Chaotic Tracker Icon
CHAOTIC TRACKER

LEGAL & DATA GOVERNANCE

Privacy Policy

Last Updated: August 26, 2026 · Effective Immediately

1. Core Commitment & Philosophy

Chaotic Tracker ("we", "us", or "the platform") is a community-built digital companion and deckbuilding suite for the Chaotic Trading Card Game. We are built on the principle of strict data minimization: we only collect the minimum amount of information required to provide deckbuilding, collection inventory management, and match history services.

We do not sell, monetize, rent, or trade your personal data. We do not use your game data or collection records for third-party automated profiling or behavioral ad retargeting.

2. Information We Collect

A. Account & Identity Data

When you create an account or authenticate via OAuth (Google or Discord), we collect:

  • Email address (for authentication, verification, and password resets).
  • Public username and optional display name.
  • Selected favorite tribe preference and avatar identifier.
  • Authentication provider ID and account creation timestamp.
  • Discord and Google profile information (e.g., username, avatar) when you authenticate via these providers.

B. Game, Deck & Collection Data

When using the platform features, we store user-associated records including:

  • Decks: Deck names, army size, card compositions (creatures, battlegear, mugic, attacks, locations), and optional notes.
  • Collection Inventory: Scanned or manually entered card instances, foil/variant tags, recorded rolled stats (Courage, Power, Wisdom, Speed, Energy), and acquisition timestamps. We do not store card digital codes and never will.
  • Match Logs: Match outcomes (win/loss/draw), opponent usernames, formats played, turns, and optional tactical match notes.

C. Payment & Subscription Data (Pro Members)

If you subscribe to the optional Pro Tier, payment transactions are processed directly by our payment processor, Stripe.

  • Chaotic Tracker never collects, processes, or stores your credit card number, CVV, or banking details on our servers.
  • We only store tokenized identifiers provided by Stripe in order to provision your Pro account features.

3. Child Privacy & Minimum Age (COPPA & Age Gate)

Chaotic Tracker is designed and intended strictly for users who are 13 years of age or older. In compliance with the Children's Online Privacy Protection Act (COPPA) and international youth privacy standards:

  • We do not knowingly collect, store, or solicit personal information from individuals under the age of 13.
  • Registration requires explicit affirmative confirmation that the user is at least 13 years old.
  • If we discover that a user under 13 has created an account, all associated records will be promptly purged from our database.

4. Subprocessors & Service Providers

We rely on trusted technical infrastructure partners to securely operate the platform:

Supabase (PostgreSQL & Auth)

Provides secure database hosting, Row Level Security (RLS) isolation, and encrypted authentication storage.

Cloudflare (Turnstile & CDN)

Provides bot prevention, DDoS protection, and privacy-first CAPTCHA verification without cross-site tracking cookies.

Stripe (Payment Processing)

PCI-DSS Level 1 certified payment processing for optional Pro subscriptions and customer portal billing management.

PostHog (Product Analytics)

Provides product analytics such as page views, frontend interactions, performance signals, browser/device details, and analytics identifiers. Session recordings are currently disabled.

Vercel (Web Analytics)

Provides aggregated website usage and performance metrics, including web vitals, to help us operate and improve the platform.

5. Analytics & Similar Technologies

We use PostHog and Vercel Web Analytics for product and website analytics. Depending on your browser and applicable regional law, these services may use cookies, local storage, or comparable identifiers and may process information such as page views, clicks, navigation events, browser and device characteristics, approximate location derived from network information, and performance measurements. We use this information to understand feature usage, diagnose problems, improve usability, and monitor site performance. We do not use these tools for advertising retargeting or session recording; PostHog session recordings are disabled.

Analytics are enabled by default where permitted by applicable law. Where prior consent is required, analytics remain disabled until you provide consent through our consent controls. You may withdraw consent or manage analytics preferences from the Profile settings page. Disabling analytics does not prevent you from using core account features.

For more information, review the privacy policies of PostHog and Vercel.

6. User Rights, Self-Service Account Deletion & Data Purge

You maintain full ownership and control of your data at all times:

  • Access & Export: You can view your complete deck, match, and collection records at any time directly through your dashboard.
  • Self-Service Account Deletion: You can permanently delete your account and all associated records directly from your Profile Settings.
  • Instant Purge Cascade: Account deletion executes a strict database cascade, permanently erasing your profile, user card instances, saved decks, likes, and match history.

7. Security & Encryption

All network communication is strictly encrypted in transit via HTTPS/TLS. Database records are protected by database-enforced Row Level Security (RLS) policies ensuring that private deck and collection instance data is inaccessible to unauthorized third parties or unauthenticated visitors.

8. Contact & Privacy Requests

For privacy inquiries, data deletion assistance, or security disclosures, please reach out via our contact channels.