Privacy Policy for Seba

Last Updated: October 22, 2026

1. Who we are

Seba is a card game of mythical creatures published by Nathan de Castro ("we", "us"), on Android, iOS and the web (seba.coldsnap.fr). You open packs of cards, build a collection, add friends and trade cards. This policy explains what data the game handles and why.

2. Playing as a guest

You can play without giving any personal details. The game then creates an anonymous account (a random identifier) so your collection can be kept on our server. No name or email is asked.

3. What we store

• Account: a random user identifier and, only if you choose "Save my collection", your email address and password (Firebase Authentication stores the password in hashed form; we never see it).
• Display name: optional, chosen by you. It is shown to your friends, on the friends leaderboard and on the cards you were the first to find.
• Game data: your cards, packs opened, pack allowance, first finds, the cards you report, and when each happened.
• Friends and trades: your friend code, your friends list and the trade offers you send or receive.
• Notifications: if you allow the "packs ready" notification, your device's push token and app language.
• Purchases: if you buy the Deep Pouch, the store's purchase token or transaction id, so the purchase can be checked with Google Play or the App Store and restored. We never receive your payment details: the store handles payment.
• Crash reports: on Android and iOS, Firebase Crashlytics sends a report when the app crashes (device model, system version, app version, the error, and your random user identifier).

To protect the game from abuse, Firebase App Check confirms that requests come from the real app, using Play Integrity on Android, App Attest on iOS and reCAPTCHA on the web.

4. Why

We use this data only to run the game: to keep your collection, open packs on the server, let you trade with friends, send the notification you asked for, check purchases, and fix crashes. The legal basis is the performance of our agreement with you (the game) and our legitimate interest in keeping it secure and working.

5. What we do not do

• No advertising and no advertising identifier.
• No tracking across other apps or websites, and no analytics profiles.
• We do not sell or rent your data, and we share it only with the service providers below.

6. Service providers

Google Firebase (Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging, Crashlytics, App Check, Hosting) hosts and processes the data, mainly in the European Union. Some processing may happen outside your country under Google's data protection terms. Google Play and the Apple App Store process purchases under their own privacy policies. Data is encrypted in transit (HTTPS/TLS).

7. How long we keep data

Your data stays as long as your account exists. When you delete your account, your account, collection, friends, trade offers, push devices, first-find credits and purchase claims are deleted, and your identifier is removed from the cards you reported. Crash reports are kept by Crashlytics for 90 days.

8. Your rights

Under the GDPR and similar laws, you can access, correct, export or delete your data, and object to or restrict its processing. You can change your display name and delete your account directly in the game (see Delete Account). For any other request, email contact@coldsnap.fr. You can also complain to your data protection authority (in France, the CNIL).

9. Children

Seba is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

10. Changes

We may update this policy. The date at the top shows the latest version. Significant changes will be announced in the game.

11. Contact

• Email: contact@coldsnap.fr
• Game: https://seba.coldsnap.fr