Privacy policy

Who we are

Holotrack (holotrack.art) is a music trading card game. This policy explains what we collect when you visit the site or play, why, and what you can do about it. Questions or requests: hello@holotrack.art.

What we collect

• Your account: your email address, to send you sign-in codes, and the username you pick, which other players see.
• Your game: your cards, holos, packs, favorites and showcase, the auctions you run and the bids you place.
• Your purchases: when you buy holos or Pro, Stripe handles the payment. We keep your Stripe customer id, what you bought and your subscription status. Your card details go to Stripe only, never to us.
• Notifications: if you turn them on, your browser's push address for that device, so we can tell you when a free pack is ready or when someone bids on or outbids you.
• Usage: the pages you view, what you tap, errors, your browser and device type, and a rough location from your IP address, through PostHog analytics. Once you're signed in, this is linked to your account, email and username.
• On your device: a cookie that keeps you signed in, PostHog's analytics cookie, and your sound settings.

We don't sell your data, and we don't show ads.

Why we use it

• To run your account and the game, and to take and deliver your purchases (the contract between us).
• To keep payment records as the law requires (legal obligation).
• To understand how the game is played, fix bugs and improve it (our legitimate interest).
• To send sign-in codes and the notifications you turned on. We don't send marketing emails.

Who helps us run it

These services process data for us, under their own safeguards:

• Convex: our database and backend, hosted in the EU (Ireland).
• Cloudflare: hosts the website.
• Resend: sends sign-in code emails.
• Stripe: takes payments.
• PostHog: analytics, hosted in the United States.
• Google, Apple, Mozilla and Microsoft: deliver push notifications to your browser, if you turn them on.

Song previews and cover art load straight from Spotify's and Deezer's servers, which see your IP address when they do. Some of these services are outside the EU; transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

We keep your account and game for as long as you have an account. Deleting your account (Profile, then Delete account) erases your game and account data. Payment records stay with Stripe for as long as tax and accounting law requires. Analytics data is kept for up to 7 years, then deleted.

Your rights

You can ask to see, correct, export or delete your data, object to or restrict how we use it, or withdraw consent you gave. Most of it you can do yourself in the game; for the rest, write to hello@holotrack.art. We answer within a month. You can also complain to your data protection authority; in France, the CNIL (cnil.fr).

Children

Holotrack isn't meant for children under 13, and we don't knowingly collect their data. If you think a child has an account, tell us and we'll delete it.

Changes

If this policy changes, we'll update it here with a new date, and tell players in the game when the change matters. See also our terms.