Privacy notice

Last updated: 25 September 2026

Operator details pending: the legal identity and contact address of the operator have not been published yet. They will appear on this page before public launch. Kosmora does not claim to be operated by any company until then.

Kosmora is a free encyclopedic card game. There are no payments, so we never collect payment details. We collect only what is needed to run your account and the game, and we do not sell your data, show advertising or use third-party analytics trackers.

1. Who is responsible

The data controller is the operator of Kosmora:

Operator: Pending publication
Address: Pending publication
Support: Pending publication
Privacy: Pending publication

2. What we collect

Account data: your email address (used to sign you in and for essential account messages), your player name (handle), the date you accepted the Terms, and optional profile choices (avatar, whether your profile is public, which statistics are shown).
Game data: your cards and their history, packs and openings, your Kosmo ledger (production, purchases, fees, recycling), talents, focus families and wishlist, albums, auctions and bids, Black Market purchases, badges, notifications, tutorial progress and interface settings, and reports you send about content.
Technical data: a session cookie named kos_session (HttpOnly, strictly necessary to keep you signed in); for each session, the browser description (user agent), creation date and last activity, so you can review and revoke your sessions; a salted hash of your IP address, used only to limit abuse of sign-in and other rate-limited actions; the days on which you were active (used for market access and income rules).

We do not collect your name, postal address, phone number, location or payment information.

3. Why we use it, and on what basis

To provide the game (performance of our contract with you): account, sign-in, collection, economy, markets, albums, public profile if you enable it.
To keep the game safe and fair (legitimate interest): rate limits, detection of multi-account abuse and coordinated transfers, moderation of reports, audit logs of administrative corrections.
To comply with the law (legal obligation): answering lawful requests and keeping records we are required to keep.

4. Who receives data

We use service providers (processors) who act on our instructions:

Resend — delivers sign-in emails (receives your email address and the sign-in link).
DigitalOcean — hosts our servers and database.
Cloudflare — network proxy, TLS and content delivery; it processes connection data such as IP addresses to deliver and protect the site.
Object storage (Cloudflare R2 or DigitalOcean Spaces) — stores card illustrations, which contain no personal data.
AI providers — OpenAI (card text summaries and illustrations) and TypeSafe AI’s Jev (family classification) process only public Wikipedia content. They never receive your email, account, collection, balance or any other player data.

Your email and balance are never shown to other players. Your handle, and your public albums and chosen statistics if you make your profile public, are visible to everyone. Auction listings show the seller’s handle; the Black Market shows the buyer’s handle only if their profile is public.

5. International transfers

Some providers may process data outside your country. Where required, transfers rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.

6. How long we keep data

Account and game data: for as long as your account exists.
Sign-in links: valid for 15 minutes and usable once; only a hash of the token is stored.
Sessions: until they expire (30 days) or you revoke them.
Deletion: when you request deletion, it executes after 7 days and you can cancel it during that time. Pending commitments are resolved first (open auctions with bids and your leading bids complete normally). Your personal data is then removed. Ledger and card-ownership history is kept in pseudonymised form because the game’s economy and the uniqueness of cards depend on it; exclusive cards are never re-issued.

7. Your rights

Depending on where you live, you have the right to:

Access and portability — Settings → Download my data gives you a JSON export of your account.
Rectification — contact us to correct inaccurate data.
Erasure — Settings → Delete account.
Restriction and objection to processing based on legitimate interest.
Complaint to your data protection supervisory authority.

You can also review and revoke your active sessions at any time in Settings.

8. Storage on your device

Besides the session cookie, Kosmora stores a few items in your browser’s local storage: interface preferences (sound, reduced motion, haptics), your chosen next goal, a last-seen snapshot of your balance and pack count for the offline page, and whether you dismissed the install suggestion. None of it is used for tracking or advertising, and it is cleared when you sign out (the snapshot) or clear your browser data.

9. Children

You must be at least 13 years old, or the minimum age for digital consent in your country if higher, to create an account. Where the law requires it, a parent or guardian must consent.

10. Security

We use encrypted connections, HttpOnly session cookies, hashed sign-in tokens, a second factor for administrators, restricted access to production systems and audited administrative actions. No system is perfectly secure; tell us promptly if you notice a problem.

11. Changes

We may update this notice. Significant changes will be announced in the game before they take effect. The date at the top shows the latest version.