Privacy Notice
This notice explains how LOST-TCG uses information to run the game. Contact the operator at lost.tcgofficial@gmail.com for privacy questions or requests.
Information we use and why
- Account email, username and a hashed password let us register, authenticate and recover your account. Verification and reset links are stored as hashes.
- Collections, decks, game progress, virtual gems, auctions, requests and memberships let us provide the game and protect card and gem transfers.
- Age confirmation and terms acceptance record your eligibility and agreement. We do not collect identity documents through the age screen.
- Image reports contain a card reference, your account reference and your written reason so we can moderate artwork. Please do not include unnecessary personal information.
- Session identifiers, IP-based request limits and technical error information help secure the service and investigate problems.
Account and gameplay processing is necessary to provide the service you request. Security and moderation serve our legitimate interests in operating a safe, reliable game. We may retain information where required by applicable law. Privacy acknowledgement is not consent to marketing.
Feedback
When you send feedback, your message, username, account ID and account email are sent to the operator at lost.tcgofficial@gmail.com so we can investigate and reply. The website sends this email through Resend using its configured LOST-TCG sending address. You do not need to provide another address or open an email app. Feedback emails remain in the operator’s support inbox; contact us to request removal of identifying information.
What other players can see
Your username, public collection statistics, rank and selected gallery cards can appear publicly. Market listings display the seller’s username. Your email, password hash and private account information are not included in public profiles.
Service providers and outside services
The hosting provider stores the application, database and backups. Transactional email delivery uses Resend when configured, which receives the recipient address and message contents. Image-report emails go to the operator’s Gmail inbox. No advertising or analytics service is installed by the application. Patreon handles membership payments on its own website; LOST-TCG does not collect your card details. For automated Supporter VIP, we receive the Patreon member identifier, email, eligible tier and payment/entitlement status. We use these to email a single-use code, bind one verified game account and update VIP access. Unsent code emails and creator API credentials are encrypted at rest; delivered codes are retained only as hashes. Temporary email queue records are removed after 35 days. Deleting a linked game account also removes its local Patreon link and code records. If the paid membership remains active, a later Patreon synchronization may email a new code; cancel membership separately on Patreon if desired. Provider regions and any international-transfer safeguards must be confirmed for the deployed configuration before public launch.
Cookies and local storage
The essential lost.sid session cookie keeps you signed in and expires after seven days. Embedded play through itch.io or Newgrounds uses a separate secure __Host-lost.embed.sid session cookie, partitioned by the browser where supported. Your account and progress are shared, but you may need to sign in separately in each view. If embedded sign-in is blocked, allow essential cookies for the game and try again. Local storage remembers your adult-content confirmation and dismissal of the quick guide. These controls support access and usability; they are not advertising trackers. Clearing them asks you to confirm your age again.
Retention and deletion
Account and gameplay information is kept while your account is active. The Delete Account control erases your identifying account fields, profile, inventory, membership and private ledger, and invalidates sessions. Active auctions are cancelled with refunds to other bidders; your outstanding bids are withdrawn. A deidentified account marker and minimal trade references remain to preserve completed transfers and prevent deleted identities from being restored accidentally. Image reports may remain with the reporter reference removed so the artwork concern can still be reviewed.
Notifications expire after three days. Password-reset links expire after 15 minutes and email-verification links after 24 hours. Expired tokens, resolved reports and delivery records are periodically cleared. Protected backup copies can temporarily contain older data until their scheduled replacement; deletion markers must be reapplied before a backup is brought online. Contact us to request removal of identifying information you supplied in a report or email.
Your choices and rights
You can request access, correction, deletion, restriction or portability of your information, and object to processing based on legitimate interests where applicable. Email lost.tcgofficial@gmail.com; we may request proportionate evidence that you own the account. We respond within the applicable legal time limit, ordinarily one month. You can also complain to the CNIL or another competent supervisory authority. Deleting your game account does not cancel a Patreon subscription.
Changes
We update this notice when the service or its data use changes, showing a new date and communicating material changes where appropriate.
Direct player trades
When you open a player trade, you can browse that player’s owned card names, quantities, levels and trading availability. Direct offers, selected cards, copy amounts and responses are visible only to the two participants and the operator. Offers expire after 48 hours; closed offers are kept for up to 30 days for review and delivery recovery. Trade notifications expire after three days. Deleting an account removes its direct offers and the related notifications. Cards remain in collections until an offer is accepted.
Clan chat
Clan chat messages and usernames are visible only to current members of that clan, including newly joined members, and the operator for moderation. They are separate from global chat. Messages are kept for up to 30 days; reports can retain the reported text until the message is removed by retention cleanup. Leaving removes your access to the room; disbanding the clan removes its chat messages and related reports. You can delete your own messages while you remain a member, and account deletion removes your authored messages.
Clans
Clan names, membership, leader identity, level, score requirements and shared boss progress are visible in the game. Clan applications are visible to the leader. We store your personal clan marks, daily activity counters and boss snapshots to operate rewards and prevent duplicate claims. Daily counters follow UTC and persist when you change clans. Completed action receipts are retained for up to 30 days, battle snapshots until seven days after expiry, and pending applications for up to seven days. Account deletion removes your clan profile, applications, receipts and battles; leadership passes to another member or an empty clan is disbanded. A clan shared by remaining members can continue after you leave.
Global chat
Messages you send in Main’s global chat are visible to other signed-in players with your username and posting time. Your email is not shown. The chat displays the latest 100 messages and stores messages and associated moderation reports for up to 30 days, with routine cleanup. You can remove your own messages; a copy already attached to a report may remain for moderation during that period. Reports include the message and your written reason. Chat mutes restrict posting without changing your game inventory. Account deletion removes your chat messages and detaches your account from reports you filed. Avoid sharing personal information in messages or reports.
Chat translation uses your browser language as the target. Where supported and already available, translation runs on your device. The Google Translate fallback opens a separate tab and sends only the selected message and target language to Google when you click it; chat is not automatically sent there.