Privacy policy

October 26, 2026

This policy explains what WikiMasters collects and why. We collect as little as the game needs.

What we collect

Account data: username, email address, display name and Google profile photo (when provided).
Game data: your cards, coins, packs opened, duels, tags, pins and achievements.
Technical data: session cookies, IP address and browser user agent for security and abuse prevention.

To run your account and the game, to send account emails (sign-in links), to rank players on the public leaderboard and to protect the Service from abuse.

Your username, display name, score, duel wins, pinned cards and achievements appear on your profile and the leaderboard. Your email is never shown.

Cloudflare hosts the Service and its database. Resend delivers account emails. Card images load directly from Wikimedia servers. Optional analytics use PostHog’s EU cloud region.

Essential storage keeps you signed in and remembers your theme and privacy choice. If you allow analytics, PostHog EU measures page visits using an analytics identifier stored in your browser and your internal account ID when signed in. It does not record sessions or collect form fields, messages, email addresses or URL query parameters. You can decline or withdraw consent using Privacy choices. No advertising cookies. With your consent, Google Analytics 4 also measures page visits using first-party analytics cookies (up to 90 days). Advertising features and enhanced measurement are disabled. We send sanitized page URLs, without account IDs, query parameters or message content. Google processes analytics data under its own infrastructure; the EU hosting statement applies only to PostHog. Withdraw consent through Privacy choices to stop tracking and remove GA cookies.

We keep your data while your account exists. When you ask us to delete your account, we remove your personal data within 30 days.

You can ask to access, correct, export or delete your data, or object to its use, by writing to hello@wikimasters.org. You can also complain to your data protection authority.