Privacy Policy
FS Card Rivals · Last updated: June 2026
1. Data Controller
The Data Controller for your personal data is:
Andrew Blewett
101 High Trees Close, Redditch, Worcestershire, B98 7XL, United Kingdom
Email: andyblewett991@gmail.com
This policy applies to FS Card Rivals on iOS, Android, and Web (the "App") and is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).
2. Personal Data We Collect
| Category | Examples | Purpose | Lawful Basis |
|---|---|---|---|
| Account data | Username, email address, hashed password | Account creation and authentication | Contract (Art. 6(1)(b)) |
| Game progress | Card collection, deck builds, battle history, XP, level, leaderboard position | Providing core game functionality | Contract (Art. 6(1)(b)) |
| Usage data | Session duration, features accessed, match outcomes, timestamps | Game improvement and balancing | Legitimate interests (Art. 6(1)(f)) |
| Technical data | Device type, OS version, IP address (transient) | Security, error diagnosis, fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Communications | Support emails, feedback | Customer support | Contract / Legitimate interests |
3. How We Use Your Data
- •To create and maintain your account and authenticate your identity
- •To save and synchronise your game progress, deck, and collection across devices
- •To operate matchmaking, ranked play, and global leaderboards
- •To detect and prevent cheating, fraud, and abuse
- •To respond to support requests and communicate service changes
- •To analyse aggregate, anonymised usage data to improve game balance and stability
4. Data Retention
| Data type | Retention period |
|---|---|
| Account and game progress data | Until account deletion, then permanently deleted within 30 days |
| Usage and analytics data | Aggregated and anonymised after 12 months; individual session logs deleted after 90 days |
| Support correspondence | 3 years from last contact, then deleted |
| Fraud/security logs | 12 months, unless required for ongoing legal proceedings |
5. Third-Party Services and Data Transfers
We use the following third-party processors. Each acts as a data processor under a written agreement with us:
| Processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Firebase (Google LLC) | Real-time database, authentication, cloud functions | USA (primarily) | Google's Standard Contractual Clauses + UK IDTA |
| Apple App Store / Google Play | App distribution, in-app purchases | USA | Governed by Apple/Google's own privacy policies |
We do not sell, rent, or share your personal data with any third party for advertising or marketing purposes.
6. Cookies and Local Storage
The App uses local storage and session tokens solely to maintain your logged-in state and save preferences. We do not use advertising cookies, tracking pixels, or third-party analytics cookies. No consent banner is required for strictly necessary storage.
7. Age Restrictions
The App is rated for ages 12 and over. We do not knowingly collect personal data from children under 13 (under 16 in certain EU member states). If you believe a child under 13 has created an account, please contact us at andyblewett991@gmail.com and we will delete the account promptly.
8. Your Rights Under UK GDPR
Under the UK GDPR and DPA 2018, you have the following rights:
- •Right of access – request a copy of the personal data we hold about you (Subject Access Request)
- •Right to rectification – request correction of inaccurate or incomplete data
- •Right to erasure ('right to be forgotten') – request deletion of your data where there is no compelling reason for continued processing
- •Right to restriction of processing – request we limit how we use your data in certain circumstances
- •Right to data portability – receive your data in a structured, commonly used format
- •Right to object – object to processing based on legitimate interests
- •Rights related to automated decision-making – we do not make solely automated decisions with legal or significant effects on you
- •Right to withdraw consent – where processing is based on consent, you may withdraw at any time without affecting prior lawful processing
To exercise any of these rights, email andyblewett991@gmail.com. We will respond within one calendar month. No fee is charged for reasonable requests.
9. Right to Lodge a Complaint
If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with the UK's supervisory authority:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113
10. Data Security
- •All data transmitted between your device and our servers is encrypted using TLS 1.2+
- •Passwords are hashed using bcrypt and never stored in plaintext
- •Access to production databases is restricted to authorised personnel only, using role-based access controls
- •Firebase Security Rules restrict data access to authenticated account owners
- •We conduct periodic reviews of our security practices
11. Changes to This Policy
We may update this Privacy Policy to reflect changes in law or our practices. Material changes will be communicated via an in-app notification or email (if you have provided one) at least 14 days before the change takes effect. Continued use of the App after that date constitutes acceptance of the updated policy.
12. Contact
For any data protection queries:
Email: andyblewett991@gmail.com
Post: Andrew Blewett, 101 High Trees Close, Redditch, Worcestershire, B98 7XL