Privacy policy
Last updated:
この文書は英語とスペイン語でのみ提供しています。
Who is responsible for your data
The data controller for this website is:
- Brand
- River TCG
For anything related to privacy, write to contact@river-tcg.com.
What data we process
We only process the data needed to run the site:
- Account data. If you sign up with email: your email address and your password, which our authentication provider stores only as a one-way hash that nobody can read. If you sign in with Google or Discord: the email address, name, profile picture and account identifier that they share with us. We also keep technical sign-in records (date, IP address and browser) to protect your account.
- Public profile. Your username, profile picture and banner, bio, the social links you choose to add (Discord, X, YouTube, Twitch, Instagram, Linktree), whether your profile is private, the number of profile visits and the date you joined.
- Saved decks. The decks you save to your account, with their name, format and cards.
- Community content. When the community features are available: the publications and comments you write (with any deck, image or video link you attach), your likes and the publications you save. To count each visitor once per day on a publication we store the account identifier of signed-in visitors and, for everyone else, a one-way hash of their IP address; we never store the IP address itself. We also keep an internal log of who created, edited or deleted each publication and when, to investigate abuse.
- Messages you send us. Your email address and the content of your message when you write to us.
- Technical data. Like any website, our hosting and database providers receive your IP address, browser details and the pages you request, and keep them in server logs for security and to keep the service running. When you sign up, sign in or reset your password, a security check (Cloudflare Turnstile) analyses technical signals from your browser to tell people from bots. We choose the initial language of the site from the language preferences your browser sends, without storing them.
- Tournament results. Our tournament and deck pages show results published by Limitless TCG (onepiece.limitlesstcg.com and play.limitlesstcg.com) and Egman Events (deckbuilder.egmanevents.com): the name or nickname, country, placing, record and decklist of each player, as made public by the organisers.
We do not use analytics, advertising or tracking tools, we do not profile you, we do not make automated decisions that affect you and we do not sell your data.
Some preferences are kept only in your browser and never reach our servers; they are listed in our cookie policy.
Why we use it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, signing you in and sending the emails the service needs (account confirmation, password reset, email change). | Performance of the contract formed by our terms of use (Art. 6(1)(b) GDPR). |
| Showing your public profile, keeping your saved decks and, when available, publishing your community content. | Performance of the contract (Art. 6(1)(b) GDPR). |
| Keeping the site secure, protecting it against attacks and bots (including the security check on the sign-up and sign-in forms), preventing abuse and spam, moderating content and counting visits fairly. | Our legitimate interest in running a safe and reliable service (Art. 6(1)(f) GDPR). |
| Showing public tournament results. | Our legitimate interest in informing players about the competitive scene, using data the organisers have already made public (Art. 6(1)(f) GDPR). |
| Answering your messages and requests. | Your request and our legitimate interest in replying (Art. 6(1)(b) and (f) GDPR). |
| Complying with legal obligations and requests from the authorities. | Legal obligation (Art. 6(1)(c) GDPR). |
Where we rely on our legitimate interest, you can object at any time (see "Your rights").
How long we keep it
- Account, profile and saved decks: while your account exists. You can delete your account at any time from Settings; your account, profile, saved decks, likes and saved publications are then erased.
- Publications and comments: if you delete your account, what you published stays on the site without any link to you or your username. If you want it removed, delete it before closing your account or ask us. A deleted comment is no longer shown, but it is kept marked as deleted so that its replies stay in place; you can ask us to erase it completely.
- Visit counter keys and the internal publication log: while they are needed to count visits and investigate abuse. The log stops being linked to you when you delete your account.
- Server logs: for the short periods set by our hosting and database providers (from hours to a few weeks).
- Messages: while we handle your request and then for as long as the law requires or as needed to deal with possible claims.
- Tournament results: while they are relevant to the history of the competitive scene, unless you object.
Deleted data may remain for a short time in our providers' backups until they are overwritten.
Who we share it with
We do not sell your data or hand it over to third parties for their own purposes. We rely on these providers, which process data on our behalf under data processing agreements:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, authentication and account emails | European Union (Ireland) |
| Cloudflare | Website hosting (Cloudflare Workers), content delivery, protection against attacks and bots, the Turnstile security check on sign-up, sign-in and password reset, and server logs | Global network; United States company |
| Amazon Web Services | Storage (S3) and delivery (CloudFront) of card and news images | European Union (Sweden) and a global delivery network |
News articles are edited with TinaCMS, which only handles our editors' data, not yours.
If you choose to sign in with Google or Discord, that company verifies your identity and shares your email address, name and profile picture with us under its own privacy policy. Your profile picture is then loaded from its servers.
Links to Cardmarket and TCGplayer take you to those marketplaces, which handle your data under their own policies once you arrive. The links carry parameters (UTM) that identify River TCG as the source, not you.
Some of these providers, or their subcontractors, may process data outside the European Economic Area, for example in the United States. Those transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the standard contractual clauses approved by the European Commission. For Cloudflare, they are covered by its data processing agreement, which includes those clauses, and by its Data Privacy Framework certification.
We may also disclose data to public authorities when the law requires it.
Your rights
You can exercise these rights at any time:
- Access: find out what data we hold about you and get a copy.
- Rectification: correct inaccurate data. You can edit most of your profile yourself.
- Erasure: ask us to delete your data. You can delete your account yourself from Settings.
- Restriction: ask us to limit how we use your data while a request is being resolved.
- Objection: object to processing based on our legitimate interest, including the publication of tournament results.
- Portability: receive the data you gave us in a structured, machine-readable format.
- Withdrawal of consent: where processing is based on consent, withdraw it without affecting what was done before.
To exercise them, write to contact@river-tcg.com from the email address linked to your account, or tell us which data your request is about. It is free, and we will reply within one month, which may be extended by two further months for complex requests.
If you think we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or with the supervisory authority of your country of residence in the EU.
Minimum age
You must be at least 14 years old to create an account, the age from which Spanish law allows you to consent to the processing of your data. If you are younger, please do not sign up. If we learn that an account belongs to someone under 14, we will delete it.
Security
All traffic is encrypted with HTTPS, passwords are stored only as a hash, and database access is restricted with row-level security so that each user can only change their own data. No system is completely secure, so please use a strong password that you do not use anywhere else.
Changes to this policy
We will update this page, and the date at the top, whenever the way we process data changes. If the change is significant, we will let account holders know by email or on the site.