Privacy

This page explains what WikiCardz knows about you, why, and what you can do about it. We keep as little as we can.

Who is responsible

The operator's legal details (company name, address, registration) are published here before paid features open.

What we keep

• Your account: your wallet address (you sign in with your Solana wallet), your username, and the confirmation that you are 18 or older.
• Invites: the code you joined with, who shared it, and the codes you shared.
• The game: your cards, packs, sales and purchases, referral earnings, and a journal of every movement (kept unchanged, for fairness and accounting).
• Payments: wallet addresses, amounts and transaction signatures. These are also public on the Solana blockchain, where no one can delete them.
• Fraud prevention: a one-way, keyed fingerprint of the network you signed up from (never the address itself), used only to stop self-referral.

We never ask for, see or store your wallet's keys or recovery phrase.

Why

• To run the game you signed up for: your account, your cards, your payments (performance of our contract with you).
• To keep the game fair and safe: bot farms, multiple accounts, self-referral (our legitimate interest).
• To meet our legal obligations, such as accounting and, where it applies, checks required by law.

No advertising, no selling of your data, no tracking cookies.

Who helps us

• Supabase (database and sign-in) and Vercel (hosting) store and serve the game's data for us.
• Helius (access to the Solana network) sees the transactions the game reads and sends.
• Card images are loaded by your browser straight from Wikimedia's servers (upload.wikimedia.org), which see your address like any website you visit.

Some of these providers are outside the European Union; they are bound by the European Commission's standard contractual clauses or an equivalent safeguard.

Cookies and storage

We only use what the game needs: a sign-in cookie, and your browser's storage for guest cards and for finishing a payment if the page closes. Nothing is used to follow you around the web.

How long

As long as your account is open. When you close it, we delete your personal details within 30 days, except records the law requires us to keep (payments and accounting, up to 10 years) and what is public on the blockchain.

Your rights

You can ask to see, correct, export or delete your data, or object to how we use it: write to the contact address above. We answer within a month. If you are not satisfied, you can complain to the CNIL (cnil.fr) or to the data protection authority where you live.