Privacy Policy

Football Cards Royale · Last updated: 2 May 2026

This Privacy Policy describes how Football Cards Royale (the “App”, “we”, “us”) collects, uses, and shares your information when you use our mobile application.

1. Information we collect

We collect the minimum data needed to operate the App.

• Account identifiers — when you sign in with Apple or Google we receive your Apple ID / Google ID (a stable opaque string), your email address, and an optional display name. If you continue as a guest, we generate a random anonymous identifier on your device; no email or personal info is collected.
• Gameplay data — your in-app username, club name, owned cards, coin balance, match history, achievements, friend list, and progression stats.
• Purchase data — when you buy in-app coin packs we receive a transaction receipt from Apple. We store the transaction ID, the product purchased, the price (in milli-currency), and the timestamp. We do not see or store payment-card information; that stays with Apple.
• Device data — IP address (only at request time, not stored long-term), and a session token stored securely on your device.

2. How we use your information

• To create and authenticate your account.
• To deliver the gameplay experience (cards, matches, packs, leaderboards, social features).
• To process and validate in-app purchases through the Apple App Store.
• To prevent abuse, fraud, and spam.
• To respond to your support requests.

3. Third parties

The App uses the following third-party services. Each operates under its own privacy policy.

• Apple App Store — for Sign in with Apple and in-app purchase processing.
• Google Sign-In — for authentication when you choose Google.
• MongoDB Atlas — to store account, gameplay, and purchase data.
• Railway — hosting provider for the App’s backend services.
• ESPNcricinfo Statsguru and cricapi.com — public sources from which we aggregate football statistics. We do not send any user data to these services.

We do not sell your personal information. We do not use third-party advertising networks. We do not run analytics SDKs that collect personally identifiable information.

4. Data retention

We retain your account and gameplay data for as long as your account is active. Inactive guest accounts that have not signed in for 7 days are automatically deleted. When you delete your account, we mark it for removal and purge all associated data within 30 days.

5. Your rights

You can:

• Access the personal data we hold by emailing us.
• Correct or update your account details from within the App.
• Request deletion of your account and associated data — either from within the App (Profile → Delete Account) or by emailing us.
• Export a copy of your gameplay data on request.

6. Children’s privacy

The App is rated 4+ on the App Store. We do not knowingly collect personal information from children under 13 (or the equivalent minimum age in your jurisdiction). If you believe a child has provided us with personal information, please contact us and we will delete the account.

7. Security

Account passwords are hashed with bcrypt; session tokens are stored in the device’s secure keychain. All API traffic is encrypted in transit via HTTPS. No method of transmission or storage is 100% secure, but we apply industry-standard safeguards.

8. Changes to this policy

We may update this policy as the App evolves. The “Last updated” date at the top of this page reflects the current version. Material changes will be surfaced in-app on next launch.

9. Contact

Questions or requests? Email support@clashcards.app.

Football Cards Royale is an independent product. It is not affiliated with, endorsed by, sponsored by, or licensed by the BCCI, ICC, IPL, Football Australia, the ECB, or any football governing body or franchise team.