Privacy Policy

Card Battle Lab · last updated 2 October 2026

What this app collects

Four separate things. They are collected for different reasons and are not joined together.

1. Your match history (only if you sign in). When you sign in with Patreon and play a match, the result is saved to your account so the app can show you your own Results, progress and XP. This is what makes the account features work, so it is not optional while you are signed in. If you never sign in, no match history leaves your device.

What is stored: the result of the match, how it ended, how long it took, which game mode and which bot, which shipped deck was used, and your Patreon account id and name. Signing in requests only your identity from Patreon; your email address is not requested and is never stored.

2. Anonymous usage and diagnostic data (optional, can be turned off). Counts only, so the app's problems can be found and fixed: the app opened, the game engine loaded or failed to load, a match started, finished or was abandoned, a browser error, an API failure. Each one carries a few coarse labels such as the app version, the game mode, the bot, a rough screen-size bucket, and how a game ended.

This stream sets no cookies and has no persistent identifier. Events in one page visit share a random session id that is generated in memory and is destroyed when the page closes. There is no way to link one visit to the next, or one device to another. It is never joined to your account, and it is collected the same way whether you are signed in or not.

Turn it off in Options › Privacy › Anonymous usage data. Off means nothing is sent and nothing is queued, immediately, not on next launch.

3. Page traffic and speed (Cloudflare Web Analytics). Cloudflare's own cookieless page analytics: page views, and how quickly pages render for real visitors. It sets no cookies and builds no visitor profile.

4. Deck lists. When you save a complete, legal deck (in your browser or in your cloud slots), and when a deck is shared or played, its card list is stored, together with how often it won and lost. This powers deck codes, share links, the deck catalogue and the Community win rates. Deck names and notes are never sent: a deck is labelled with a name the app generates from its cards. Unfinished decks are not sent, and a deck that is never saved complete, shared or played stays in your browser.

Each of your decks is Public or Private, and you can change it in the Deck Manager at any time. Decks you build from scratch, and copies of the built-in decks, start Public. Decks you import (pasted text, a deck code, a shared deck link, Quick Add) start Private, and so do decks saved before this setting existed. Private decks are never listed. (If someone else makes the exact same card list Public, that list can appear, never linked to you.)

If you are signed in when you save, the deck is also linked to your account, so the app knows which decks are yours. That link is stored but never shown to anyone, and it is deleted with your account.

Tournament decks in the Public gallery show the player's name, the event, placement, region and date, as published in public event coverage. If you are one of those players and want your name or deck removed, contact [email protected].

If you are signed out, your browser makes one random key the first time you save a deck and keeps it in its local storage. It is sent only with deck saves, so that a deck you made Public from this browser can later be made Private again from the same browser. We store only a one-way hash of that key, never the key itself, and it is not used for anything else: it is not part of the usage data, never linked to an account and never shown to anyone. Clearing your site data removes the key; decks you made Public before that then stay listed, because nothing can prove they were yours. If your browser does not allow local storage, decks you save while signed out are always sent as Private. When you sign in and make a deck Private, this browser's key, if it has one, is sent with that save so a Public save of the same deck from this browser while signed out is taken back too; the account and the key are not linked in storage.

What is never collected

Not by any of the usage streams above, and this is enforced in code, not just policy:

Who processes it

Cloudflare hosts the site and stores all of it (Pages, D1, R2, Analytics Engine, Web Analytics, Turnstile). Patreon provides your identity and membership status when you choose to sign in. Nobody else.

Links out to TCGplayer are affiliate links. Those sites set their own cookies on their own domains once you click through, under their own policies.

How long it is kept

Your choices