Privacy Policy

Last updated: November 2026

1. Privacy at a glance

quartetto. is a Top Trumps style card game against the app or, with an account, against other players. This involves your account data, your game progress (collection, coins, profile) and, if you use them, data from online duels and the Workshop: for these we are the controller within the meaning of the GDPR.

Without an account, your data never leaves the device. We do not use analytics or tracking services, no social media plugins and no newsletter systems; there is no profiling and no automated decision-making. In the free Basic tier, the app shows an ad banner; ad videos for coins play only when you start them yourself, in any tier (section 10). Data is not sold to third parties.

2. Controller

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

Legal bases

We process personal data on the basis of Art. 6(1)(b) GDPR (performance of the user contract, see Terms), Art. 6(1)(f) GDPR (legitimate interest in secure, trouble-free operation), Art. 6(1)(c) GDPR (statutory retention obligations for payments) and, where consent has been given, Art. 6(1)(a) GDPR. Consent given can be withdrawn at any time with effect for the future.

SSL/TLS encryption

This site and all interfaces of the service are delivered exclusively over an encrypted connection (recognisable by https:// in the address bar). Data transmitted cannot therefore be read by third parties.

3. Hosting

quartetto. runs on a server in a data centre within the European Union. All application data (accounts, profiles, the collection backup and the data from online duels and the Workshop) is held on that server. No content delivery network is used; fonts, icons and scripts are also delivered from our own server and not loaded from external hosts.

4. Website access data

When a page is requested, your browser transmits technically necessary information that the server records in log files:

• the address requested, date and time of the request
• the amount of data transferred and the HTTP status code
• browser type and version, operating system
• the referring page, where transmitted
• IP address

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in secure operation and the defence against attacks. This data is not merged with other data sources. Logs are deleted after 30 days at the latest, unless they are needed to investigate a specific case of abuse.

To fend off automated attacks we store the IP address of suspicious requests in a block list for a limited time.

Contacting us

If you write to us by e-mail, we process your details in order to handle the enquiry and in case of follow-up questions. The legal basis is Art. 6(1)(b) or (f) GDPR. Messages remain with us until the purpose ceases to apply and no statutory retention periods stand in the way.

5. Account and sign-in

You need an account for syncing and backup, purchases, online duels, the Workshop and ad videos for coins. In doing so we process:

• e-mail address and, if provided, name
• your player name, if you set one in your profile (3 to 20 characters, each name can only be taken once)
• the password, solely as a non-reversible hash, never in plain text
• a session identifier by which the app recognises you on each request
• the tier booked and the confirmation status of the account
• timestamps of creation and last change
• time-limited identifiers for the confirmation e-mail and for resetting the password

The legal basis is Art. 6(1)(b) GDPR. The account is valid for quartetto. only. Other applications of the provider maintain separate accounts with their own records, even for the same e-mail address; no comparison takes place between them.

6. Collection, profile and game progress

When syncing with the server (from the Premium tier onward), the following is stored there:

• your card collection with the number of copies, metal editions and energy per card, plus your decks
• your coin balance, experience, match history (wins, losses) and your progress in daily tasks, the daily bonus calendar and the Season Pass
• profile information and, if provided, a profile picture

There is no sync in the Basic tier. If you start or accept an online duel with cards from your collection, we still store this game progress on the server and record cards lost in Hardcore duels, to check that the cards in your deck are yours (Art. 6(1)(b) GDPR).

The legal basis is Art. 6(1)(b) GDPR. The card catalogue itself (names, categories and values of the cards) is not personal data and is shipped with the app, not linked to your account. Each account's files reside in its own directory; the permission is checked on every request.

Online duels

If you play online, we store the following on the server in every tier: your friend code, your rating (Normal and Hardcore), your level, the time of your last visit and the app language; also friendships, requests and redeemed invitations, your place in the queue, and every match with both players, decks, card backs, moves, result and cards won or lost.

Other players see your player name, or without one your first name and the initial of your surname, never your email address. Your friends also see your level and whether you are online. The queue shows only the number of players waiting, no names. The server picks an opponent with a similar rating. The legal basis is Art. 6(1)(b) GDPR.

