What we collect, and why.
This policy covers The Traveller, CardClassics and this website. We keep it short and specific: it lists what each game actually stores, not what a game might one day store.
Last updated 2 November 2026
In short
- No ads, no tracking, no selling. We don't show ads, we don't use analytics or advertising SDKs, we don't track you across other apps or websites, and we never sell or rent your data.
- The Traveller keeps your game on your device. It has no accounts and sends nothing about you or your game to us.
- CardClassics needs an account (a guest account is fine) so others can play with you. It stores your profile, your games, and what you choose to share at the table. Voice messages are deleted within a day.
- You can delete your CardClassics account yourself, in the game, at any time. See Your choices.
“We” and “us” means Stupid Studios, which makes the games and is responsible for your data under this policy. You can reach us at support@stupidstudios.games.
The Traveller
The Traveller runs in your browser. There's no sign-in, no chat and no online play.
Stored on your device only
- Your save: the name you give your character, your progress, inventory, skills, where you are on the map, a log of recent in-game events, and the time you last saved. It's kept in your browser's local storage and never sent to us.
- Game files cached by the browser so the game loads faster and works offline.
You can copy your save as a “save code” to move it to another device, and erase it at any time from the game's menu. Clearing your browser's site data for the game also deletes it.
Sent when you load the game
- Like any website, your browser sends our server your IP address and browser details to download the game. Our server doesn't keep a log of these requests (our hosting provider's network may log them for a short time for security; see How long).
- Nothing is loaded from other companies: the game's fonts and map data come from our own server.
The Traveller doesn't ask for your location, camera, microphone or contacts. It may vibrate your phone during fishing, which needs no permission. The map comes with the game; your real location is never used.
CardClassics
CardClassics is played online with other people, so it needs an account. You can start as a guest (we make up a username for you) and later save it as a full account with your own username and password. We don't use Google, Apple or Facebook sign-in.
What we store, and why
| Data | What it is | Why |
|---|---|---|
| Account | Username, display name, avatar and colours, settings and favourite game. Your password is stored only as a one-way hash; we can't read it. | To run your account and show you to other players. |
| Email (optional) | Only if you add one, and whether you've confirmed it. Never shown to other players. | To confirm the address and let you reset your password. We don't send marketing email. |
| Photo (optional) | Only if you add one: the 512 px picture you cropped (never the original file), and whether everyone or only friends can see it. | To show it at the table and on your profile. |
| Your play | Matches and scores, ratings, stats, badges, seasons and leaderboard places, tournaments, Daily Deal results, shells (the in-game currency) and what you've spent them on. | To run the games, ratings, leaderboards and rewards. |
| Social | Friends, friend requests, who you've blocked or muted, clubs you're in (and club posts, pictures and invites), invite codes you used, and in-game notifications (the newest 100). | For the friends, clubs and invite features. |
| Table chat | Text messages (up to 120 characters), quick phrases and reactions at a table. | So the people at your table can talk. Deleted when the table closes. |
| Voice messages | Short recordings (up to 30 seconds) you choose to send by holding the microphone button at a table with other people. | So the people at your table can hear you. Deleted when the table closes, and after 24 hours at the latest. |
| Sign-in and devices | A sign-in cookie, the browsers you're signed in on (their user agent), and the IP addresses you play from (each kept for up to 90 days). | To keep you signed in, let you sign out other devices, keep invite rewards fair and stop cheating and abuse. |
| Error reports | When the app hits an error: the error, the page, the time, your account and your browser. Never your cards or what you type. | To find and fix bugs. Deleted after 14 days. |
| Activity counts | Which days an account was active. | To count daily players. Deleted after 120 days. |
| Reports | If you report a player, or someone reports you: the reason, the last 20 chat lines at that table, and, for a reported photo, the photo for 30 days. | So we can review the report and keep the game safe. |
| Push notifications (optional) | If you turn them on, the address your browser gives us for sending notifications. | To tell you when it's your turn, a friend invites you or a tournament starts. |
Permissions
- Microphone: asked for only the first time you hold the voice button. Recording happens only while you hold it. You can turn voice messages off in Settings, or deny the permission; the rest of the game works without it.
- Notifications: only if you turn them on.
- Photos: only the picture you pick when you add a profile or club photo. The game can't see the rest of your photos.
Stored on your device
CardClassics keeps your settings (theme, sound, vibration, voice on or off, card style), the order you arranged your cards in, which tips and banners you've dismissed, and an invite code if you came from one, in your browser's local storage. The sign-in cookie is the only cookie: it's needed to keep you signed in, lasts at most 7 days (24 hours if you're inactive), and isn't used for tracking.
