Pawfolio Privacy Policy — Draft for Owner Review

Status: Test draft. This policy is incomplete and has not been legally reviewed. The operator must complete the items marked TODO before public release.

Who operates Pawfolio

Operator: TODO — legal name and jurisdiction. Contact: TODO — privacy email or another reliable contact method. Effective date: TODO.

What the game processes

Pawfolio uses Supabase anonymous sign-in to create an account identifier without requiring you to register with a name, email address or password. The game stores your collection, card quantities, pack-opening times, request identifiers and card results. It also records game events associated with that anonymous identifier: visits, first game start, pack openings and reveals, and card-share actions or visits. These records support gameplay, the daily limit, recovery of interrupted requests and basic game-use analysis.

The browser stores the anonymous access and refresh tokens, their expiry and the service URL in local storage. The game also stores a pending pack request identifier while recovering an interrupted opening. Tokens are refreshed as needed. Clearing site data, changing browser or device, or losing the local session may permanently disconnect you from your collection. The current game has no account linking or recovery feature.

The game does not actively ask for your name, profile photo, phone number or precise location. Your browser and service providers necessarily receive technical request information, potentially including IP address, device and browser information, timestamps and diagnostic or security logs. The operator must verify each provider's actual log settings, purposes and retention before publishing this policy.

Providers and transfers

Supabase supplies anonymous authentication and the database and API services. The existing project is configured in the Tokyo region. Cloudflare Pages hosts the current test site and delivers its files; Cloudflare may process request and security information at its network locations. The game calls Supabase over HTTPS to sign in, refresh a session, fetch game state, open a pack and record the events described above. Card artwork is included with the game rather than fetched from a separate art host.

If Pawfolio is distributed on itch.io or another platform, that platform may independently process information under its own privacy terms. TODO — confirm each distribution platform, its role, transfers, subprocessors and applicable notices before release. This draft does not assert that any platform integration is already live.

Retention and deletion

Retention: TODO — specify the actual retention periods for anonymous accounts, gameplay records and relevant logs, including backups, and how they are enforced. No retention period is currently promised or represented as implemented.

Deletion requests: TODO — provide an operational contact and a feasible verification and deletion procedure. There is no in-game deletion button or verified request workflow at present. Clearing browser storage alone does not delete server records and may make an anonymous account impossible to identify or recover. Do not send tokens or other secrets through an unverified channel.

Your choices and rights

You can stop using the game and clear its browser data, subject to the loss-of-progress and server-data limitations above. TODO — identify the applicable privacy rights, lawful basis, request process and response times with qualified review.

The operator must complete this draft and assess the actual provider configuration and applicable law before publication. No legal compliance review is claimed.