Privacy Policy

Cardlab Studios is the data controller for the personal data processed on this site. Cardlab Studios is an independent development team working remotely.

Two channels are open for any question, request or application about our processing: the contact form on this site and the address [email protected].

Requests sent to the team are answered on behalf of Cardlab Studios; there is no separate representative or intermediary in between.

Account data: username, email address and the Argon2id hash of the password. Passwords are never stored in plain text.

Closed Alpha records: the redemption record of a playtester access key, the bug reports you send and the files you attach to them.

Contact form messages: name, email address, the reason you selected and the message itself.

Game session records: a device label, a build number and a timestamp.

Aggregate usage measurement: daily totals from first party counters. Raw IP addresses are not stored.

We process the data for these purposes: verifying accounts and managing closed Alpha access, debugging and monitoring release quality, replying to contact requests, checking for abuse and concurrent sessions, and measuring aggregate usage.

As a legal basis we rely on article 5 of Turkish Law No. 6698 on the Protection of Personal Data, namely the establishment and performance of a contract and legitimate interest.

Under the GDPR the same processing rests on contract (art. 6(1)(b)) and legitimate interest (art. 6(1)(f)).

Contact messages are kept for 90 days, bug report attachments for 90 days and operational logs for 30 days.

Account data is kept until the account is closed.

Once a period expires the related records are deleted.

We do not sell personal data and we do not transfer it for marketing purposes.

Our infrastructure uses Cloudflare for content delivery and tunnelling, and Tailscale for private network connectivity. These services are needed to carry the data.

We use no payment, advertising or third party analytics service.

This site uses strictly necessary cookies only: a session cookie, a CSRF cookie and a language preference cookie.

There are no tracking or advertising cookies, which is why we do not show a separate cookie consent banner.

Under article 11 of Law No. 6698 you have the right to learn whether your personal data is processed, to request information about it, to have it corrected or erased, to object to the processing and to claim compensation if you suffer damage.

The GDPR equivalents are the rights of access, rectification, erasure, restriction of processing, data portability and objection.

You can send your request through the contact form on this site or to [email protected]. Requests are answered within 30 days at the latest.

When this policy is updated the new text is published on this page and the effective date is updated.

Effective date: 20 September 2026.