Legal · Version 1.2 · Effective 12 October 2026

Privacy policy

In short
  1. 01We collect your email, your consent choices, how you play and the feedback you send, to run the playtest and improve the game.
  2. 02Marketing emails only if you ticked the box. You can switch them off any time.
  3. 03Site analytics are anonymous and cookie-free. The only cookie is the one that keeps you signed in.
  4. 04We never sell your data. Ask us to see or delete it any time.

01What we collect

DataDetails
Sign-upEmail address, the policy and terms versions you accepted, your marketing choice and when you made it, how you found us (referring site or campaign), country derived from your IP address.
Tester accountAccount ID, invite wave, sign-in times and the device and browser you sign in with.
GameplayMatches you play: fighter, cards drafted and played, dice rolls, positions, results, match length, game version.
FeedbackWhat you write, your rating, an optional screenshot of the screen you were on, and the game context at that moment (page, match, turn, last cards, screen size).
EmailsDelivery status of the emails we send you, so we can fix bounced addresses.
Site analyticsAnonymous page views and referrers via Umami. No cookies, no personal identifiers, no cross-site tracking.

We don't collect payment details during the playtest. If you later buy the deck, payments are handled by Stripe and covered by an updated version of this policy.

02Why we use it

PurposeLegal basis (GDPR art. 6)
Running the playtest: sign-up, invites, sign-in, the game itselfPerforming our agreement with you: the tester terms (6(1)(b))
Confirming your email, playtest updates and one launch noticeOur legitimate interest in running the playtest you signed up for (6(1)(f))
Improving rules, balance and the site from gameplay data and feedbackOur legitimate interest in making the game good (6(1)(f))
Launch offers and newsYour consent (6(1)(a)), only if you ticked the box
Security, abuse prevention and keeping records of consentLegitimate interest and legal obligations (6(1)(f), 6(1)(c))

Where we rely on legitimate interest, you can object at any time (see section 06).

03Who we share it with

We use these service providers to run Base. They process data only on our instructions under data processing agreements.

ProviderWhat forWhere
SupabaseDatabase, sign-in and screenshot storageEU
ResendSending sign-up, invite and update emailsUSA, under EU Standard Contractual Clauses
UmamiAnonymous site analyticsEU
VercelHosting the website and gameEU

When data is transferred outside the EU/EEA, we rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. We never sell your personal data or share it for advertising.

04How long we keep it

  • Unconfirmed sign-ups: deleted after 30 days.
  • Tester accounts: for the length of the playtest and 12 months after it ends, unless you ask us to delete yours sooner.
  • Gameplay data and feedback: anonymised when your account is deleted. We keep the game statistics, not who played.
  • Marketing: until you unsubscribe. We keep a record of your consent and withdrawal for 3 years to show we respected it.
  • Site analytics: anonymous from the start; kept for 24 months.

05Cookies

We use one essential cookie to keep you signed in to the playtest. It isn't used for tracking and doesn't need consent. Our analytics don't use cookies. There are no advertising or third-party tracking cookies.

06Your rights

You can ask us to show you your data, correct it, delete it, restrict or object to how we use it, or give it to you in a portable format. You can withdraw consent for marketing at any time with the unsubscribe link or in your tester settings. This doesn't affect anything before you withdrew.

Email contact@grolea.com. We reply within one month. If you're unhappy with how we handle your data, you can complain to the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi) or your local supervisory authority.

07Security

Data is encrypted in transit and at rest with our providers. Access is limited to the people running the playtest. Invite links are single-use and expire after 7 days.

08Age

The playtest is for people aged 16 or older. If you believe someone younger has signed up, tell us and we'll delete their data.

09Changes

If we change this policy we'll update the version and date at the top, and email you about significant changes before they apply.

10Who we are

Grolea Oy, VAT ID FI32114512, Juutinraumankatu 7 A 4, 00220 Helsinki, Finland. Email contact@grolea.com.

Grolea Oy is the controller of your personal data under the EU General Data Protection Regulation (GDPR).

Tester terms →
Privacy policy — Base