Privacy Notice

1. Who we are

Card and Combat is operated by james chalk, a sole trader trading as Card and Combat, based in the United Kingdom. We are the data controller for the personal data described in this notice, which means we decide how and why it is processed. You can reach us at privacy@cardandcombat.com.

2. What we collect and why

• Trainer profile — your chosen trainer name and the picture you upload, plus your friend code. Used to create your trainer, show who you are to opponents and friends, and render your shareable trainer card. Legal basis: performance of our contract with you.
• Multiplayer, trade and chat content — battle rooms, trade offers, chat messages and friend activity. Used to run multiplayer features you choose to use. Legal basis: contract performance.
• Game progress — collection, PokéCoins, tickets, battle history, tournament standings and achievements. Mostly stored in your browser; multiplayer-related progress is stored on our servers. Legal basis: contract performance.
• Account and login data — where you sign in, your email address and authentication identifiers. Legal basis: contract performance.
• Technical and usage data — IP address, device and browser type, pages viewed, and error logs. Used for security, fraud and abuse prevention, and to fix problems and improve the app. Legal basis: legitimate interests in keeping the service secure and working well.
• Support messages — the content of emails you send us. Used to answer you. Legal basis: legitimate interests and contract performance.
• Card appraisal inputs — the card details you submit for an estimate, processed by our AI provider to generate a valuation. Legal basis: contract performance.
• Legal obligations — records we must keep, for example for tax or to respond to lawful requests. Legal basis: compliance with a legal obligation.

We do not use your data for automated decisions with legal effects, and we do not sell your personal data.

3. Who we share it with

• Service providers and subprocessors — hosting, database, authentication and AI providers who process data on our instructions.
• Payment processors — none. Card and Combat is free, we do not sell anything, and no payment or billing data is collected or shared.
• Other users — your trainer name, picture, friend code and chat or trade messages are visible to users you play, trade or chat with.
• Professional advisers — legal and accounting advisers where needed.
• Authorities — where required by law or to protect our rights.

4. International transfers

Some providers process data outside the UK and EEA. Where that happens we rely on appropriate safeguards, such as UK adequacy regulations or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

5. How long we keep it

We keep your profile and game data for as long as your account is active, and delete or anonymise it within 12 months of your account becoming inactive or of a deletion request. Chat and trade records are kept up to 12 months for abuse prevention. Technical logs are kept up to 12 months. Purchase records are kept as long as tax law requires (usually 6 years). Data stored only in your browser is removed when you clear your browser storage.

6. Your rights

Under UK and EU data protection law you can request access to your data, correction, erasure, restriction of processing, portability, and you can object to processing based on legitimate interests or withdraw consent where we rely on it. Email privacy@cardandcombat.com and we will respond within one month. You can also complain to the UK Information Commissioner’s Office (ico.org.uk) or your local supervisory authority.

7. Security

We use appropriate technical and organisational measures, including encryption in transit, row-level access controls on our database, signed identity tokens for multiplayer features, and limited administrative access. No system is completely secure, so please use a strong, unique password where you set one.

8. Cookies and local storage

We use essential cookies and browser storage only — to keep you signed in, remember your accessibility settings, and store your collection and game progress on your device. We do not use advertising or third-party tracking cookies, and there is no checkout. You can clear cookies and site data at any time in your browser settings, which will reset locally stored game progress.

9. Children

The service is not directed at children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Changes

We may update this notice and will change the “last updated” date above. Significant changes will be highlighted in the app.