Privacy

Last updated 3 October 2026

We keep only what we need to run your account and the game. We don't sell your data or show ads. We measure the audience with Google Analytics, and it uses cookies only if you agree. If you buy Astra, Stripe handles the payment, and we never see your card details.

1. Who is responsible

We, the team that runs Kosmora, control your data.

You can reach us on X (Twitter): @pxmme1337.

2. What we collect

• Account: your email (to sign you in, send essential messages and, unless you turn it off in Settings, an occasional email about your collection after a few days away), your player name, when you accepted the Terms, and your profile choices (avatar, which stats are shown).
• Game: your cards and their history, packs, Kosmo movements, Astra movements, Style items and card changes, Odyssey progress, talents, focus families, albums, auctions and bids, Black Market purchases, achievements, notifications, tutorial progress, settings, and reports you send.
• Technical: a sign-in cookie called kos_session (strictly necessary); for each signed-in device, its browser name, start date and last activity, so you can review them; a salted hash of your IP address, only to limit abuse; and the days you played (for game rules such as Black Market prices).
• Notifications: if you turn them on, for each device the address its browser gives us to deliver them, with its encryption keys, browser name, language and time zone; your choices per type of notification; and which notifications we sent. Turn them off in Settings, or in your browser or phone settings.
• Fraud prevention: to spot one person playing with several accounts, we record a random identifier your browser keeps for Kosmora, a summary of how your browser draws text and graphics (canvas, WebGL, fonts, screen size, time zone and language), and your IP address, with whether it belongs to a hosting provider. We store only salted hashes of these, never the values themselves, and compare them between accounts along with how cards and Kosmo move between players. An account that breaks the rules can be suspended. You can appeal by contacting us on X (Twitter).
• Purchases: if you buy Astra, we keep each order: the bundle, the price, the currency, the tax, the country Stripe gives for tax, the status of the payment and of any refund or dispute, Stripe's references for you and for the payment, when you asked for immediate delivery and the wording you saw, a salted hash of your IP address, and whether we sent you the confirmation email. Stripe sends us a notice at each step of a payment, which we keep as received: it can include your name, email address and billing address as you gave them at checkout. We also keep what became of the Astra of each purchase (spent, refunded or held), your spending limit and any pause on your purchases. If you buy Astra for a friend, the order also keeps which friend it was for, and your friend sees your player name and the amount, never the price or your payment details.

Outside purchases, we don't collect your real name or postal address. We don't collect your phone number or location. We never see or store your card number or other payment details: Stripe collects them on its own page.

3. Why we use it

• To run the game (our contract with you): account, sign-in, collection, Kosmo, Astra and purchases, market, albums and your public profile.
• To keep it fair and safe (legitimate interest): rate limits, spotting multi-account abuse and rigged trades, preventing payment fraud (the spending limit, payment disputes), handling reports, logging admin corrections.
• To follow the law (legal obligation): answering lawful requests and keeping required records, such as the tax and accounting records of purchases.
• To measure the audience (our legitimate interest in improving the game for the measurement without cookies, and your consent for the cookies): which pages are visited and how the game is used, so we can improve it.

4. Who else handles data

These providers work for us, following our instructions:

• Resend sends sign-in emails (your email address and the link), the occasional email after a few days away (your email address, player name and what is new in your collection) and the confirmation of each Astra purchase (your email address, player name, the bundle, the price and the date).
• DigitalOcean hosts our servers and database.
• Cloudflare delivers and protects the site, which involves connection data such as IP addresses.
• Google Analytics (Google Ireland Limited) measures the audience, as our processor, and only for us. It uses cookies only if you agree. It is never used for ads.
• Object storage (Cloudflare R2 or DigitalOcean Spaces) holds card pictures. No personal data.
• AI providers: OpenAI (card summaries and pictures) and TypeSafe AI's Jev (sorting cards into families) only see public Wikipedia content, never your email, account or game data.
• Push services run by your browser's maker (Google, Apple, Mozilla or Microsoft) deliver notifications if you turn them on. They carry an encrypted message they cannot read.

Stripe handles payments when you buy Astra, through Stripe Managed Payments. The payment page says "Sold through Link": Sold through Link, LLC, a Stripe company, is the merchant of record. For the payment, Stripe decides how your data is used, as an independent controller, under its privacy policy. It collects your payment details, your billing address and country for tax, and your email address for the receipt. We give Stripe your email address, the order and your language. Stripe gives us the status of the payment, its amount and tax, your country and the notices described in section 2. Stripe may process this data outside your country, including in the United States.