Workshop

If you create your own topics, categories and cards in the Workshop, we store them on the server in every tier: names, values, colours, shares with friends and your pictures. The app crops pictures to 800 × 600 pixels before uploading. A picture is delivered through an address with a random part, without login, so that the app can display it; anyone who knows that address can open the picture. Your categories are visible only to the friends you share them with, and only while the friendship lasts.

If you report a shared collection, we store the reason, your free text, your account and the collection concerned in order to review the report. The legal basis is Art. 6(1)(b) GDPR, and for reviewing reports Art. 6(1)(f) GDPR (protecting users from unlawful content).

7. E-mail

The service sends e-mail only in response to an event: confirming registration, resetting the password, a notice after a password change and notices about the account. Dispatch is handled by the provider's mail server. There is no advertising or newsletter mailing.

8. Purchases via the App Store

Purchases of tiers, coin packs and the Season Pass are processed via the Apple App Store. You enter your payment details with Apple; they do not reach our server. We only receive confirmation from Apple as to which tier is unlocked for your device or App Store account, or which coin pack or Season Pass has been credited, and store this status against your account.

The legal basis is Art. 6(1)(b) GDPR (performance of contract) as well as Art. 6(1)(c) GDPR for commercial and tax retention. Apple's privacy notices additionally apply.

9. Storage on the device

The app stores data in the device's local storage. Without an account it stays there exclusively:

• card collection, match history and coin balance (IndexedDB)
• the session (account identifier, session identifier, display name) and the PIN lock
• selected language, light/dark setting and last opened area

The legal basis is Art. 6(1)(b) GDPR. Signing out and deleting the app's data removes these entries.

If you are signed in, the app keeps a profile backup on the server in every tier, so that your profile is the same on all your devices. It contains your profile picture, the hash of your PIN code (if set up) and the unlocked tier. The app checks the PIN code itself only on the device; it is not transmitted.

10. Advertising in the app

If the app shows advertising in the Basic tier, it is delivered as a banner at the bottom of the iOS app via Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google processes device data such as the device's advertising identifier, IP address and coarse location data to select advertisements and enable billing and abuse detection.

If the app offers ad videos in return for a reward (rewarded ads), you only ever start such a video yourself; these videos are also delivered by Google AdMob. In quartetto. this works in any tier in the coin shop; a video watched to the end pays 10 coins, at most once an hour and five times a day. For this the app stores when and how often you watched a video today.

The legal basis is Art. 6(1)(f) GDPR (financing the Basic tier); where personalised advertising or access to the advertising identifier requires consent, it is obtained through the operating system's prompt and can be withdrawn there at any time (Settings > Privacy & Security > Tracking). The advertising identifier can also be reset or disabled in system settings.

From the Premium tier onward there is no advertising banner. A connection to AdMob is then only made if you start an ad video yourself.

11. Reminders in the app

The app reminds you at 10 am about the daily bonus, at 11 am about the daily tasks pack as long as you have not opened it, and at 9 am on the first day of a new season. The app schedules these reminders only on your device; no data is sent to us or to a push service for them. Once the day's task is done, the reminder is dropped. You can turn them off under notifications in the system settings.

12. Retention and deletion

• Account data: until you delete the account.
• Collection, coin balance and profile on the server: until you delete your account. We do not delete them on our own initiative.
• Data from online duels and the Workshop: until you delete your account. Your rating, friendships, matches, Workshop entries and Workshop pictures are then removed from the server.
• Data only on the device: until you delete it or remove the app; it will not be restored if no sync has taken place.
• Access logs: after 30 days at the latest.
• Payment records: for the statutory retention periods, as a rule six to ten years.

You delete your account yourself in the app. The account is then deactivated and the associated data on the server is removed. This cannot be reversed. Accounts with other applications of the provider are unaffected and have to be deleted there separately.

13. Your rights

You have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the processing (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on a legitimate interest (Art. 21). Consent given can be withdrawn at any time with effect for the future.

Please contact [email protected].

Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement.

14. Changes to this policy

We adapt this policy when the service or the legal situation changes. The version published here at the time applies. In the case of substantial changes we additionally inform account holders in the application or by e-mail.