Privacy Policy
MorphCard is a card game made by CredoCode, an independent developer ("we", "us"). This policy explains what information MorphCard collects, why, and the choices you have. Questions or requests: credocodes@gmail.com.
The short version
- Playing offline (tutorial, the bot, Pass & Play) sends nothing to us. Your progress stays in your browser.
- An account (email sign-in) keeps your progress on our server: your email, player name, Coins, cards, deck, cosmetics, stats, friends, rating and match results.
- We ask your age when you create an account, but your age never leaves your device: we only keep yes/no answers for "13 or older" and "17 or older".
- No advertising networks, no analytics trackers, and we never sell your information.
- Your player name and rating appear on public leaderboards once you play a ranked match.
- You can delete your account in the game at any time.
1. Playing as a guest (no account)
You can play the tutorial, matches against the bot and Pass & Play as a guest, without an account. Guests are asked one question, whether they are 17 or older; the answer is saved only on your device and only decides whether promotions for 17+ games are shown. Guests play the starter deck and can't buy card packs. Your Coins, cosmetics, stats, tutorial progress and settings are saved only in your browser's local storage on your device. We cannot see them. Clearing your browser's site data, or using "Reset progress" on the main menu, removes them.
2. Information we collect with an account
If you sign in with your email, we collect:
- Email address, to send your sign-in codes and identify your account.
- Player name and friend code, which other players see.
- Age: when you create an account you set your age with a slider. The game uses it on your device to work out two yes/no answers, "13 or older" (required for online play) and "17 or older", and only those answers are sent to us. We never store your age or birthday.
- Game progress: your Coins, the cards you own, your deck, cosmetics you own and use, match statistics and whether you finished the tutorial. These are kept on our server so they follow you between devices, and so they can't be edited to cheat.
- Rating: your ranked rating and your ranked wins, losses and games played.
- State (optional): if you choose one in your profile, the US state you picked (or "Outside the US"), used only for state leaderboards. We never work it out from your connection.
- Matchmaking: while you search for a ranked match, your rating and the time you started searching. This is deleted when you are matched or stop searching.
- Friends: the friend requests you send and accept.
- Matches: who played, the deck each player used, the moves and game state, the result and when it was played.
- Online status: whether you are currently online, shown to your friends while you are connected. It is not stored.
- Sign-in session: a session token stored in your browser so you stay signed in.
- Technical data: like any website, our service providers process your IP address and basic browser information when your device connects, and keep it in server logs for a limited time for security and abuse prevention.
3. How we use it
- To run your account and online play: sign-in, saving your progress, card packs and purchases with Coins, friends, challenges, ranked matchmaking, ratings, leaderboards, live matches and head-to-head stats.
- To keep matches fair: our server checks every move against the game's rules and deals cards so neither player can see the other's hand.
- To decide whether to show promotions for 17+ games (see section 4).
- To protect the service: preventing abuse, investigating problems and keeping accounts secure.
We do not use your information for advertising profiles, and we do not use analytics or tracking tools.
4. Promotions for our other game
MorphCard shows promotions for Observation Post 7, another CredoCode game rated Mature 17+. They appear only for players who are 17 or older: signed-in players whose account says so, or guests who answered that they are. These are our own promotions: no advertising network is involved, and no information about you is shared for them.
5. Who we share information with
We share information only with the service providers that run MorphCard, and only what they need:
- Supabase: hosts our database, accounts and game server (United States).
- Resend: delivers sign-in emails, so it receives your email address.
- GitHub Pages: hosts this website.
- jsDelivr and Google Fonts: deliver code and fonts that the game loads, so they see your IP address.
- itch.io (or another store) if you play there: their own privacy policy covers your use of their site.
Other players can see your player name, friend code, online status, and the results of matches you played against them. Once you have played a ranked match, your player name, rating and number of ranked games appear on the world leaderboard, on your state's leaderboard if you chose a state, and on your friends' leaderboards. We may disclose information if the law requires it. We never sell your personal information or share it for cross-context behavioral advertising.
6. Legal bases (EEA and UK)
We process your information to provide online play you asked for (contract), to keep the service secure and fair (legitimate interests), and where needed with your consent.
7. How long we keep it
We keep your account information while your account exists. When you delete your account (Online → Delete account), we delete your email, profile, progress (Coins, cards, deck and cosmetics), rating, leaderboard entry, friends and matches. That includes those matches disappearing from your opponents' history. Providers' server logs are kept for a limited time and then deleted. Browser saves stay on your device until you clear them.
8. Children
Online play is for players aged 13 and older, and the sign-in screen does not let anyone under 13 create a profile. Offline play collects nothing. If we learn that a child under 13 has an account, we will delete it. Parents can contact us at the address below.
9. Your rights
Depending on where you live, you can ask to access, correct, export or delete your information, or object to how we use it. California residents have the right to know, delete and correct their information and are not discriminated against for using these rights. You can delete your account yourself in the game, change your name, age range and state with "Edit profile", or email us. We reply within 30 days. You can also complain to your local data protection authority.
10. Security
Connections use HTTPS. The database only lets players read their own friendships and matches, and full game states (including both hands) can only be read by our server. No system is perfectly secure, but we work to protect your information.
11. International transfers
Our providers store and process information in the United States. Where the law requires, they use approved safeguards such as standard contractual clauses.
12. Changes
If we change this policy, we will update the date above. For important changes we will also let you know in the game.
13. Contact
CredoCode · credocodes@gmail.com