Privacy policy

1. Data controller

The data controller is the team running the fan site narutokarty.pl. The site is not affiliated with the publisher of Naruto Mythos TCG.

For any data-related matters you can reach us via our Discord server (discord.gg/dAjT78fYPN).

2. Data we collect

Account data from Discord sign-in: Discord ID, username, avatar and (optionally) email. Sign-in happens only through Discord OAuth — we never store passwords.

Data you create on the site: collection and binder contents, wishlists, decks, marketplace listings, price watches and notifications.

Technical data: IP address used transiently for abuse prevention (rate limiting) and basic server logs.

3. Purposes and legal basis

We process data to provide site features (account, collection, decks, marketplace) — the basis is performance of a service at your request (Art. 6(1)(b) GDPR).

Technical and security data is processed under our legitimate interest in keeping the service safe and stable (Art. 6(1)(f) GDPR).

4. Cookies and browser storage

We do not use third-party advertising cookies or cross-site tracking tools.

In browser storage (localStorage) we keep your session token, selected preferences and your consent to this notice. The session token is required to stay signed in.

The app runs as a PWA and may cache resources (card images, public data) in your browser cache to load faster and work offline. You can clear this cache at any time in your browser settings.

5. Discord sign-in

Sign-in requires Discord authorization and membership of our Discord server. During sign-in we fetch only the basic profile data listed in section 2.

Data processing on Discord's side is governed by Discord's own privacy policy.

6. Affiliate links and external prices

The site shows prices and offers for products and cards sourced from external platforms (e.g. Allegro, eBay, online stores). Some links are affiliate links — clicking takes you to a partner site that uses its own cookies and privacy policy.

We do not share your narutokarty.pl account data with these partners.

7. Data sharing

We do not sell or rent your data. Data may be processed by infrastructure providers (hosting) only as needed to run the service, and by Discord for sign-in.

Your public profile, public binders and listings are visible to other users only when you choose to make them public.

8. Retention

Account data is kept until you delete your account. Technical data (logs, abuse counters) is kept short-term, only as long as needed for its purpose.

9. Your rights

You have the right to access, rectify, erase and restrict processing of your data, and to object.

The right to be forgotten (GDPR art. 17) can be exercised at any time by yourself — in your user profile (/en/profile) under the “Danger zone” section there's a “Delete account” button. The operation is irreversible and removes all associated data (collections, binders, decks, listings, likes, notifications, scanner history). Technical logs are anonymized automatically.

Other rights (rectification, restriction, objection) can be exercised by contacting us via Discord. You also have the right to lodge a complaint with a supervisory authority (in Poland: the President of the UODO).

10. Changes to this policy

We may update this policy as the service evolves. Significant changes will be announced on the site. The last-updated date is shown at the top of this page.