Other players never see your email or your Kosmo balance. Every player has a public profile that anyone can open and that search engines may list: it shows your player name, avatar, showcase cards, achievements, public albums and the stats you choose to show. If you played in the last 7 days, the leaderboard shows your name, your Kosmo per hour and the stats you choose to show. Auctions show the seller's name, and the Black Market shows the buyer's name.

If you accept someone as a friend, they can also see every card in your collection, every stat on your profile, your Kosmo per hour and the day you last played. Either of you can end the friendship at any time, and you can turn off friend requests in Settings.

5. International transfers

Some providers may process data outside your country, Google Analytics and Stripe included. When required, this relies on safeguards such as adequacy decisions (for Google, the EU-US Data Privacy Framework) or standard contractual clauses.

6. How long we keep it

• Account and game data: as long as your account exists.
• Sign-in links: 15 minutes, one use. We only store a hash.
• Signed-in devices: until they expire (30 days) or you sign them out.
• Notification devices: until you turn notifications off on that device or sign out there, or the browser stops accepting them. The list of notifications sent: 30 days.
• Fraud prevention hashes: 90 days after your browser or address was last seen, and deleted with your account. An account's score and the decisions about it are kept while the account exists.
• Audience measurement: 14 months at Google, then deleted. Your choice to accept or refuse cookies: 6 months on your device.
• Purchase records (orders, payments, refunds, disputes and Stripe's notices about them): 1 year after the payment, or after the last refund or payment dispute about it if that is later, even if you delete your account before then. After that year, we delete the personal details in them (your name, email address and billing address in Stripe's notices, Stripe's reference for you and the hash of your IP address) and keep only the amounts, currencies, dates and references that the game's records of Astra need. While your account exists, your purchases stay listed in it. Stripe keeps its own records under its privacy policy.
• Deleting your account takes effect after 7 days, and you can cancel before then. Running auctions and bids finish first. Then your personal data is erased, except purchase records, which are kept as described above. The history of Kosmo and card ownership is kept without your identity, because the game's economy and one-of-a-kind cards depend on it. Exclusive cards are never re-issued.

7. Your rights

Depending on where you live, you can:

• Get a copy of your data: Settings → Download my data.
• Correct it: contact us on X (Twitter).
• Erase it: Settings → Delete my account.
• Restrict or object to uses based on legitimate interest.
• Complain to your data protection authority.

8. Stored on your device

Besides the sign-in cookie, your browser keeps a few things: your settings (sound, animations, vibration), your next goal, a snapshot of your balance and packs for the offline page, whether you dismissed the install or notifications tips, and your choice about audience measurement. None of it is used for tracking or ads. The snapshot is cleared when you sign out. If you accept the audience measurement cookies, Google Analytics adds them (section 9).

9. Audience measurement

We use Google Analytics to see how the site is used: the pages visited, the type of device and browser, the language, the approximate location (country and city, estimated from your IP address, which Google Analytics does not store), where the visit came from, and a few moments of the game: creating an account, opening a pack, claiming a challenge pack, sharing and finishing the Constellation introduction. This anonymous measurement happens for every visitor, before and without any choice, and without cookies: nothing is kept on your device, so Google Analytics cannot recognise you from one visit to the next. Only if you agree does Google Analytics also keep cookies named _ga to recognise a returning browser and measure how long visits last.

We never send your email, your player name or any account number. Addresses reach Google as page types only: a card, a profile, a shared pack or a sign-in link becomes a general address such as /u/:handle, and everything after it is removed. Advertising features and Google signals are off, and the data is never used for ads.

Cookies are set only if you agree. On your first visit you can accept or refuse them, with the same two buttons. Your choice is kept on your device for 6 months, then we ask again. Refusing changes nothing in the game. You can change your mind at any time: Cookie settings at the bottom of the public pages, or Settings then Privacy and devices in the game. If you refuse or withdraw, the Google Analytics cookies are deleted at once and only the measurement without cookies continues. Google Ireland Limited processes this data as our processor, only for us, and keeps it 14 months.

10. Age

Kosmora is for adults. You must be 18 or older to create an account, play and buy Astra. If you think someone younger has an account, tell us and we will look into it.

11. Security

Encrypted connections, protected sign-in cookies, hashed sign-in links, two-factor sign-in for admins, restricted access to our systems and logged admin actions. No system is perfect: please tell us quickly if you notice a problem.

12. Changes

If we change this notice in a meaningful way, we'll tell you in the game first. The date at the top shows the current version.

13. Contact

For privacy requests, reach us on X (Twitter): @pxmme1337.