Privacy Policy
Last updated: 11 October 2026
This policy explains what personal data is processed when you play Football Card Duel (the website footballcardduel.com and its mobile apps, together the "Game"), why, and what rights you have. It covers the information duties under the EU General Data Protection Regulation ("GDPR") and the Turkish Personal Data Protection Law No. 6698 ("KVKK").
1. Controller
The controller of your personal data is Muhammet Ahmet Özkanlı (developer of Football Card Duel).
Contact: info@footballcardduel.com
2. What data we process
| Data | When |
|---|---|
| Player name | The nickname you choose when you create an account. You don't have to use your real name, and we recommend you don't. |
| Year of birth | When you create an account. Used only to apply the age limit (under-13s can't join) and to show under-18 players the notices they need; we don't ask for your full date of birth. |
| Consent record | The date you confirmed, when creating your account, that you have read this notice and accept the Terms of Service, and the version you agreed to. |
| E-mail address and password | Only if you link your account (optional). Your password is never stored in plain text, only as a one-way hash (scrypt). |
| Google account details | Only if you use "Continue with Google": your Google account ID, e-mail address and (to suggest a player name) your name are received from Google. Your Google password never reaches us. |
| Game data | Card collection, decks, in-game currencies (Gold, Diamonds, tokens), level and XP, match results and statistics, ranked rating, Season Pass progress, in-game shop and market transactions, redeemed gift codes, your chosen profile photo (a player card) and cosmetics, game settings (sound, language, etc.) and inbox messages. |
| Club data | The club you belong to, your role, your club war participation and the messages you write in club chat. |
| Technical data | When you connect, your IP address and browser/device information are processed by the server to establish the connection. Your IP address is not stored in the game database; it may appear briefly in our infrastructure providers' security logs. |
| Purchase data | If you buy something with real money, the payment is processed by the app store (e.g. Google Play). We never receive your card details; we only store the transaction ID needed to verify the purchase and the item you bought. |
We don't show ads, don't track you for advertising or marketing, don't use third-party analytics and don't sell your personal data. We don't request device permissions such as location, contacts, photos or microphone.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6(1) · KVKK Art. 5(2)) |
|---|---|
| Creating your account, running the Game, saving your progress, operating online matches, clubs, rankings and the market | Performance of a contract (GDPR 6(1)(b) · KVKK 5/2-c) |
| Letting you sign in on another device (e-mail login) | Performance of a contract (GDPR 6(1)(b) · KVKK 5/2-c) |
| Preventing cheating, fraud and abuse, keeping the Game and servers secure, fixing errors | Legitimate interests (GDPR 6(1)(f) · KVKK 5/2-f) |
| Applying the age limit and keeping the consent record | Legal obligation and legitimate interests (GDPR 6(1)(c), (f) · KVKK 5/2-ç, f) |
| Verifying and recording purchases, responding to legal requests | Legal obligation and contract (GDPR 6(1)(c), (b) · KVKK 5/2-ç, c) |
Your data is collected automatically while you use the Game and from what you enter yourself when linking your account.
4. What other players can see
The Game is online and competitive. Your player name, profile photo and frame, level, ranked rating and league, club, card back and match statistics are visible to other players (in matches, rankings, club pages and the market). Club members can see your club chat messages. Your e-mail address is never shown to other players.
5. Service providers and transfers
We share data only with the providers needed to run the Game, limited to that purpose:
- Google Cloud (Google Cloud EMEA Ltd.): game servers and database, located in Frankfurt, Germany (European Union).
- Sign in with Google (Google LLC): verifying your identity if you use "Continue with Google".
- Resend: sending verification code and support e-mails (your e-mail address and the e-mail's content).
- Google Fonts: the Game's fonts are loaded from Google's servers, which receive your IP address in the process.
- App stores (e.g. Google Play): app distribution and real-money purchases.
For players in Turkey, storing data on servers in Germany is a transfer abroad; it is necessary to provide the service and is carried out in line with Article 9 of the KVKK. Apart from this, we don't share your data with third parties unless legally required (e.g. a request from a competent authority).
6. Information stored on your device
The Game doesn't use tracking cookies. Your browser's/app's local storage only keeps what the Game needs to work: your session key (so you stay signed in), your language choice, the game mode you picked on the home screen and which new cards you have already looked at. You can clear it by deleting your browser data; if you play as a guest you will then lose access to that account, which you can prevent by linking it to an e-mail address.
7. Retention
- Account and game data: for as long as your account exists. When you delete your account it is removed from the game database immediately.
- Club chat messages: deleted automatically after 24 hours.
- Backups: database backups taken to prevent data loss are kept for at most 14 days; deleted accounts disappear from backups after that.
- Market and purchase records: may be kept, no longer linked to the deleted account's identity, to prevent fraud and meet legal obligations.
8. Account and data deletion
In the Game: Settings → Account → Delete my account. You confirm by typing your player name. Your account and game data are deleted immediately and permanently; this can't be undone.
If you can't open the Game: e-mail info@footballcardduel.com with the subject "Account deletion request", your player name and (if linked) your account's e-mail address. Once we have confirmed the account is yours it is deleted within 30 days.
9. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing and to data portability (GDPR), and the rights listed in Article 11 of the KVKK (to learn whether and how your data is processed, who it was transferred to, to request correction or deletion, and to claim compensation for unlawful processing). Send requests to info@footballcardduel.com; we answer free of charge within 30 days. You may also lodge a complaint with the data protection authority of your EU country or with the Turkish Personal Data Protection Board.
10. Children
The Game is not directed at children under 13; if you are under 13, don't create an account. If you are under 18, use the Game, and especially real-money purchases, only with permission from a parent or legal guardian. If we learn that an account belongs to a child under 13, we will delete it.
11. Security
All connections between the Game and our servers are encrypted (HTTPS). Passwords are stored as one-way hashes, server access is limited to authorised people and the database is backed up regularly. No system is 100% secure; in the event of a data breach we will notify affected people and authorities within the legal deadlines.
12. Changes and contact
We may update this policy from time to time; the current version is always published on this page, and we announce important changes in the Game. Questions: info@footballcardduel.com