1. Data Controller

The data controller for the personal data processed on getpaird.io is:

Entity: TimeVault TCG
Contact: [email protected]
Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (European Union).

2. Data Collected

2.1 User-Provided Data

Account data: Email address, name, first name, last name, username, password (stored as a bcrypt hash — the actual password is never stored).
Optional profile data: Avatar, biography, city, geographic coordinates, social handles (Discord, Twitch, Instagram, Twitter/X, YouTube, Facebook, LinkedIn, TikTok).
Player profiles: First name, last name.
Social authentication: Google, Discord, and/or Apple provider identifiers, used to link accounts for OAuth sign-in.

2.2 Tournament Data

Registrations: Status, barcode, check-in status, custom fields defined by the Organizer.
Decklists: Name, archetype, card lists, notes. Decklists are the creative content of the player.
Penalties: Category, name, level, notes, judge identifier.
Results: Scores, match status, reporter identity.

2.3 Payment Data

No credit card data is stored by the Platform.

Stripe transaction identifiers, amounts paid and refunded, payment method and status.
Subscription data: Stripe customer identifier.
For Organizers: the identifier of the Stripe Connect account on which their revenue is collected.

2.5 Shop, Event Wallet and Feedback Data

Shop orders: items ordered, amounts, collection or delivery status and, for a shipped order, the delivery address you provide.
Event wallet (TIX): the history of TIX earned, purchased and spent for a given event.
Post-event feedback: the ratings and comments you submit about an event. The Organizer sees them anonymously unless you expressly consent to your name being disclosed; feedback addressed to getpaird.io is never passed on to the Organizer.

2.4 Technical Data

Push notifications: Device push tokens (Expo/Apple/Google).
Sessions: Stored in Redis with a lifetime of 3 days (4320 minutes).
Analytics: IP address and navigation data collected via Google Analytics 4 (ID: G-CNF4TMEDY8), only after user consent, with anonymize_ip: true enabled.

3. Purposes and Legal Basis

3.1 Contract Execution

Processing necessary to provide the services: account management, tournament participation, payment processing, transactional notifications.

3.2 Legitimate Interest

Platform improvement, fraud prevention, anonymous statistics for service enhancement.

3.3 Consent

Analytics cookies (Google Analytics 4), collected only after explicit user consent.
Push notifications, activated via the native OS prompt.
Optional Cancellation Protection, chosen by the buyer at checkout.

3.4 Legal Obligation

Retention of transaction data for fiscal and accounting obligations under French law.

4. Data Recipients

4.1 Organizers

Tournament Organizers and staff have access to: display names, email addresses, decklists, results, and penalties of registered players. Organizers must not use this data for purposes other than tournament management.

4.2 Sub-processors

Stripe (USA): Payment processing. PCI DSS Level 1 certified.
Brevo (France): Delivery of transactional emails and of emails sent by Organizers.
Expo / Apple / Google (USA): Push notification delivery.
Google Analytics 4 (USA): Web analytics, only after user consent.
Scryfall / Moxfield (USA): Card data APIs only. No personal data is transmitted to these services.
Cloudflare (USA / Global): CDN, DNS and reverse proxy in front of the Platform; processes connection metadata, including IP addresses, to deliver and secure traffic.

4.3 Transfers Outside the EU

Services based in the USA are covered by EU Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework, ensuring an adequate level of data protection.

4.4 Public Publication of Completed Tournaments

When a tournament is completed, the decklists submitted to it are published publicly, regardless of their private or public setting. The published data includes the full card content of each list, the deck archetype, and the player display name (username or real name). It is shown on the public standings, pairings, and a dedicated shareable snapshot page, accessible to anyone including visitors without an account. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — the publication of decklists from completed competitive events is an established practice in the trading card game community and is integral to the competitive and informational purpose of the Platform; the deck archetype is moreover already public in the aggregated metagame. Organizers may disable this publication for a specific event.

4.5 Emails Sent by Organizers

An Organizer may add the email address you used to register for one of their events to their own contact list, in order to inform you about their upcoming events. The legal basis is legitimate interest: you are one of their customers, and the message relates to comparable events. Every such email includes an unsubscribe link, and unsubscribing is definitive for that Organizer. The Editor provides the sending tool; the Organizer alone decides the content and the recipients.

These marketing emails measure opens (through an invisible image) and clicks (through links passing via our servers), so that the Organizer can assess their campaign. Transactional emails contain no such tracking.

5. Data Retention

Active accounts: Data retained for the duration of the account activity.
Unverified accounts: Deleted automatically 48 hours after creation if the email address has not been confirmed.
Event wallet (TIX): The ledger is kept for the life of the event and of the accounting obligations attached to it.
Abandoned registrations: Cleaned automatically once the payment window expires (about 35 minutes).
Transaction data: Retained for 7 years in compliance with French fiscal obligations.
Account deletion: Personal data is permanently anonymized: identifiers are removed, while tournament results may be retained in anonymized form for historical and competitive integrity purposes.

6. Your Rights (GDPR)

In accordance with the General Data Protection Regulation (GDPR), you have the following rights:

Right of access (Art. 15): Obtain a copy of the personal data we hold about you.
Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
Right to erasure (Art. 17): Request deletion of your personal data, subject to legal retention requirements.
Right to restriction (Art. 18): Request limitation of how we process your data.
Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
Right to object (Art. 21): Object to processing based on legitimate interest.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

You also have the right to file a complaint with the French data protection authority: CNIL — www.cnil.fr.

7. Security

We implement appropriate technical and organizational measures to protect your data:

All data is transmitted over HTTPS/TLS.
Passwords are hashed using bcrypt (10 rounds).
Sensitive credentials are encrypted at rest and no bank card details ever transit through our servers.
Hosting within the European Union (Hetzner, Germany).
Access to production systems is restricted and controlled.

8. Minors

Users aged 16 and over may use the Platform freely.
Users aged 13 to 15 may use the Platform with verifiable parental consent.
Users under the age of 13 are not permitted to use the Platform.

If we become aware that personal data has been collected from a child without appropriate consent, we will delete that data promptly.

9. Modifications

This Privacy Policy may be updated at any time. Significant changes will be communicated to users by email. The date of the last update is indicated at the top of this page.

10. Contact

For any questions regarding this Privacy Policy or to exercise your data rights:

Email: [email protected]
Publisher: TimeVault TCG
Data protection authority: CNIL — www.cnil.fr