Duels.ink

Privacy Policy

Last updated: February 20, 2026

Overview

Duels.ink is a free, community-built Disney Lorcana TCG simulator operated from France. We respect your privacy and collect only the minimum data necessary to provide and improve the service.

What We Collect

  • Account data — When you sign in (via Discord or Google), we store your username and authentication identifier so you can access your decks and game history across sessions.
  • Game data — Game states, deck lists, and match results are stored so you can review past games and track your progress.
  • Feedback — If you submit feedback through the in-app form, we store the message content and your user ID so we can follow up.

Analytics

We use PostHog for product analytics to understand how the app is used and identify bugs. Our PostHog instance is:

  • Cookieless — No tracking cookies are set. Each page load is treated as an independent session.
  • EU-hosted — Data is processed and stored on PostHog's EU servers (Frankfurt, Germany).
  • First-party proxied — Analytics requests go through our own domain (/ingest), so no third-party domains are contacted from your browser.

Third-Party Processors

Your data may be processed by the following services, all of which are based in the EU or offer GDPR-compliant processing:

  • Hetzner (Nuremberg, Germany) — Application hosting, database, and Redis.
  • Cloudflare (US, with EU data processing) — CDN, DDoS protection, DNS proxy, and card image hosting.
  • PostHog (Frankfurt, Germany) — Cookieless product analytics (see above).
  • Discord / Google — Used solely for sign-in via OAuth. We receive your username and identifier from these providers; we do not send your data back to them.

Cookies

We use a single, strictly necessary session cookie to keep you logged in. No marketing, advertising, or tracking cookies are used.

Legal Basis (GDPR)

  • Contract — Processing your account and game data is necessary to provide the service you signed up for.
  • Legitimate interest — Cookieless, anonymized analytics help us fix bugs and improve the app without impacting your privacy.
  • Consent — Where required (e.g., optional feedback), processing is based on your explicit action.

Your Rights

Under the GDPR (and similar laws), you have the right to:

  • Access the personal data we hold about you
  • Request correction or deletion of your data
  • Object to or restrict processing
  • Request data portability
  • Withdraw consent at any time (where consent is the legal basis)

To exercise any of these rights, email us at [email protected].

Data Retention

Account and game data are retained for as long as your account is active. To delete your account and associated data, email [email protected] and your personal data will be removed within 30 days. Anonymized analytics data may be retained indefinitely.

Contact

If you have questions about this privacy policy or your data, reach out at [email protected].

If you believe your data protection rights have not been addressed, you have the right to lodge a complaint with the French data protection authority (CNIL) at cnil.fr.