This Privacy Policy explains what information Gormless Games LLC, the company that operates Fat TCG ("we", "us", or "our"), processes when you use the game, why, for how long, who helps us run the service, and the rights you have. We try to process as little as possible, and we want this page to describe exactly what happens.
1. Who Is Responsible for Your Data
Fat TCG is provided by Gormless Games LLC, a limited liability company registered in New Mexico, United States, with its registered address at 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States. Gormless Games LLC is responsible for the personal data described here (the "data controller"). You can reach us for anything related to your data at DSBx1@protonmail.com, in English or Spanish. Full company details are in our Legal Notice.
2. Information We Process
Account information
- Email address: used to sign in, recover your account, and send essential account messages (such as password resets). We do not send marketing emails.
- Username: a display name you choose.
- Month and year of birth: asked when you register, used only to confirm that you are 18 or older. It is never shown to other players.
- Password: stored only in a securely hashed form. We never see or store it in plain text.
Game data
- Your card and object collection, decks, coins, inventory, mail, cosmetics, missions, Story Mode progress and pet.
- Your friends list, trades, and the matches you play (opponents, moves, results).
- Profile details you choose to add, such as your avatar, title and favorite card.
- When you were last active in the game, used to show your friends whether you are online and to handle abandoned matches.
Technical and security data
- IP address and basic request data (such as the time of a request and the browser's user agent). Like any website, every request you make reaches our hosting and backend providers together with your IP address, and they keep it briefly in their server logs.
- Rate limiting: to protect the game against spam, cheating and automated abuse, we count recent requests per account and per IP address. These counters are deleted automatically after 2 hours. If a request exceeds a limit, a record of it may be kept for up to 30 days so we can tune the limits and investigate abuse.
- Match fingerprints: when you join a FatTCG match with Find a match, we store a one-way, salted hash of your IP address and of a random ID that the game saves in your browser. We never store the IP address itself. We use these hashes only to spot one person playing against their own second account to farm rewards or rating.
- Bot protection: the game page loads Cloudflare Turnstile, which protects the login, registration and Patreon sign-in forms by checking that you are a human. Cloudflare receives your IP address and technical browser signals to do this.
Optional linked accounts (only if you choose to link them)
- Discord: your Discord user ID, username, avatar and whether you are a member of our server, used to give you the matching team roles in the game. We check these once a day while your account is linked.
- Patreon: your Patreon user ID, name, profile picture, membership tier and the access tokens Patreon gives us, used to grant supporter rewards. We check your tier once a day while your account is linked, and every time you sign in with Patreon.
- Sign in with Patreon (Patreon Beta Testers and Tier IV Supporters only): if you create your account with Patreon instead of a password, we also receive the email address of your Patreon account, which becomes your account email, and your Patreon account is linked automatically. This kind of account can only be used while your Beta Tester or Tier IV membership is active.
3. Why We Use It (Legal Basis)
- To provide the game you signed up for (performance of a contract): your account, game data, matches, trades and support requests.
- To keep the game safe and fair (our legitimate interest in security and abuse prevention): IP addresses, rate limiting, match fingerprints, bot protection, server logs and enforcing our Terms of Service.
- With your consent: linking Discord or Patreon. You can withdraw it at any time (see section 7).
4. Who Can See Your Information
Any player can see your username, avatar, title, team roles, your public stats on leaderboards and in search, and your name in matches you play. Only your friends can also see your favorite card, collection, Fattydex, card sets, friends list and whether you are online, and trade with you. Your email address, IP address and linked account details are never shown to other players.
5. Service Providers
We do not sell, rent or trade your personal information, and we do not use it for advertising or profiling. We rely on these providers to run the game, and they process data only as needed to provide their service:
- Supabase (database, authentication and backend, hosted in the European Union).
- Our web hosting provider, which serves the website files and keeps standard access logs.
- Cloudflare (Turnstile bot protection).
- Resend (sending account emails such as password resets).
- Image and code hosting: card art and other images are loaded from catbox.moe and ImgBB, and part of the game code is loaded from esm.sh. When your browser loads these files, those services receive your IP address.
- Discord and Patreon, only if you link those accounts.
Some of these providers are based outside the European Economic Area, mainly in the United States, so your data may be transferred there. These transfers rely on the safeguards those providers offer, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.
6. Cookies and Local Storage
Fat TCG uses essential cookies and your browser's local storage only to keep you signed in, to remember your in-game preferences (such as sound, theme and collection settings) and to cache game data so it loads faster. We do not use tracking or advertising cookies, and we do not use analytics services. Because this storage is strictly necessary for the game to work, it does not require consent. Disabling it may prevent you from staying logged in.
7. How Long We Keep It
- Account and game data: for as long as your account exists. If you ask us to delete your account, we remove your personal information within a reasonable period, except records we must keep to comply with the law or to deal with fraud and abuse.
- Rate limiting counters: 2 hours. Records of requests that exceeded a limit: up to 30 days.
- Match fingerprints: as long as the match record they belong to.
- Server logs kept by our providers: for a short period set by each provider, typically a few days.
- Linked Discord or Patreon data: until you unlink the account. You can unlink Discord from your profile in the game. To unlink Patreon, email us or remove Fat TCG from the connected apps in your Patreon settings. An account created with Patreon cannot be used without its Patreon link.
8. Your Rights
Under data protection law (including the GDPR), you have the right to:
- Access the personal data we hold about you and receive a copy of it.
- Correct inaccurate data.
- Delete your account and personal data.
- Restrict or object to how we process your data, including processing based on our legitimate interests.
- Withdraw your consent for linked accounts at any time.
To exercise these rights, email DSBx1@protonmail.com from the address linked to your account, or contact us through our Contact page. We may need to verify your identity first, and we will reply within one month. You also have the right to lodge a complaint with the data protection authority in your country.
9. Security
We take reasonable technical measures to protect your information, including hashing passwords, encrypting connections, restricting access to account data and limiting abusive traffic. No online service can be completely secure, so we cannot guarantee absolute security, but we work to keep the data we hold safe.
10. Age Requirement
Fat TCG is intended only for adults aged 18 or older. It is not directed at children, and we do not knowingly collect information from anyone under 18. If we learn that an account belongs to a minor, we will remove it. See our Terms of Service for details on the mature content notice.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Significant changes will be communicated within the game or by email where appropriate.
12. Contact Us
Questions about this Privacy Policy or your data? Reach us through our Contact page or by email at DSBx1@protonmail.com.