Privacy Policy

1. Who is the controller

The data controller is Emanuele Roberto De Santi, who publishes Hiyoru under the name Exa Studio Digitale. For any question about your data write to [email protected].

2. What data we process

• Discord account: when you sign in with Discord we receive your Discord ID, username, profile picture and the associated email address. We never receive your password.
• Email sign-in: if you sign in with your email we process your email address, which we use only to send you the sign-in code and recognize your account, and the name you choose in the game. We do not use passwords and we do not send you advertising.
• Game data: Ryō, cards, Collection, decks, progress (Story, missions, pass, level, Competitive), friends, titles and frames.
• Matches: moves, results, duration and decks used, to award rewards and check that matches are fair.
• Presence: when you are connected and which screen of the game you are on, to show who is online and manage online matches.
• Reports: the text you write in “Report a problem”, any screenshot and the attached technical details (game version, browser, screen size, match situation).
• Donations (optional): if you donate on Ko-fi, Ko-fi sends us the amount, date and type of donation and, only if you choose to make it public, the name you entered. We do not keep emails, messages or payment data: the payment takes place entirely on Ko-fi (with Stripe or PayPal).
• Technical data: IP address and connection data recorded by the providers that host the game, needed to run and protect it.

If you play as a guest, without signing in, we do not create any account: your progress stays only on your device.

3. Why we process it

• To provide you with the game and your account (performance of a contract, art. 6.1.b GDPR).
• For security, to prevent cheating and abuse, for moderation and to answer your reports (legitimate interest, art. 6.1.f GDPR).
• To show the monthly donation goal and, if you made your donation public, your name in the Supporters’ Hall of the game and the website (consent, art. 6.1.a GDPR: you can withdraw it at any time by writing to us, and the name is removed).
• To comply with any legal obligations (art. 6.1.c GDPR).

We do not show advertising, we do not sell your data and we do not use it for commercial profiling. Automatic anti-cheat checks flag suspicious matches, but every suspension is decided by a person.

4. Who can see the data

• Other players see your name, profile picture, title, frame, level and rank during matches, in leaderboards and among friends.
• The game administrators can consult game data, matches and reports for support and moderation.
• Anyone visiting the game or the website sees the names in the Supporters’ Hall (only for those who chose a public donation) and the month’s donation total, never the amount donated by a single person.
• Providers processing data on our behalf: Supabase (database and sign-in), Cloudflare (website hosting), Netlify (test website), GitHub (launcher download), Discord (sign-in), the service that sends the emails with the sign-in code, Google Fonts (page fonts: your browser downloads them from Google’s servers, which receive your IP address).

5. Donations on Ko-fi

Donations are handled by Ko-fi (Ko-fi Labs Limited), which processes payment data as an independent controller under its own privacy policy, together with its payment providers (Stripe, PayPal). We only receive the data listed above. If you link your Discord account to Ko-fi to receive the “Supporter” role, the link is made between Ko-fi and Discord.

6. Transfers outside the European Union

Some providers may process data in the United States or other countries outside the EU. In these cases transfers take place with the safeguards provided by the GDPR, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

7. How long

We keep the data as long as your account exists. If you delete your account (Profile → “Delete my account and all data”) we delete the profile, the game data and the reports. Some minimal information may remain for a limited time in the providers’ technical and security logs.

The donation register (amount, date and public name) is not linked to your game account: we keep it for our accounts and for the Supporters’ Hall. If you ask, we remove your name immediately; the amount stays, anonymous, in the totals.

8. Storage on your device and cookies

The game saves your settings, guest progress and sign-in session in the browser (local storage). These are technical tools needed for the game to work: we do not use profiling or advertising cookies, which is why we do not ask for your consent.

9. Minors

To create an account you must be at least 14 years old. If you sign in with Discord, Discord also has its own minimum age. If you are a parent and think your child gave us data without being old enough, write to us and we will delete it.

10. Your rights

You can ask to access your data, correct it, delete it, restrict its processing, receive it in a readable format (portability) and object to processing based on legitimate interest. Write to [email protected]. You can delete your account at any time from your Profile. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

11. Changes

We may update this policy when the game changes. The date at the top shows the latest version; important changes will be announced in the game.