Privacy Policy

This document describes how Monarch Hoard ("the Service") collects, uses and protects your personal data, in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1. Data Controller

Monarch Hoard is operated by Roberto Terzoli, based in Italy. For any request regarding the processing of your personal data, you can write to: monarchhoard@outlook.com.

No Data Protection Officer (DPO) has been appointed, as it is not mandatory for a service of this size and nature.

2. What Data We Collect

• Account data: email address, password (never stored in plain text, only as a secure hash), display name (required, shown in leaderboards)
• Collection data: owned cards, quantities, wishlist status, personal notes, serial numbering, grading information
• Game data: Memory and Quiz scores, associated with your chosen display name and visible on the in-app public leaderboards
• Language preference
• Minimal, temporary technical data: IP address, used only in server memory (never saved to the database) to prevent abuse of login/registration (rate limiting)
• Technical cookies: session cookie (required to stay logged in) and language preference cookie (valid 1 year)

We do not use profiling, advertising or third-party tracking cookies, and we do not use analytics tools (e.g. Google Analytics). For this reason, no cookie consent banner is required.

3. Why We Collect This Data (Purposes and Legal Basis)

• To provide the requested service (create account, manage your collection, save scores) - legal basis: performance of a contract (Art. 6(1)(b) GDPR)
• To prevent abuse and protect accounts (rate limiting, password hashing) - legal basis: legitimate interest (Art. 6(1)(f) GDPR)
• To send you account verification and password recovery emails - legal basis: performance of a contract

4. Who We Share Your Data With

Your data is processed only to the extent necessary to run the Service, through technical providers acting as data processors:

• Hosting and database provider (currently being migrated to Render)
• Google LLC, for sending verification/reset emails via Gmail
• Cloudflare Inc., for delivering card images (no personal data is involved here: images are game assets, not linked to your account)

We do not sell or share your data with third parties for marketing purposes.

5. International Data Transfers

Some technical providers (Google, Cloudflare) are based in the United States. These transfers take place under safeguards recognised by EU law (e.g. standard contractual clauses or adherence to the EU-US Data Privacy Framework).

6. How Long We Keep Your Data

We retain your data for as long as your account remains active. If you delete your account (available in Settings), your collection data is erased and your account is permanently and irreversibly anonymised.

7. Your Rights

• Access: view your data in Settings
• Portability: download a CSV file of your entire collection at any time (Settings -> Data & Backup)
• Rectification: correct your display name and contact email
• Erasure: permanently delete your account yourself (Settings -> Danger Zone)
• Objection and restriction: contact us at any time at monarchhoard@outlook.com
• Complaint: you have the right to lodge a complaint with your national data protection authority (in Italy, the Garante per la protezione dei dati personali - www.garanteprivacy.it) if you believe the processing violates the law

8. Minors

The Service is not specifically designed for children. If you are under 14, please use the Service only with the consent of a parent or guardian.

9. Security

Passwords are never stored in plain text (only as a secure hash). Communications with the site are protected via HTTPS. We take reasonable measures to protect your data from unauthorised access.

10. Changes to This Policy

We may update this policy from time to time, for example when new features are introduced. We recommend checking it periodically. The last update date is shown below.

Last updated: 24/08/2026