Privacy policy

Last updated: 3 November 2026

Hoarding Master is a collectible card game: you photograph real objects and each photo becomes a card. This policy explains what data the game handles, why, and what you can do about it. We wrote it to be read, not skimmed.

Who is responsible

The controller of your data is Lucas Lefort EI (sole proprietorship, SIRET 949 815 138 00019), who publishes Hoarding Master. Contact for anything about your data: [email protected].

What we collect

Your account

You sign in with a social account (Google, Apple, X, Facebook, Discord or GitHub, depending on what is offered). Our sign-in service, Zitadel, which we run on our own servers, receives from that provider:

• an identifier for your account at that provider;
• your name and, if the provider shares it, your email address and profile picture. With Sign in with Apple you can hide your real address: we then only receive an Apple private relay address. We never take your name from a relay address;
• whether the provider has verified that email address.

When a provider gives no email, we create a placeholder address that is never used to write to you. We do not send marketing emails to your account's address.

So that signing in with Google or with Apple finds the same player, the game keeps, for each sign-in method linked to your account, the provider's identifier for you, when you last used it and, only when the provider has verified your email address (and it isn't an Apple relay address), a fingerprint of that address (a one-way hash): we can recognise the same address again, but the address itself isn't stored by the game. You see and manage your sign-in methods in Settings, Sign-in methods.

The game itself stores your player profile: a username and display name (made from what the provider gives, then yours to change), your profile picture link, your language and your time zone (used to count streak days).

Your photos and what is made from them

When you take a photo for a card:

• the app compresses it and sends it to our storage. Before anything is published, we remove its metadata (EXIF), including GPS location;
• the photo is analysed by an AI model (GPT-6 Luna, from OpenAI) that writes the card: the object's kind, name, description, brand and visible text, tags and strengths. The same photo goes through OpenAI's moderation service;
• the card then gets a rarity, stats and a serial number, computed by the game.

Photos must not show anyone's face. A photo that shows a face, nudity or other unsafe content is rejected (see Moderation and automated decisions).

Your game activity

Cards you own, captures and their state, trades, auctions and bids, credits and instant photo tokens (every movement is recorded in a ledger), experience points, levels, streaks, quests, leagues, achievements, your showcase, and your privacy settings. The players you block, and the reports you send (what you reported, the reason and your note) or that are made about you or your cards.

Purchases

Credit packs, when they are on sale, are paid through Stripe on the web or through Apple's In-App Purchase in the iPhone app. The payment provider handles your card details: we never see them. We receive a record of the payment (identifier, pack, amount, date) to credit your wallet.

Notifications

If you allow notifications, we store your browser's push subscription (Web Push) or your iPhone's device token (Apple Push Notification service), your notification preferences, and a log of the notifications sent to you, which limits how many we send per day.

Connection data and logs

• Session: when you sign in, we keep a session (a random token, of which we store only a fingerprint) for 30 days after your last use.
• Last connection: the date of your last visit (at most once a day) and when you were last active (at most every 5 minutes). We use them for streaks, to count active players and to show who is online.
• Server logs: our servers record technical logs of requests, which include your IP address, the address requested and your browser's user agent. They protect the service against abuse (sign-in attempts are rate limited per IP address) and help us fix bugs.

The reminder list (if you leave your email)

On the home page and on the pioneers' page, you can leave an email address to be reminded of the public opening (17 November 2026). We keep the address, the language of the page, which page it was left on and the campaign tag of the link that brought you (such as `?src=…`), the date, and the version of the consent line you saw. Nothing else about you: no IP address, no browser identifier. We use it only to remind you of the public opening and to send you news about the game's launch. Every email says how to unsubscribe: reply « stop » or write to [email protected], and we delete your address from the list.

These emails are sent through Brevo (Sendinblue SAS, a French company). Brevo receives only your email address, the date of your consent and your language, nothing else from your account or your cards. When you unsubscribe, your address is deleted from Brevo at the same time as from our list.

Stored on your device

The app keeps on your device: your language, sound, motion and haptics preferences, a copy of your own cards (so the collection opens without asking our servers again; cleared at sign-out), and up to 5 photos taken offline, for at most 72 hours, until they are uploaded.

Why we use it, and on what legal basis

We do not sell your data, do not use it for advertising, and do not build advertising profiles.

What other players see

The game is social. Other players can see your username, display name and profile picture, the cards you own and your showcase, the cards you trade or put up for auction, your rank in leagues and leaderboards, and your first discoveries and Legendary cards in the live discovery feed. A card's photo is visible to everyone once the card is revealed.

In the settings you can hide your collection, stay out of the discovery feed and stay out of the weekly leaderboards (league members still see each other). A player you block no longer sees your cards or your profile. A player you report is never told who reported them.

Who processes your data

The game server, its database and our sign-in service are hosted in the European Union, in Germany. Some of the other providers are outside the European Union or belong to groups based there: OpenAI processes data in the United States, and Cloudflare, Stripe and Apple are US companies or have US parents that may access it. These transfers rely on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's standard contractual clauses.

How long we keep it

When you delete your account

You can delete your account in the app (Settings, Delete my account). Deletion is refused while you have an open trade, auction or winning bid, so that money and cards in escrow are settled first. When you delete it:

• your photos are deleted from our storage, and the cards made from them show a placeholder instead;
• your sessions, notification subscriptions, sign-in methods (and their email fingerprints), settings, showcase and current league seat are deleted, and captures still developing are stopped;
• your cards stay in the game: the account becomes an anonymous "Former player" with no name or picture, which keeps owning what it owned. That way other players' cards, first discoveries and the credit ledger stay whole.

Your record in our sign-in service (your name, email address and provider identifier) is not yet removed automatically by this deletion: write to [email protected] and we delete it.

Minors

You must be at least 13 to play. In France, if you are under 15, you also need the consent of a parent or guardian. If we learn that an account belongs to a child below these ages without the required consent, we delete it.

Moderation and automated decisions

Every photo is checked automatically, by the AI model's own flags and by OpenAI's moderation service. A photo with no object, too blurry or too dark, of a screen or a printout, or of the same kind as your previous card is rejected automatically; you can simply take another photo.

When a photo is flagged for a face or sensitive content, a person on our team reviews it before it can become a card. If nobody has reviewed it within 24 hours, it is rejected automatically, with the reason its flags point to. Bans for cheating are decided by a person. Reports from players are reviewed by a person; the only automatic step is that a card's photo is hidden for everyone once several players have reported it, until someone on our team looks at it. You can contest any decision by writing to [email protected].

The kind, rarity and stats of a card are game mechanics computed automatically; they have no legal effect on you.

Cookies and trackers

The game sets one cookie when you sign in: a session cookie that keeps you signed in. During sign-in, a second short-lived cookie protects the sign-in flow for 10 minutes. Both are strictly necessary, so they need no consent.

There are no advertising cookies, no analytics trackers and no third-party scripts. Our fonts are served from our own servers.

Your rights

You have the right to access your data, to correct it, to delete it, to receive it in a portable format, to object to processing based on our legitimate interest, to restrict processing, and to withdraw consent at any time. In France you can also give instructions about what happens to your data after your death.

• Delete: in the app, Settings, Delete my account.
• Everything else: write to [email protected]. We answer within one month.

If you believe we do not respect your rights, you can complain to your data protection authority; in France, the CNIL (cnil.fr).

Changes

We will tell you in the app before any significant change to this policy takes effect.