Who this covers
- Child: under 13. A parent or guardian creates the profile; children never register themselves.
- Teen: 13 to 17. The teen starts sign-up and the account stays inactive until a parent or guardian approves it. We delete the pending data after 7 days without approval. We apply the strictest age (under 13 for COPPA; under 12 is a "child" in Brazil, under 18 gets ECA Digital protections) to everyone under 13, and protective defaults to everyone under 18.
What we collect from a child
Guardian email; the child's birth month, a generated username (never a real name), a preset avatar, and the collection the child records. No photos or real names are published, no location, no free text visible to others. The only way a child can share is through features the guardian approves.
What we do not do
No ads, no profiling, no tracking, no data sale or sharing, no third-party disclosure of a minor's data, no public profile, no search by strangers, no chat. Card photos (if scanning is enabled) are sent to our recognition provider without metadata or account identity and deleted after 24 hours. Under-13 accounts are collection-only until we offer, and you approve, a verified parental consent step for social features.
Your choices as parent or guardian
- Review everything we hold about your child, export it, correct it.
- Refuse further collection or use, and delete the child's data at any time. Revoking consent deletes the child's account and data (backups age out within about 6 months).
- Approve or decline each friendship, trade or share request (every one needs your approval).
- Contact [email protected] for any request; we answer within the legal deadlines and verify you are the guardian first.
How we get your consent
We email the guardian a link, show this notice and ask for specific, prominent consent at one of two levels: Basic (collection only) or Social (friends, trades, shares, each still needing approval). Consent is recorded with date, method, policy version and a hashed IP. Method for under-13 collection-only accounts: email plus a confirming step. We keep consent records for the life of the link plus 3 years, as proof.
Retention
See the Retention table. We keep a minor's personal data only as long as needed for the account.
Contact
DeckMaster, [email protected].