Privacy Policy

Iron & Ember is a card game with online play. This page says exactly what the game's server keeps about you, why, and how to have it removed. It is short because the game keeps very little.

Who this is

Iron & Ember is made by Christopher Quenneville, in Canada. For anything on this page, including a request to see or delete your data, write to christopher@quenneville.tech.

What is kept, and why

Your sign-in. Signing in with Google tells the game one thing: the opaque account identifier Google calls sub. The server keeps a SHA-256 hash of it, and uses it only to find your account the next time you sign in. Your email address, your Google display name and your Google profile picture are never requested, never stored and never logged.

What you make in the game. The name you choose, the title under it, the card you use as a picture, the Factions you mark as favourites, your Ember Stones, which cards you own, your unopened crates and the decks you have built. This is your account: it is what lets you sign in on another device and find your collection there.

Your record. How many online matches you have played and how many you have won, when the account was created, and when it was last used.

A session. A random token, so the game does not ask you to sign in every time you open it. It expires, and signing out on a device forgets it.

Match logs. When two people play online, the server writes down the deal, the two decks, the moves and the winner, so a fault or a dispute can be replayed. A match log holds the name each player is called across the table and nothing else about either of them — no account identifier, no sign-in, no address.

What is not kept

• No email address, from any source.
• No password: the game has none, and never asks for one.
• No payment details. Purchases, when they exist, will be handled by the store you installed the game from, and the game will never see a card number.
• No chat. There is none.
• No advertising identifier, no advertising, and no third-party analytics or tracking of any kind.
• No contacts, photos, location, microphone or camera. The game asks for none of these permissions.
• Your IP address is used to carry the connection and is not written down or kept after it closes.

Who it is shared with

Nobody. Nothing here is sold, rented or handed to an advertiser or a data broker, and none of it leaves the game's own server except to the two places that have to hold it:

• Google Cloud, which runs the server and the database the account is stored in, on our behalf and under its own terms.
• Google, which you sign in through, and which tells the game only the identifier described above. What Google collects when you sign in is covered by Google's own privacy policy.

Data may be disclosed if the law requires it.

The other player

When you play a match, the other player is shown the name you chose, your title, your picture and your record. Nothing else about you reaches them.

How long it is kept

Your account is kept while you use it. Ask for it to be deleted and it is deleted — the account, the sign-in, the collection, the decks and the name, which then becomes free for anyone else to take. Match logs are kept for up to a year and carry no sign-in.

Your rights

Write to christopher@quenneville.tech and ask for a copy of what is held about you, a correction, or deletion. There is nothing to prove and no form to fill in; sign in on the account you are asking about, or say what name it uses. Requests are answered within 30 days. If you are in the EU or the UK, this is your right of access, rectification and erasure under the GDPR; if you are in Quebec, it is your right under the Act respecting the protection of personal information in the private sector.

Children

Iron & Ember is not directed at children under 13, and the game does not knowingly keep an account for one. If you believe a child has made an account, write to the address above and it will be deleted.

Changes

If what the game keeps ever changes, this page changes with it and the date at the top moves. The date is the whole of the version history: this page is served from the game's own server, out of the same source the server is built from.