Privacy Policy
OPTCG Web Sim (optcgwebsim.com and its iPhone app). Last updated November 1, 2026.
OPTCG Web Sim ("we", "us") runs the card game simulator at optcgwebsim.com and its iPhone app. This page explains what we collect, why we collect it, and the choices you have.
The short version
- No ads, no third-party analytics, and no tracking across other apps or websites. We never sell your data.
- You can play without an account. If you make one, it holds your name, decks, games and ladder places.
- You can delete your account at any time: in the app (Settings, then Delete account), on your Profile on the website, or by asking us.
What we collect
- Your account. Your player name, which is public (it shows on boards and in games), and your password, which we store only as a one-way hash; we can't read it. When you sign up with an email address, we email you a one-time code. We keep only a keyed hash of the address (scrambled with a secret key), so one email makes one account; we don't keep the address itself. On the website you can also sign in with Google or LINE. We then receive an account ID (and from Google your email address and first name) and keep the ID and the email only as keyed hashes. We don't keep the name or the picture these services share.
- Your games. Your decks, games and replays, ladder and ranked results, Grand Line progress, coach reviews, your friends list and room invites.
- Membership. Memberships are bought on our website and paid through Stripe. We never see your card number. We keep your plan, its status, and the Stripe customer and subscription IDs needed to manage it. For a free trial we keep keyed hashes of your card's Stripe fingerprint, your browser's random ID and your network, so each person gets one trial. Emails about your plan (such as a trial ending) go to the address you gave at Stripe's checkout, which we read from Stripe when the email goes. A checkout you leave unfinished gets one email only if you said yes to offers by email (below). If you tell us what stopped you at checkout, we keep that answer, and any words you add, with your account.
- Deck tips and offers by email (optional). Only if you tick the box for them, at sign-up or on the Membership page: the email address you give there, which we keep encrypted with a key of our own, to send you deck tips and offers, at most one email a day. If you tick the box for offers on Stripe's checkout instead, we use the address you gave Stripe the same way. Every one of these emails has a one-click unsubscribe. Using it, or unticking the box, deletes the address we kept, and so does deleting your account.
- Contests on our website (such as Perfect 10). If you enter: the public livestream link you give us. If you win: the PayPal email address where we send your prize.
- Messages. What you send through the contact or bug-report forms, including the email address the contact form asks for, so we can reply.
- Technical data. Our servers receive your IP address. We use it to tell which country you're in (for regional features such as LINE sign-in), and we keep it only as keyed hashes, to keep the free games and free trials fair and to stop abuse. We store the country of an account's first sign-in. When a page opens we count the site you came from, the page you opened and whether you visited on an earlier day. That count uses no cookies and no IDs. If the game hits an error, it may send us a technical error report (the message, where in the code, the build and the screen), with no account attached.
- Notifications (iPhone app). If you turn notifications on, we store your device's push token, the kinds of notifications you chose and your time zone, to send you the friend invites, ladder rank changes, daily Beat the Pro and event news you chose.
- On your device. The website and the app keep your sign-in, settings and some decks in your device's local storage. We use one short-lived cookie only while you sign in with LINE. Google's sign-in button and Cloudflare may set their own cookies on the website.
How we use it
We use your data to run the game and your account, match you with other players, keep the ladders fair, run memberships, send the notifications you chose, answer your messages and pay contest prizes. We also use it to stop abuse (such as repeat free trials) and to fix bugs. We don't use your data for advertising.
Who we share it with
We share data only with the services that help us run the game, and only for that work:
- Cloudflare (network and security)
- Stripe (payments)
- PayPal (prize payouts)
- Apple (iPhone notifications)
- Resend (email delivery)
- Google or LINE, if you choose to sign in with them on the website
We may also share data when the law requires it. We never sell personal data.
How long we keep it
We keep your data for as long as your account exists. When you delete your account, we remove it and the data tied to it from the game at once and cancel any membership at once; copies in our backups are deleted within 30 days. Stripe keeps its own payment records as the law requires. We keep the hashed free-trial markers, so a deleted account can't restart a free trial. The address for deck tips and offers is deleted as soon as you unsubscribe or untick the box. Server logs are rotated regularly. They don't contain IP addresses; they can contain player display names as players set them.
Your choices
- Delete your account: in the app (Settings, then Delete account), on your Profile on the website, or ask us through the contact page.
- Notifications: turn each kind on or off in the app's Settings, or turn them all off in iOS Settings.
- Emails: use the one-click unsubscribe in any offer email, or untick the email box on the Membership page. We delete the address at once.
- Your data: ask us for a copy, or to correct it, through the contact page.
Children
The game isn't meant for children under 13, and we don't knowingly collect data from them. If you think a child has given us personal data, contact us and we'll delete it.
Changes
If this policy changes, we'll post the new version here with a new date.
Contact
optcgwebsim.com/contact, or email [email protected].