Privacy Policy

1. Responsible party and contact

Leandro Lucas Miranda, professionally known as Leo Gersen, is the controller responsible for decisions about Specter’s personal data processing described here. For privacy questions or requests, use the Support form without signing in, select “Account” or “Other” and indicate that your request concerns personal data.

For requests made by a guardian or representative, we may request proportionate proof of that status and the data subject’s identity. Never send your password or complete payment details.

2. Account data and preferences

Registration involves email, player name, password for authentication, country and language. The service uses Supabase for authentication and its database. Account identifiers, email confirmation and access information are needed to administer registration and secure sessions.

The client stores session and reconnection information on your device to support persistent login and return to matches. Preferences such as language and game settings may also be stored locally. Protect your device and sign out when sharing it.

3. Gameplay and transaction data

We process collections and card copies, decks, items, appearance selections, Gold, experience, rating, achievements, results, match actions and state. We also process friendships, invitations, trades, auctions and their records to execute transactions, maintain history and resolve errors or disputes.

For purchases, we process products, amounts, currencies, transaction and provider identifiers, payment status and cancellation, refund or dispute events. Stripe or Xsolla receive the data needed for checkout and may process billing and payment instrument data under their policies. The Support form does not request full card numbers or security codes.

4. Support, Alpha access and technical data

When you contact us, we process the name, email, subject, message and language you provide. Alpha requests may also include player identifier, name, language and access status. Support messages are delivered using Brevo.

Service connections may produce technical records such as IP address, timestamps, requested routes, errors and connection data. We use this information to operate the service, investigate failures, limit abuse and protect accounts. Do not submit unnecessary sensitive data through forms.

Protected forms use Google reCAPTCHA Enterprise. Google receives technical interaction data such as IP address, browser and usage signals to assess automation and fraud risk. Specter receives an assessment result to decide whether the request may proceed.

5. Purposes and legal bases

Account, gameplay and transaction data is used to provide the requested service and carry out purchases, matches and exchanges, on the basis of contract performance or preliminary steps you request. Data needed for tax, accounting or other legal requirements is processed to meet those obligations.

We may process limited records for security, fraud prevention, diagnosis and service improvement based on legitimate interests after considering necessity, proportionality and your rights. Records needed for disputes may be processed to establish, exercise or defend legal claims.

Where a purpose requires consent, we will request it specifically and it may be withdrawn. Email confirmation, account recovery, purchase and support communications are operational; registration is not a general authorization for advertising.

6. What other players can see

Player names, avatars and information relevant to an interaction may be shown to other players in matches, friendships, invitations and transactions. Revealed cards and match actions are visible according to game rules. Offered items are displayed to transaction participants or auction visitors.

Authentication data such as passwords and tokens is not public profile information. Displaying gameplay information does not authorize other users to harass you or improperly disclose personal data.

7. Providers and sharing

Data needed to operate the service is processed by authentication, database, hosting, infrastructure, email delivery, security and payment providers. Current integrations include Supabase, Brevo, Google reCAPTCHA Enterprise, Stripe and Xsolla, depending on feature and region.

Sharing is limited to the relevant purpose and each provider’s applicable obligations. Payment processors and other providers may act independently for their own activities, including fraud prevention and legal compliance.

We may also provide data where necessary to comply with a legal obligation or order, defend rights or investigate fraud. Requests are assessed for their legitimacy and scope.

8. Cookies and device storage

The website uses session cookies and mechanisms associated with authentication, security and language preferences. The client uses local session, reconnection and settings files. These mechanisms maintain access and preferences between uses.

You may delete cookies through your browser and local data through device settings; doing so may end sessions and reset preferences. Integrated services such as reCAPTCHA and checkout may use their own mechanisms described in their policies. Optional technologies requiring consent must respect your choice before activation.

9. International transfers and security

Providers may process data in other countries. International transfers must observe the conditions and safeguards required by applicable law, including contractual mechanisms or other legally permitted grounds.

We apply access controls, authentication and operation restrictions to protect data. No system removes every risk. In an incident, we will take containment measures and make legally required communications to affected users and authorities.

10. Retention and account closure

We retain data while needed for the account, service provision and stated purposes. After closure or a deletion request, some records may need to be retained for legal obligations, fraud prevention and legal claims for as long as each reason requires.

Financial and transaction records may involve other players and are not necessarily deleted in full when an account closes. Where possible and appropriate, data no longer requiring identification will be deleted or anonymized. Backups follow infrastructure retention cycles and remain subject to access restrictions.

11. Your rights

Depending on applicable law, you may request confirmation of processing and access, correction, information about sharing, anonymization, blocking or deletion of unnecessary or unlawfully processed data, portability where applicable and deletion of consent-based data, subject to legal exceptions.

You may also withdraw consent, obtain information on the consequences of withholding it and object where applicable. Where a solely automated decision affects your interests, you may request review and information about the criteria used within legal limits.

Submit your request through Support and describe the right you wish to exercise. We verify identity only as needed to protect the account and respond within legal deadlines. You may also contact Brazil’s ANPD or other competent authorities.

12. Children, teenagers and updates

Use by minors is subject to the Terms of Service and applicable law. Children’s and teenagers’ data must be processed in their best interests with legally required authorizations. If you identify improper registration or collection, a guardian may request review and appropriate measures through Support.

This policy will be updated for material changes to the service or data processing. The date at the top identifies the version. Material changes will be communicated through an appropriate channel; new processing requiring consent depends on a specific choice.