Política de privacidade

Last updated: 13 October 2026

This policy explains what personal data Calvir Ltd collects when you play Spellcraft: Second Age (the game, on any device or in a browser) or use this website, why we collect it, who we share it with, how long we keep it, and your rights. We have tried to keep it short and plain.

1. Who we are

Calvir Ltd is the controller of your personal data. We are a company registered in England and Wales, company number 07296625, with our registered office at 20-22 Wenlock Road, London, N1 7GU, United Kingdom. For anything about your data, email [email protected].

2. What we collect

Data you give us

• Account details: your player name and, if you add them, your email address and password (we store only a secure hash of the password). If you sign in with Apple or Google, we receive an account identifier and, if you allow it, your email address and name from them.
• Year of birth and country: asked once, so that we can apply age-appropriate rules (for example, packs are not available to players under 16) and show the right prices and tax.
• Messages to support and anything you send with them, such as screenshots or receipts for a veteran claim.

Data created when you play

• Game data: your collection, decks, progress, campaign results, ratings and match history, friends list, Gold and Gems balances and how they changed.
• Device and technical data: a random identifier the game creates for your installation (used to sign you in without a password), your IP address (seen by our servers when you connect), the platform, app version and language.
• Gameplay statistics and crash reports: events such as "match started" or "tutorial finished", with a timestamp and a few details, and error reports when the game crashes. These are sent to our own server only; we do not use third-party analytics or advertising tools.
• Purchases: what you bought, when, the price and the order number. Card payments on this website are handled by Stripe, and in-app purchases by Apple or Google. We never see your full card number.

We do not show advertising, we do not sell your data, and we do not use it to build profiles for anyone else.

3. Why we use it, and our legal basis

• To provide the game (your account, matches, matchmaking, collection, purchases, support): this is necessary to perform our contract with you.
• To keep the game fair and secure (checking match results, preventing cheating, fraud and abuse, and fixing crashes): our legitimate interest in running a fair, working game.
• To improve the game (understanding which modes are played, where players get stuck, game balance), using the gameplay statistics above: our legitimate interest. You can object at any time (see section 7).
• To send you emails you need, such as verifying your email address or resetting your password: necessary to perform our contract. We will only send news or marketing if you have opted in, and you can opt out at any time.
• To send push notifications (for example, that a friend has challenged you), only if you allow them on your device. You can turn them off in your device settings.
• To keep financial records and meet tax and accounting rules: our legal obligation.

4. Who we share it with

We use these service providers, who process data for us under contracts that protect it:

• Hetzner Online GmbH (Germany): hosts our servers and database in the European Union.
• Cloudflare, Inc.: domain name service and network protection for our website and servers.
• Resend (Plus Five Five, Inc.): sends account emails such as verification and password resets.
• Stripe Payments Europe, Ltd.: processes payments made on this website and calculates tax.
• Google Firebase Cloud Messaging and Apple Push Notification service: deliver push notifications, if you allow them.

Apple and Google are independent controllers for purchases made in their stores and for "Sign in with Apple" and "Sign in with Google". Their own privacy policies apply to the data they hold.

Other players can see your player name, rating, rank and the decks you play in a match. Your friends can see when you are online.

We may disclose data if the law requires it, to protect our rights or the safety of others, or to a buyer if our business is sold (they would be bound by this policy).

5. International transfers

Our servers are in the European Union. Some providers (such as Cloudflare, Resend and Stripe) may process data in the United States or elsewhere. When they do, the transfer is covered by an adequacy decision or by the standard contractual clauses approved by the European Commission and the UK addendum to them.

6. How long we keep it

• Your account and game data: until you delete your account. If an account has been unused for three years, we may delete it after warning you by email if we have your address.
• Match logs: 30 days.
• Gameplay statistics and crash reports: up to 24 months, and deleted with your account.
• Server backups: 14 days.
• Support emails: up to two years after the conversation ends.
• Payment records: six years, as UK tax law requires.

You can delete your account at any time. See Delete your account.

7. Your rights

Under the UK GDPR and the EU GDPR you have the right to access your data, to have it corrected, deleted or restricted, to receive it in a portable format, and to object to processing based on our legitimate interests. To use any of these rights, email [email protected]. We may ask you to confirm the account is yours, and we will reply within one month.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live in the EU.

8. Children

Spellcraft: Second Age is not intended for children under 13, and we do not knowingly collect data from them. Players under 16 cannot open packs. If you believe a child under 13 has an account, email us and we will delete it.

9. Cookies and local storage

This website and the browser version of the game do not use cookies for tracking or advertising, and make no requests to third-party analytics or advertising services. They store a few items in your browser's local storage that are strictly necessary: your language choice and, in the game, your sign-in session and settings.

10. Changes

We will update this policy when our practices change and show the date at the top. If a change is significant, we will tell you in the game or by email before it takes effect.