Privacy
Draft · pending review by a qualified lawyer
Last updated: 2026-10-23 (UTC) · Version 2026-10-23.2
What we store. When you open a pack: your public wallet address and the on-chain records of the packs and payouts linked to it, which are public on Solana anyway. We also keep server access logs that include IP addresses (see below).
Email sign-up. If you sign up with your email (the "Get access" form), we store your email address, the date you signed up, where you signed up (for example, the landing page) and the version of these terms you accepted. Nothing else: not your IP address, not your name. We use it only to email you when your access is ready and to send important updates about your access. We never sell or share it, and it stays on our own server. Our legal basis is your consent, which you can withdraw at any time: message us (see Contact below), and we delete your address. If you signed up under an earlier version of this page, your consent stays valid for this same use and nothing changes for you. Database backups are kept on our server for 14 days, so a deleted address can remain in a backup for up to 14 days. We delete the whole list at the latest 12 months after it was created.
What we don't store. We don't keep your name, any account password or any tracking profile. There are no ads and no third-party trackers. Fonts are hosted on our own servers.
IP addresses and logs. Your IP address is processed for security and rate limiting. For the email sign-up and the demo pull, the per-address limit keeps only a salted one-way hash of it (never the address itself) for up to 1 hour. Our general limit on all requests, and the other rate limits, keep the address itself for about a minute in our rate-limit store. It is never written to our database. It is also stored in our web server access logs, which are rotated daily and deleted after 7 days at most. Our hosting provider also processes each request to run the server, and our Solana RPC provider (Helius) receives requests from our servers only, never from your browser directly. If a wrong password is entered for the password-protected part of the site, the IP address is sent to our team as a security alert through Telegram, kept in our security log for up to 5 weeks, and blocked for 15 minutes after 5 failed tries. IPs are used only for security and rate limiting, are never sold, and are not shared beyond what this page describes.
Third parties. When you open a pack, Collector Crypt, our vault and fulfilment provider, processes the order under its own privacy policy, published by Collector Crypt. Your wallet provider and the Solana network also see your transactions. PlayTCG is operated independently.
Public by design. Transactions on Solana are public. Never put personal info in a memo or a wallet name.
Your rights. You can ask to see, correct or delete your data, or object to its use, by messaging us (see Contact below). You can also complain to your data protection authority.
Contact. Email contact@playtcg.digital (main address) or playtcgteam@mail.grokbot.com, or message @JustPlayTCG on X. We will never ask for your keys.