Legal information
Privacy policy
Last updated: 4 October 2026
This page explains what data SCP TCG uses, why, and your rights (GDPR).
Controller
L’éditeur de SCP TCG, reachable at tcg.scp@gmail.com.
Data we collect
Account: email, password (stored securely by the auth provider), nickname, creation date. Game: owned cards, credits, boosters, wins and losses, purchase history (amount, offer, Stripe IDs, status). Technical: IP address and security logs (anti-abuse, captcha), chosen language. Payment: handled by Stripe (we receive confirmation, not your card).
Why
Create and secure the account, run the game, deliver purchases, prevent cheating and farm accounts, answer support, meet accounting and fraud duties.
Legal bases
Contract (account and game), legal duty (invoicing, limited payment records), legitimate interest (security, anti-abuse), consent (sign-up box, immediate-delivery box at checkout).
Retention
Account and save: while the account exists, then deletion or anonymisation within a reasonable time after closure. Security logs: only as long as needed to stop abuse. Purchase evidence: as long as the law requires (typically several years for accounts).
Recipients
Us (publisher), OVH (hosting), Supabase (account and database), Stripe (payment), Cloudflare (Turnstile). No sale of customer files. No third-party targeted ads in the game.
Transfers outside the EU
Some providers may use servers outside the European Union. In that case, safeguards (standard clauses, Stripe / Supabase / Cloudflare measures) apply.
Your rights
Access, rectification, erasure, restriction, objection, portability, and a complaint to your data authority (in France: cnil.fr). To exercise a right: tcg.scp@gmail.com. A parent may write for a child’s account.
Close the account
Write to tcg.scp@gmail.com from the account address. We delete or anonymise game data that is no longer needed. Purchase records the law requires us to keep may remain for the legal period.