Privacy

Cards with Friends keeps only what it needs to let you sign in and play: your name, profile picture and email address from the account you sign in with, and the games you play. There are no ads, no analytics, no tracking cookies and no chat. Nothing is sold or shared for marketing.

Cards with Friends is made and run by Joel Byrén, a solo developer in Sweden, who is responsible (the controller) for your personal data. Questions and requests: cwf@byren.se.

You sign in with GitHub, Google or Twitch, through Clerk, which handles accounts for us. The provider you pick shares your name, email address, profile picture and account id with Clerk. It also sees that you signed in to Cards with Friends; that is covered by its own privacy policy. We never see your password. Clerk keeps a session cookie in your browser so you stay signed in; it is needed for the site to work.

• Your profile: your Clerk account id, display name, profile picture link and email address, copied from Clerk each time you sign in, plus the theme you picked.
• Your games: the games you create or join, their settings and rule sets, your seat, the cards on the table and in your hand, and a log of the moves made, with the time of each.
• In your browser: your theme and, per game, the board layout you chose, in local storage. These never leave your device.

Our service providers (below) may also keep short-lived technical logs, such as IP addresses and request times, to run and secure their services.

Other players in a game you join see your display name and profile picture. When you host an open lobby, anyone signed in can see its name and your display name. Your email address is never shown to anyone.

Only to run the game: to sign you in, show you to the players at your table and keep track of your games. The legal basis is that it is needed to provide the service you asked for (GDPR article 6(1)(b)). We don't use your data for advertising or profiling, and we don't email you.

• Clerk: accounts and sign-in.
• Convex: the database and game server.
• Vercel: serves the website.

All three are based in the United States, and the game data is stored there (Convex, US East). They protect transfers from the EU with the safeguards the GDPR requires, such as the EU-US Data Privacy Framework or the EU's Standard Contractual Clauses, as their own privacy policies describe.

A game is deleted, with its cards and move log, when its host deletes it or its last player leaves. Leaving a game removes your seat. Your profile is kept until you delete your account.

You can delete your account yourself: open the account menu, choose Manage account, then Delete account. Your profile is removed right away and you leave every game you are in; a game you were the last player in is deleted, and a game still being played ends for everyone, as if you had given up. Moves you made in games other players are still in stay there, but no longer point to you, and so do rule sets those games use, until the games are deleted; your other rule sets are deleted. Clerk deletes its copy of your account under its own policy.

You can ask to see, correct, export or delete your data, or object to how we use it. Email cwf@byren.se and we'll answer within a month. You can also complain to your data protection authority, in Sweden IMY.

Cards with Friends is for players aged 13 and over, as are GitHub, Google and Twitch, which you sign in with. If you believe a child under 13 has an account, email us and we'll delete it.

If this page changes, the date at the top changes with it. Bigger changes, such as adding chat, will be described here before they go live.