Privacy Policy

Smashmaker is responsible for the service described here. For privacy questions, access requests or account deletion, email privacy@smashmaker.cards. You can use this address without signing in.

Account information: a user identifier, email address, username, profile image, language and account preferences. Firebase Authentication handles sign-in, including email/password and Google Sign-In. Guest sessions also receive an identifier. Passwords are handled by Firebase rather than stored in the Smashmaker application database.

Content and gameplay: deck and card names, descriptions, images, visibility settings, saved games, votes and related timestamps. Information is required when needed to provide the feature you choose; optional profile fields and uploads are your choice.

Usage and technical information: first-party events include page visits, searches typed into the deck catalog, clicks, swipe activity, timing, device category, session identifiers and the relevant deck or card. These events can be linked to your registered or guest user identifier. Hosting and infrastructure providers also process technical connection and security information such as IP addresses.

Support messages: the subject, message, attachments, account identifier, username, email address, language and time supplied with a report. Please avoid including unnecessary personal or sensitive information in messages or uploaded content.

We use account and gameplay information to authenticate you, maintain preferences, save your choices, manage decks, and personalize the order of the public feed based on completed decks. This supports the service you request.

We use technical, analytics and moderation information to understand use of the service, improve features, prevent abuse, investigate reports and protect users. Where applicable, these purposes rely on legitimate interests in operating and securing the service, subject to your rights. We process information to meet legal obligations where required, and seek consent where applicable law requires it.

Smashmaker does not make decisions with legal or similarly significant effects about you. Automated moderation can flag or remove submitted content; you can contact us to request review.

Public decks, their cards, creator usernames and profile images can be viewed by others and indexed or copied by search engines. Unlisted content is accessible to anyone with its link; it is not private. Private content is intended to be restricted to its owner. Games and reviews have their own visibility settings.

Your account email is not part of the public profile response. Choose a public username and profile image that you are comfortable sharing. Removing content from Smashmaker does not automatically remove copies, downloads or search-engine caches held by other parties.

If you choose Google Sign-In, Firebase receives the information needed to authenticate your Google account, including its identifier, email, display name and profile image. Smashmaker uses the resulting identity and profile information for your account. The sign-in integration does not request access to your Gmail messages, Drive files or contacts.

An administrator-only research feature accesses the operator’s authorized Search Console property and Google Ads keyword-planning data using a server-side service account. It stores search queries, landing pages, site-performance metrics, estimated keyword volumes and measurement periods to research deck topics. Visitors are not asked to connect their own Search Console or advertising accounts.

Google account information and research data are used for the features described in this policy, not sold or used to train AI models. Account credentials and access tokens are not published. Access to Google API research data is restricted to authorized administrators and the infrastructure needed to provide the feature.

The service uses Google Firebase for authentication; Vercel for hosting and Web Analytics; Neon for application database storage; Cloudflare R2 for uploaded and processed images; Modal for image processing; Z.ai for automated content moderation; ImprovMX for forwarding messages sent to our public email addresses; and the configured email provider for support correspondence. These providers process information needed for their respective tasks.

Submitted card or deck text and images may be sent to Z.ai for moderation. Images may be processed through Modal to generate display assets. These tasks concern the content you submit, rather than your Google account credentials. Authorized administrators may review flagged content and support requests.

We may also disclose information when required by law or necessary to address fraud, security incidents or legal claims. Public content is shared according to its visibility setting. External images and links may cause your browser to contact other websites, whose own policies apply.

Providers may process information outside your country, including outside the European Economic Area. Contact us for information about the providers, processing locations and transfer safeguards relevant to your information.

Firebase uses browser storage to maintain authentication. Smashmaker also uses browser storage for preferences and session behavior, and a secure, HTTP-only sign-in cookie on the production site to support personalized server-rendered pages. That server cookie lasts up to 14 days and is cleared from the browser on logout.

First-party analytics use a browser-session identifier and may link activity to your account or guest identifier. These analytics are separate from Vercel Web Analytics, which provides aggregated traffic statistics without third-party analytics cookies. Blocking storage or analytics requests can affect measurement, and blocking authentication storage can prevent account features from working.

You can manage cookies and site storage in your browser. Clearing guest-session storage or signing out can affect access to unsaved or guest activity. Contact us to exercise applicable rights concerning analytics linked to your identifier.

Account, content and saved-game records are retained to provide your account and the activity you keep on the service, until removed through available controls or an account-deletion request. First-party analytics, moderation and support records are retained for service analysis, handling reports, security investigations and applicable legal obligations. They do not currently have a fixed automatic deletion schedule.

We assess deletion requests against the purpose of the records and any remaining legal or security need. Deletion can include removal or anonymization of associated information. Copies in provider backups or caches may remain until their normal replacement or expiry. We cannot remove copies independently retained by other people.

To request account closure or deletion, email privacy@smashmaker.cards with enough information to identify the account. We may ask for proportionate verification of ownership before acting. Do not send passwords or access tokens.

Depending on applicable law, you may request access, correction, deletion, restriction, portability or an objection to processing, and withdraw consent where processing relies on it. You can edit available profile fields and remove your own decks through the application. Contact us for other requests, including data associated with a guest session.

We respond within the periods required by applicable law; under the GDPR this is generally one month, with extensions where permitted. You may complain to the data-protection authority in your country or, where applicable, the authority where you live, work or believe an infringement occurred.

Smashmaker is an entertainment service and is not designed to collect personal information from young children. Use must comply with applicable age and consent requirements. If you believe a child has provided information without the necessary authorization, contact us so we can investigate and take appropriate action.

Do not upload confidential information about yourself or other people, or content that unlawfully exposes personal information. Entertainment preferences can be personal; consider the visibility of your decks and reviews before sharing them.

We update this page when the described practices change and revise its date. Material changes will be brought to users’ attention where required. Privacy requests can be sent to privacy@smashmaker.cards; general service questions can be sent to contact@smashmaker.cards.