This website
stupidstudios.games has no cookies, no analytics and no third-party scripts or fonts. If you switch between the light and dark theme, your choice is remembered in your browser's local storage on that device. Our server doesn't log your visits.
Who sees your data
Other players (CardClassics)
Your username, display name, avatar, photo (to everyone or only friends, as you choose), online status (to friends), stats, badges, ratings and leaderboard places are visible to other players. Chat and voice messages are heard and seen by the players and spectators at that table, except people who have blocked or muted you. Club posts are seen by the club's members.
Service providers
We use a few companies to run the games. They process data only on our behalf and only for these purposes:
- Hetzner Online (Germany): hosts our servers and the CardClassics database.
- Resend (USA, sending from Japan): sends account emails (email confirmation and password reset) to the address you give us.
- Your browser's push service (Google, Mozilla, Apple or Microsoft, depending on your browser): delivers notifications if you turn them on. A notification contains its text, which may include another player's name.
Nobody else
We don't sell, rent or trade personal data, and we don't share it with advertisers or data brokers. We would disclose data only if the law requires it, or to protect players or the games from fraud or abuse. If Stupid Studios or a game is ever sold, this policy would continue to apply to your data, and we would tell you first.
International transfers
Our servers are in the European Union. Resend may process data in the United States and Japan, and the push services in the United States; where that happens, we rely on the safeguards the law requires, such as the European Commission's standard contractual clauses.
Legal basis (EEA and UK)
We process your data to provide the game you asked to play (performance of a contract); to keep the games fair and safe, fix bugs and prevent abuse (our legitimate interests); and, for the microphone, notifications and your photo, because you chose to turn them on (consent, which you can withdraw at any time).
How long we keep it
| Data | Kept until |
|---|---|
| Voice messages | The table closes, or 24 hours, whichever comes first |
| Table chat | The table closes |
| Error reports | 14 days |
| Reported photos | 30 days after the report |
| Daily activity counts | 120 days |
| Removed profile photo | Deleted within a day |
| IP addresses | 90 days |
| Guest accounts | 12 months without being used, then deleted like a deleted account |
| Account, email, photo, friends, clubs, devices | You delete your account |
| The Traveller save | You erase it or clear your browser's data (it's never on our servers) |
| Hosting network logs | A short period set by our hosting setup, for security and troubleshooting |
Your choices and rights
Delete your CardClassics account
In CardClassics, open You → Settings → Privacy and data → Delete your account. It takes effect immediately. If you can't sign in, email support@stupidstudios.games from the address on your account, or tell us your username, and we'll delete it within 30 days. Full steps are on the Support page.
What is deleted: your password, email, photo, settings, friends, blocks, clubs, notifications, notification subscriptions, mutes (yours and other players' mutes of you), sign-in sessions, IP addresses and unused tournament entries, and your shells.
What is kept, without your details: past matches, scores and ratings stay so other players' results and leaderboards still add up; they show “Deleted player” instead of your name. Your username stays reserved so nobody can pretend to be you. Reports and moderation records are kept to keep the game safe. Error reports and activity counts expire on their normal schedule (14 and 120 days).
Your rights
Wherever you live, you can ask us for a copy of your data, to correct it, or to delete it, and you can object to how we use it. If you're in the EEA or UK you also have the right to restrict processing, to data portability and to complain to your data protection authority. If you're in California, you have the right to know, delete and correct your personal information, and not to be discriminated against for using these rights; we don't sell or share personal information as California law defines it. Email support@stupidstudios.games; we answer within 30 days and may ask you to confirm the request comes from your account.
Turning things off
- Turn off voice messages, sounds or vibration in CardClassics' Settings, or deny the microphone permission in your browser.
- Turn off notifications in CardClassics or in your browser's settings.
- Remove your photo, or show it to friends only, from your profile.
- Block or mute any player; you won't see or hear them at tables.
Children
Our games aren't directed at children under 13, and CardClassics lets players chat and send voice messages to people they don't know. You must be at least 13 to create a CardClassics account (or older, if your country requires it for using online services without a parent's consent). If you believe a child under 13 has given us personal data, email support@stupidstudios.games and we will delete the account.
Security
All traffic to our games is encrypted (HTTPS). Passwords are stored only as hashes, and sign-in cookies are stored only as hashes on our side, can't be read by scripts, and expire. Only the people who run the games can access the database. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities as the law requires.
Changes
When a game starts collecting something new, we update this page first and change the date at the top. If a change is significant, we'll also say so in the game.
Contact
Questions or requests about your privacy: support@stupidstudios.games. Anything else: hello@stupidstudios.games.