Privacy policy

1. Who is responsible

The controller of your data is the VirtualTCG project. For any privacy matter, write to the contact email shown at the bottom of this page.

2. What data we collect

When	What data
When you create your account	Email, display name, password (stored only as an irreversible hash, never in plain text), the date you accepted the terms and whether you confirmed your email.
In your profile, if you choose	Portrait (image), country and date of birth.
When you link your Meta Quest	Your Meta user identifier and Meta profile name.
When you use VirtualTCG	Your decks, recorded matches, friendships and requests, and the date of your last activity (to show whether you are online).
When you apply to the team	Name or alias, email, role, portfolio link, country, message and language.

We do not store your IP address in our database. Our servers use it temporarily to limit abusive submissions, and our hosting provider may record it in its technical logs.

In your browser, the web app keeps your session, display name and portrait address in local storage so you do not have to sign in on every visit. We do not use advertising or analytics cookies.

3. What we use it for

• Creating and protecting your account, confirming your email and signing you in on the web and on the headset.
• Letting you play: preparing decks, finding friends, seeing who is online and recording matches.
• Keeping the service secure and preventing abuse.
• Reviewing your application and replying to you.
• Sending you necessary service emails, such as account confirmation.

We do not sell your data, we do not advertise and we do not use it for commercial profiling.

If you are in the European Union, the legal basis is providing the service you request (your account), our legitimate interest in security, and your consent for optional data and applications.

4. What other players see

Registered players can see your display name, portrait, country, age (calculated from your date of birth, if you provided it) and whether you are online. Players who search for you by email, or see you in the online players list, can also see your email address.

5. Who we share it with

Only with providers we need for VirtualTCG to work:

Provider	Purpose
Microsoft Azure	Hosting the API, database, images and web app.
A transactional email provider (on Amazon Web Services)	Sending service emails.
Meta Platforms	The Meta Quest headset and the platform where the VR app runs, under its own policy.
Photon (Exit Games)	Real-time networking for multiplayer matches.
Scryfall	Source of Magic: The Gathering card data and images; some images may load directly from its servers.
Ko-fi and PayPal	Processing donations, only if you choose to donate. They are responsible for that data.
Google Fonts	Loading the fonts of the web pages.

We may disclose data if a law or an order from a competent authority requires it.

6. International transfers

Some of these providers may process data outside your country, including outside the European Union. In those cases they rely on the safeguards the law requires, such as standard contractual clauses.

7. How long we keep it

• Account data, for as long as you keep your account. If you ask us to delete it, we erase it, except what the law requires us to keep.
• Email confirmation links expire in 24 hours and only their hash is stored.
• Applications, for as long as they are useful for the selection process and for at most 2 years, unless you ask us to delete them sooner.

8. Security

We use encrypted connections (HTTPS), passwords are stored hashed, and single-use links are stored only as a hash. No system is 100% secure, but we look after your data as if it were our own.

9. Your rights

You can ask to access, correct or delete your data, object to or restrict its use, take it to another service, or withdraw your consent. Write to the contact email and we will reply as soon as possible, within one month at most.

If you are not satisfied, you can lodge a complaint with the data protection authority of your country.

10. Minors

VirtualTCG is for people aged 12 or older. If you are a minor under the law of your country, you need permission from a parent or guardian. If we learn that an account belongs to someone under 12, we will delete it. If you are a parent or guardian and want to review or delete a minor’s data, write to us.

11. Changes

We may update this policy. We will publish the new version on this page with its date and, if the change is significant, announce it in the app.