Conclave is an independent fan project: a free, non-commercial game simulator, and a small shop selling Riftbound cards. We collect as little personal data as possible and we don't track you. When you buy from the shop we need some details to deliver your order. This page explains what we handle, and the rights you have under the EU General Data Protection Regulation (GDPR).
Who we are
Conclave (“we”, “the project”) is maintained by [YOUR FULL NAME OR BUSINESS NAME], who also runs the shop as the seller. For the purposes of the GDPR, [YOUR FULL NAME OR BUSINESS NAME] is the data controller for this website and the shop. The site is an unofficial fan project and is not affiliated with, endorsed by, or sponsored by Riot Games, Inc.
For privacy questions, or anything about an order, email us at [CONTACT EMAIL]. You can also use the feedback form.
The short version
- Browsing the site uses no analytics and no tracking cookies.
- If you buy from the shop, we receive your name, email, delivery address and what you ordered — only to deliver it and keep the records the law requires.
- Checkout runs on Shopify and you pay with PayPal. We never see your card or bank details.
- The feedback form collects only what you type, plus an optional contact you choose to give.
- The game at /play saves your decks and profile in your own browser — it stays on your device.
- You can ask us to access or delete anything we hold about you.
What we collect, and why
When you browse the site
We don't run analytics, advertising, or third-party trackers, and our fonts are self-hosted, so browsing doesn't send your data to third parties. Like any website, our hosting provider (Vercel) automatically processes technical information such as your IP address and browser type in server logs, for a short time, purely to deliver the site and keep it secure.
When you buy from the shop
While you shop, a single cookie (conclave-cart) remembers your cart — see the Cookie Policy. Checkout happens on a secure page run by Shopify, our shop platform. When you place an order we receive:
- your name, email address and, if you give it, phone number;
- your delivery and billing address;
- what you ordered, the amounts paid, and the order and delivery status;
- any messages you send us about the order (for example a return request).
We use this to process, pack and ship your order, to handle returns, refunds and questions, and to keep the invoices and order records that tax and accounting law requires. Your payment is processed by PayPal — we only see the payment status and the name and email on your PayPal payment, never your card or bank details.
We won't send you marketing emails unless you explicitly opt in at checkout, and every such email lets you unsubscribe. We don't use your order data for profiling or advertising.
When you use the feedback form
If you submit a bug report or feature request, we receive the category, title and details you write, and any optional contact (e.g. an email or Discord handle) you choose to add so we can reply. We use this only to understand, triage and respond to your report and to improve the project. Submissions are stored as issues in our private issue tracker on GitHub. Please don't include sensitive personal information, and don't submit other people's personal data.
When you play the game
The playable app at /playstores your decks, your guest name or profile, and preferences in your browser's local storage. This information lives on your device— we don't receive it or send it to a server. Clearing your browser storage for this site removes it (and deletes your saved decks). If a Google sign-in option is offered and you choose to use it, your Google account details are handled by Google under its own privacy policy.
Legal bases (GDPR Art. 6)
- Contract — processing, delivering and supporting your shop orders.
- Legal obligation — keeping invoices and order records as tax and accounting law requires.
- Consent — when you choose to send us feedback or contact details, or opt in to marketing emails.
- Legitimate interests — keeping the site and shop available and secure, preventing fraud, and understanding and fixing problems you report.
Who we share it with
We don't sell or rent personal data. We rely on a small number of service providers (processors) to run the project:
- Vercel — hosting and delivery of this website (privacy policy).
- Shopify— runs the shop's catalog, cart and checkout, and stores order records (privacy policy).
- PayPal — processes your payment, under its own privacy statement (privacy statement).
- Poste Italiane — receives your name, delivery address and phone number to deliver your parcel (privacy notice).
- GitHub — stores feedback submissions as issues (privacy statement).
- Google — only if you use an optional Google sign-in in the game (privacy policy).
International transfers
These providers may process data on servers outside the European Economic Area. Where they do, they rely on recognised safeguards such as the EU Standard Contractual Clauses or an adequacy decision.
How long we keep it
- Server logs: a short period, as set by our hosting provider.
- Orders and invoices: as long as tax and accounting law requires — in Italy, generally 10 years.
- Your cart: the
conclave-cartcookie expires after 10 days. - Feedback: kept while it's useful for fixing and improving the project, then removed.
- Game data: in your browser until you clear it.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to how we use it;
- receive your data in a portable format;
- withdraw consent at any time; and
- lodge a complaint with a supervisory authority — in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).
To exercise any of these, email us at [CONTACT EMAIL] or use the feedback form. We'll respond within the timeframe the GDPR requires (normally one month). Order records we're legally required to keep can't be erased before that period ends, but we'll keep them only for that purpose.
Children
This site isn't directed at children under 16, and we don't knowingly collect their personal data. If you believe a child has sent us personal data, contact us and we'll remove it.
Changes to this policy
We may update this policy as the project evolves. We'll change the “last updated” date at the top, and significant changes will be noted on the site.
See also our Cookie Policy for details on local storage and cookies.
This policy is provided in good faith for an independent hobby project and is written in plain language — it isn't legal advice. If your circumstances change (for example, if analytics, accounts or new sales channels are added), review and update it, ideally with a qualified professional.