Privacy
Who we are
Legend Drop is an independent project, not affiliated with the Wikimedia Foundation. For any question about your data or to exercise your rights: [email protected].
Account
Username, email, hashed password, language. With Apple or Google sign-in: your account identifier with that service, the email it shares and, for Apple, an encrypted token used to revoke the sign-in when you delete your account.
What you publish
Bio, avatar photo (subscribers), folder and guild names, shown on your public profile; friends list, blocks, preset quick messages and reports you send.
Game and purchases
Packs opened, cards, coins and gems, auctions, trades, purchases and subscriptions. Payment is handled by Stripe, Apple or Google: Legend Drop never sees your card number.
Security and fraud prevention
A random device identifier (cookie), not tied to your hardware; your IP address, to limit abuse, verify sign-up (Cloudflare Turnstile) and rule out self-referrals, not kept beyond technical logs; the country derived from your IP address, read on each visit and never stored; fraud indicators on the game economy.
Usage measurement and notifications
The days you play and views or clicks on premium offers, measured by Legend Drop alone, without third-party tools. If you accept notifications, your device token (Apple Push Notification service or Firebase Cloud Messaging). Catalog searches may be sent without any identifier to a semantic search service.
Purposes and legal bases
Running the game and your account (contract); securing the player economy, moderating and measuring usage (legitimate interest); sending notifications (consent); keeping payment accounting records (legal obligation).
Recipients
Hosting by Hetzner (EU); Cloudflare (network, bot protection, card images); Stripe (web payments); Apple (in-app purchases, sign-in, notifications); Google (in-app purchases, sign-in, notifications); our email delivery provider; Wikimedia, which may serve some images. Transfers outside the EU rely on the European Commission's standard contractual clauses.
Ads and tracking
No ads, no tracking across apps or websites, no data resale. Cookies are only used for your session, the device identifier (two years) and the referral link.
Retention
Data is kept while the account exists. On deletion, the account is anonymized immediately (username, email, profile, friends, messages, devices, notifications), then erased as soon as its ongoing auctions are settled. Payment records, without name or email, are kept as required by law. Technical logs are erased after 14 days.
Children
The game is intended for ages 13 and up. We do not knowingly collect data from younger children: if this happens, write to us so the account can be deleted.
Your rights
Access, rectification, portability, objection and deletion. Account deletion is available directly in the app; for everything else, write to [email protected]. You can also contact the data protection authority of your country.
Delete your account: Account