Privacy policy

Last updated November 6, 2026

CardBoard is run by Smergaman LLC ("we"). It's a website where you rank trading card art and keep lists of cards. This policy says what we collect, why, and what we never do.

What we collect

• Your saved progress. So your progress isn't only on your phone, the game copies what it keeps on your device (your rankings, finished or not, your streak, your Random favorites, your collection, your settings and similar game progress) to our server as it changes, with the same scrambled device ID as votes. That lets a wiped or new phone get it all back. The nickname you type for a challenge stays on your device.
• Your collection. When you mark cards you own or want (your ISO list), the game keeps which cards they are and how many copies you own, on your device and in your saved progress. It isn't shared with anyone, and it never counts as a vote.
• Your account (when sign-in is open). If you sign in with Discord, we keep a scrambled version of your Discord user ID, your Discord display name and avatar, which saved progress is yours, and a sign-in cookie (cb_session, sent only to /api/). Signing in on another device brings your saved progress there. We don't see your Discord password, email, messages or friends, and we never post as you. Accounts are for people 13 and older; Discord requires the same. Sign out any time; to delete the account, email us.
• Votes from Discord. If you vote on the daily duel through our Discord bot, we keep your vote with a scrambled version of your Discord user ID (the same one-way scramble as device IDs; we never store the ID itself, your username, or messages), so each person counts once a day. The bot sees only the button you pressed.
• Your completed sets. Which sets and master sets you've finished, how many times and when, kept on your device and in your saved progress. Not shared with anyone.
• Your binder. The cards you put in your binder (a favorite you found, a duel winner, a card you added), in their order, kept on your device and in your saved progress. Not shared with anyone.
• A restore code and a cookie. Your saved progress has a restore code (Me, then Save and restore) that brings it back on any device. We store only a scrambled form of the code. To bring your progress back to the same browser if it clears this site's data, we set one cookie, cb_restore, which holds that code. It's sent only to our own servers, page scripts can't read it, and it's used for nothing else. Anyone with your code can load your progress, so keep it to yourself.
• Votes and rankings, with a random device ID. When you pick between two cards, we save the pick (the two cards, which one you picked, the game mode, how long you took and when). When you move a card in one of your rankings by hand, we save the move (which card, from which spot to which, and when). When you finish or edit a ranking, we save its current order (up to the first 500 cards). Each is saved with a random ID your device creates. Before it reaches our database, that ID is scrambled with a secret key, so the database never holds the ID itself. It isn't tied to your name, email or any account. We use this only to build rankings, to improve how cards are matched up, to count how many people play and come back, to catch vote-stuffing, and to keep the site working. Moves by hand never count as votes.
• A check that a person is playing. Before a device's votes count toward crowd rankings, the site runs Cloudflare Turnstile, an invisible check that tells people from bots. It runs in a small frame from Cloudflare, which looks at your IP address, browser and connection details only to stop bots, not to identify, profile or target you (see Cloudflare's Turnstile privacy terms). We learn only whether the check passed. With the same scrambled device ID, we note when it passed and how fast the device's picks come in, so picks too fast for a person, or past a daily limit, don't count toward crowd rankings. They're still saved like any other pick, and you can still have them deleted.
• Technical data. Our host, Cloudflare, handles IP addresses to deliver the site and protect it from attacks. Card images load from pokemontcg.io and Scrydex, which see your IP address when your browser loads an image. We send them nothing else, not even which page you're on.
• No accounts yet. When accounts arrive, for ages 13 and up, we'll update this policy first.

What we never do

• Sell or rent personal information.
• Show ads aimed at you, or let ad networks or trackers run on our site.
• Share votes, moves or rankings tied to a device. We share only crowd rankings and totals.
• Ask for your real name, home address, phone number or photo.

Shared links

Challenge links carry their contents inside the link itself. We don't store them. A nickname you add to a challenge travels in the link, so don't use your real name.

Children

Anyone can play without an account, and we don't collect information that identifies a child. If you think a child has given us personal information, contact us and we'll delete it.

How long we keep data

Votes, moves, rankings and the human-check record tied to a device ID are kept for 24 months. After that, only totals are kept. Saved progress is kept until 24 months after it was last saved, or until you ask us to delete it.

Your choices

• Clearing your browser's site data removes your device ID and everything saved on your device. Your saved progress stays on our server, so your restore code can still bring it back. Clearing cookies too means only the code can.
• To delete the votes, moves, rankings, human-check record and saved progress (your collection included) tied to your device, email us the device ID below and we'll remove them.

Contact

hello@playcardboard.app
Smergaman LLC, 239 4th Ave, Ste 1401 #7346, Pittsburgh, PA 15222

Changes

We'll post any change here with a new date.

November 5, 2026: we now also save moves you make by hand in your rankings, and the order of rankings you finish or edit, with the same scrambled device ID as votes. Before this, rankings stayed on your device. We also use the scrambled ID to count how many people play and how many come back.

November 5, 2026, later: votes now count toward crowd rankings only after a device passes Cloudflare Turnstile's check that a person is playing, and only at a person's speed. With the scrambled device ID, we note when the check passed and how fast picks come in.

November 6, 2026: your game progress is now also saved on our server, so you can get it back on a wiped or new phone, with a restore code and the cb_restore cookie that holds it. Before this, your rankings in progress, streak and settings stayed only on your device.

November 6, 2026, later: you can now mark cards you own and want (Own and ISO). Your collection is kept on your device and in your saved progress, like the rest of your progress.

November 6, 2026, night: Sign in with Discord is built, off for the public until it's checked, and this policy says what an account keeps (a scrambled Discord ID, display name, avatar, which saved progress is yours, a sign-in cookie). Also the Discord bot. Votes made through it are kept with a scrambled Discord user ID, one vote a person a day; nothing else about the Discord account is stored. Also: finishing a set or a master set is recorded (which set, how many times, when), with the rest of your progress. The first visit now finds your favorite card and starts your binder. Which cards are in your binder, and their order, is kept on your device and in your saved progress.