactics.com.

8.3 Deletion. You have the right to request the deletion of your account and associated personal data. Deletion requests are subject to the retention periods described in Section 6 and any legal obligations that require us to retain certain information. To delete your account, go to Profile, then Account Settings, then Delete Account, or email support@riftborntactics.com.

8.4 Emails. You can turn each kind of notification email on or off in your profile; every notification email links there. Account emails such as password resets are always sent.

8.5 Withdraw Consent. Where we rely on your consent as the legal basis for processing your personal information, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

8.6 Right to Lodge a Complaint. If you believe that we have not handled your personal information in accordance with applicable law, you have the right to lodge a complaint with a supervisory authority in your country or region of residence.

8.7 Additional Rights for EU/EEA Residents (GDPR)

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR), including:

• The right to restriction of processing of your personal data.
• The right to object to processing based on legitimate interests or for direct marketing purposes.
• The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.
• The right to lodge a complaint with your local Data Protection Authority.

8.8 Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including:

• The right to know what personal information we have collected, used, disclosed, and sold (if applicable) about you.
• The right to delete your personal information, subject to certain exceptions.
• The right to correct inaccurate personal information.
• The right to opt out of the sale or sharing of your personal information. As stated in Section 5, we do not sell personal information.
• The right to non-discrimination for exercising your privacy rights.
• The right to limit the use and disclosure of sensitive personal information.

8.9 Additional Rights for Canadian Residents (PIPEDA)

If you are a Canadian resident, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA), including:

• The right to access personal information we hold about you and to be informed of its use and disclosure.
• The right to challenge the accuracy and completeness of your personal information and to have it amended as appropriate.
• The right to withdraw consent for the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions.
• The right to file a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

9. Children's Privacy

9.1 Age Restriction. You must be at least thirteen (13) years old to create an account. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete it from our systems as promptly as possible. When you create an account, you confirm that you are 13 or older.

9.2 Users Under 18. If you are under 18 (or the age of majority where you live, if that is higher), you may use the Services only with the permission of a parent or guardian.

9.3 Parental Rights. If you are a parent or legal guardian and believe that your child under the age of 13 has provided personal information to us without your consent, or if you wish to review, correct, or request deletion of your child's personal information, please contact us at support@riftborntactics.com. We will respond to verified parental requests in accordance with applicable law, including the Children's Online Privacy Protection Act (COPPA) in the United States and equivalent legislation in other jurisdictions.

9.4 International Compliance. We are committed to complying with applicable child protection laws worldwide, including COPPA (United States), the Age Appropriate Design Code (United Kingdom), and the GDPR's provisions on children's consent (European Union).

10. International Data Transfers

10.1 Where Your Data Is Kept. Riftborn Tactics is operated from Canada. Our servers are located in the United States and our backups in eastern North America, and some of our providers process data in other countries.

10.2 Safeguards. Where the law requires it, we rely on our providers' data processing terms, including standard contractual clauses, to protect information transferred abroad.

10.3 Further Information. For more information about the specific safeguards we apply to international data transfers, or to obtain a copy of the relevant transfer mechanisms, please contact us at support@riftborntactics.com.

11. Changes to This Privacy Policy

11.1 Right to Update. We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will revise the “Last Updated” date at the top of this document.

11.2 Notification of Changes. We will provide notice of changes through one or more of the following methods:

• Posting the updated Privacy Policy on our website.
• Sending an email notification to the address associated with your account.
• Displaying an in-game notice or banner upon login.

11.3 Material Changes. For material changes that significantly affect your rights or the way we use your personal information, we will provide at least thirty (30) days' advance notice before such changes take effect. Your continued use of the Services after the effective date of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree to the revised Privacy Policy, you should discontinue use of the Services and may request deletion of your account.