Privacy Policy

Last updated: September 27, 2026

This policy explains what information is processed when you use ElixirDeck (elixirdeck.org, the “site”), why it is processed, and your rights. The site is free and requires no account. We never ask for your name, email address or password.

1. Data controller and contact

The site's owner, ElixirDeck, is the data controller under the EU General Data Protection Regulation (GDPR) and Turkey's Personal Data Protection Law No. 6698 (KVKK). For any privacy question or request: hello@elixirdeck.org

2. Information we process

a) Player tag. When you use “Fetch my cards”, the Clash Royale player tag you enter is sent to our server. Our server uses it to retrieve your player name and card list from Supercell's official Clash Royale API, through RoyaleAPI's proxy server. This is game data that Supercell already makes publicly available. We do not store it in a database. To reduce repeated requests for the same tag, the response may be kept in our hosting provider's cache for a few minutes.

b) Data stored in your browser. The cards you select, their levels and the last player tag you entered are kept in your browser's local storage (localStorage) so you don't have to enter them again. This data stays on your device and is never sent to us. You can remove it at any time by clearing site data in your browser settings.

c) Technical logs. The site is hosted by Vercel Inc. As with any website, technical information such as your IP address, browser details and the requested page may be logged for a short time by the hosting provider to deliver the page and keep it secure.

d) Card images. Card images are loaded from RoyaleAPI's servers (cdn.royaleapi.com), so your IP address is visible to that server when your browser downloads them.

e) “Open in game” links. The “Open in game” button opens Supercell's link.clashroyale.com. Supercell's own privacy policy applies there.

3. Advertising

To keep the site free, we show or may show advertising. For this we may use third-party advertising services such as Google AdSense.

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this site or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet.
• You can opt out of personalized advertising in Google Ads Settings. You can also opt out of third-party vendors' cookies for personalized advertising at aboutads.info.
• More information: How Google uses information from sites that use its services.

For visitors from the European Economic Area, the United Kingdom, Switzerland and other regions where it is legally required, advertising cookies are used only after you give consent. You can withdraw your consent at any time. See our Cookie Policy for details.

4. Purposes and legal bases

• Providing the service (fetching cards by tag, suggesting decks, remembering your preferences): your request and necessity for providing the service (GDPR Art. 6(1)(b), KVKK Art. 5(2)(c)).
• Security and technical operation (server logs, preventing abuse): legitimate interest (GDPR Art. 6(1)(f), KVKK Art. 5(2)(f)).
• Personalized advertising and advertising cookies: your consent where required (GDPR Art. 6(1)(a), KVKK Art. 5(1)).

5. International transfers

Our service providers may operate servers outside your country, including in the United States and the European Union: Vercel (hosting), RoyaleAPI (API proxy and images), Supercell (game data) and advertising providers. The information described above may therefore be transferred internationally, only to the extent necessary to provide the service and in line with applicable law.

6. Retention

We do not store player data in our own database. Cached responses expire within minutes. Technical logs are subject to the hosting provider's retention periods. Data in your browser remains on your device until you delete it.

7. Your rights

Under the GDPR and KVKK you have the right to:

• know whether your personal data is processed and request information about it
• access your data and learn the purpose of processing
• know the third parties your data is transferred to
• have inaccurate data corrected and, where applicable, erased
• object to processing, restrict it, and withdraw consent you have given
• data portability, where applicable
• lodge a complaint with your local data protection authority

To make a request, write to hello@elixirdeck.org. We respond within 30 days.

8. Children

The site is not directed at children under 13, and we do not knowingly collect personal information from children.

9. Changes

We may update this policy from time to time. The current version is always published on this page with the date at the top.