Privacy Policy

Overview

AppLink is an independent Digimon Card Game companion for card search, collection tracking, account features, and related tools. This policy explains what information AppLink handles, why it is used, and when it may be processed by service providers.

Information you provide

When you create or use an AppLink account, AppLink may store your email address, display name, username, selected avatar, optional Bandai ID, account creation information, and other profile fields you choose to provide. Your Bandai ID and email are treated as private account information unless AppLink clearly tells you otherwise before you submit them.

AppLink also stores information you intentionally save through its features, such as collection printing identifiers and quantities, preferences, and other account-linked feature data.

Authentication and browser storage

AppLink uses Supabase for authentication and database services. Authentication sessions may be persisted in your browser so you can remain signed in. AppLink may also use local browser storage for interface preferences and other functionality you request.

AppLink's progressive web app may cache application assets on your device so the interface can load reliably. Cached application assets are separate from the account information stored in AppLink databases.

Google and Discord sign-in

AppLink offers optional sign-in through Google and Discord using Supabase Auth. If you choose one of these methods, the provider may send AppLink and Supabase basic identity information needed to authenticate your account, such as a provider account identifier, email address, and basic profile information made available by that provider. AppLink does not receive your Google or Discord password.

Information received through these sign-in methods is used to create or authenticate your AppLink account, associate the provider identity with that account, and help secure the sign-in process. It is not used to build advertising profiles or to access unrelated provider services.

For Google sign-in, AppLink requests only the OpenID, email, and basic profile permissions required for authentication. AppLink does not request access to Gmail, Google Drive, Google Calendar, contacts, or other Google service content. Discord sign-in is used only for account authentication; AppLink does not request access to private Discord messages or server administration.

AppLink does not intentionally store or use Google or Discord provider access or refresh tokens to make unrelated provider API requests. If AppLink later adds an integration that accesses additional Google or Discord data, this policy and the relevant consent flow will be updated before that access is used.

Technical and service information

AppLink and its infrastructure providers may process technical information needed to deliver and secure the service, such as IP address, browser or device information, request metadata, timestamps, and diagnostic or security logs. This information may be generated automatically when you access AppLink.

How information is used

AppLink uses information to:

• create, authenticate, and maintain your account;
• save and display your private account and collection data;
• send account, verification, password-reset, or service emails;
• operate, secure, troubleshoot, and improve AppLink;
• prevent abuse and investigate technical or security problems.

Service providers

AppLink relies on third-party infrastructure to operate. Current providers include Supabase for authentication and database services, Vercel for application hosting and delivery, Resend for transactional email, and, when you choose those sign-in methods, Google or Discord as third-party identity providers. Those providers may process information on AppLink's behalf or as part of the authentication service according to their own terms and privacy practices.

External links

AppLink may link to third-party services such as TCGplayer, Bandai, or other reference sources. When you follow an external link, the destination service controls its own data practices. AppLink's Privacy Policy does not govern those external sites.

Public and shared information

AppLink may add features in the future that let you intentionally share information, such as public profiles, decks, collection or trade lists, or other community content. Information will not be treated as public merely because such a feature is planned.

If a sharing feature is already available, only information you deliberately choose to share should be considered shared, subject to the visibility described by that feature.

Sale of personal information and advertising

AppLink does not sell personal information. AppLink does not use account or collection data to build advertising profiles. If AppLink later introduces advertising, analytics, or tracking that materially changes these practices, this policy will be updated before that change is relied upon for user data.

Data retention and deletion

AppLink may retain account and feature data while your account is active and for a reasonable period afterward when needed for service, security, backup, fraud-prevention, or legal purposes. Retention may differ by data type and by the systems used to operate AppLink.

You may request access, correction, or deletion of account data where applicable. AppLink will publish a dedicated privacy contact before public sharing features are launched. Until then, use AppLink's established support channel for account or privacy requests and do not post sensitive information in a public issue or forum.

Security

AppLink uses access controls and service-provider security features intended to protect account information. No internet service can guarantee absolute security, so you should use a unique password and protect access to your email account and devices.

Policy changes

This policy may change as AppLink adds features or changes service providers. Material changes will be reflected by an updated date on this page. Public sharing, new categories of personal information, advertising or tracking, and materially different uses of account data are all events that require a policy review.