Privacy policy

Data controller

Dorian de VILLELE (alias LaM0uette), publisher of the site. Contact: lam0uette.dev@gmail.com.

The data we process

• Account: the identifier given by the sign-in service, your e-mail address and whether it is verified, your nickname, avatar, and the dates of creation and last visit. They come from the provider you choose (Google, Microsoft, Apple or e-mail and password). TCG Maker never sees or stores your password.
• Session: a sign-in token, valid for 30 days, stored as a hash on the server.
• Content: the TCGs, cards, boosters, decks, rules, images and animations you put online, with their revisions.
• Progress: your collection, in-game currency, decks, statistics, match history, cosmetics and tutorial progress, copied to your account so you can find them on your other devices.
• Social: your friends list, invitations and the private messages exchanged between friends.
• Matches: your nickname and the moves played in an online match, plus the match chat and emotes, relayed to the other players of that match.
• Claude connection (MCP): if you connect an assistant, the access tokens (stored as hashes), the authorized apps, and an activity log holding the date, the app name, the tool called, the TCG concerned and the result, but not the content of your cards.
• Moderation: the reports you send (what you report, the reason, your message) and the decisions taken (removal, suspension, with their reason). Your name is never shown to the person you report.
• Technical server logs: IP address and requests, kept for a limited time, with automatic rotation, for security and troubleshooting.

Why, and on which basis

• Providing the service (account, creating, publishing, matches, friends): performance of the terms of use.
• Securing the site and fighting abuse (rate limits, logs, reports): legitimate interest.
• Connecting an AI assistant to your account: your consent, which you give on the authorization screen and withdraw by disconnecting the app.

Cookies and local storage

TCG Maker uses no advertising cookie, no audience measurement tool and no third-party tracker.

A strictly necessary session cookie (tm_session, HttpOnly, SameSite Lax, Secure over HTTPS) keeps you signed in. A temporary cookie is used during sign-in.

Your game progress (collection, TCGs made on this device, settings) is saved in your browser's local storage, on your device. When you are signed in, your progress (collection, in-game currency, decks, statistics, match history, cosmetics, tutorial progress) is also copied to your account so you can find it on your other devices. Your TCGs are sent to the server only if you put them online.

Since these items are necessary for the service to work, no consent banner is required.

Processors and recipients

• OVH SAS (France): hosting of the server and the data.
• Auth0, part of Okta: sign-in service. It handles your sign-in credentials, and the provider you choose (Google, Microsoft, Apple) passes your identity to it. Transfers outside the European Union may happen, covered by the safeguards required by the GDPR.
• Other players see your nickname, your avatar and what you publish or play with them. A private TCG is visible only to people who have its code or link.
• If you connect an assistant such as Claude, what you ask it and what TCG Maker answers is processed by its publisher under its own terms.

Retention

• The account and its content are kept as long as the account exists. The « Delete my account » button in your profile immediately erases your account, your online TCGs, your friends, your messages, your tokens and your activity log. You can also ask for it by e-mail.
• Sessions expire after 30 days. Tokens and connections can be revoked at any time from your profile.
• Uploaded images that no TCG shows any more are deleted automatically after a few days. Technical logs are kept for a limited time, with automatic rotation.

Your rights

You can ask for access to your data, its correction, erasure, portability, and restriction of or objection to its processing. Write to lam0uette.dev@gmail.com: you can delete your account yourself from your profile, or ask for it by e-mail from your account address.

You can export your TCGs from the site. If you think your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.

Minors and images of people

The service is meant for people aged 15 and over. Below that age, the agreement of a parent or legal guardian is needed to create an account.

If you upload a photo of a person, you must have their consent, and that of their legal guardians if they are a minor.

Security

Exchanges are encrypted over HTTPS, tokens are stored as hashes, session cookies cannot be read by page scripts, and failed sign-in attempts are rate limited.