Four Suit Studio
Gallery Gambit — Privacy Policy
Effective date: 22 July 2026 · Applies to the Gallery Gambit web game and mobile apps.
Gallery Gambit is a card game, not a data business. We collect the minimum needed to run online games, keep leaderboards fair, and make the computer opponents less terrible. This page explains exactly what that is, in plain language.
1Who is responsible
The data controller is Four Suit Studio (Robin Stokkel & Simone Luijk, based in the Netherlands, EU). For anything privacy-related, email robin@foursuitstudio.com.
2What we collect
If you create an account (email magic link, Google, or Apple sign-in):
- Email address and sign-in provider identifiers, stored by our authentication provider (Supabase). We never see your password — there isn't one.
- Your chosen nickname — permanent and unique, shown on leaderboards and in games.
- Gameplay data: games played, scores, daily challenge entries (score, round scores, thinking time, the moves you made), and multiplayer game logs. Move logs are also used to train and improve the AI opponents.
- Turn notifications (optional): if you enable them, a push subscription token for your browser or device.
If you play as a guest: a randomly generated identifier stored on your device (so reconnecting to a game works) and, if you post a daily score, the display name you type. No email, no real-world identity.
Basic technical logs: when the game loads we record an anonymous visit ping (browser user-agent, referring page, and screen-orientation events) to understand how the game is used. These pings are not linked to your account.
Device-local preferences (interface settings, your sign-in session, the guest identifier) stay in your browser's local storage and are not a server-side profile.
3Why we process it (legal basis)
- Running the game you asked for — accounts, matches, leaderboards, streaks, notifications you turned on (GDPR Art. 6(1)(b), performance of a contract).
- Improving the game — anonymous usage pings and using game move logs to train the AI opponents (Art. 6(1)(f), legitimate interest; move logs describe card plays, not your personal life).
- Optional features such as push notifications run only after you enable them and stop when you turn them off (Art. 6(1)(a), consent).
4Who processes it for us
| Service | Role | What they handle |
|---|---|---|
| Supabase | Authentication & database | Account data, nicknames, scores, game logs |
| Render (Frankfurt, EU) | Game server hosting | Live game traffic, server logs |
| Hostinger | Web hosting | Serves the game's website files |
These providers process data on our behalf under their own data-processing agreements. We don't share your data with anyone else, unless the law requires it.
5How long we keep it
- Account data (email, provider IDs, nickname): until you delete your account.
- Scores and game logs: kept to preserve leaderboards and train the AI. When you delete your account these are anonymized — the score and date stay, your identity is removed and replaced with “Deleted player”.
- Anonymous visit pings: kept as aggregate usage statistics; they were never linked to you.
- Push subscriptions: deleted when you disable notifications or delete your account.
6Deleting your account
You can delete your account yourself, at any time, inside the game: open the account panel (your email in the top corner) and choose Delete account. This permanently removes your sign-in and email, frees your nickname for others, and anonymizes your past scores. It cannot be undone.
Prefer email? Write to robin@foursuitstudio.com from the address on your account and we'll do it for you.
7Your rights (GDPR)
You can ask us at any time to:
- access a copy of the data we hold about you,
- correct it if it's wrong,
- delete it (see above — you can also do this yourself),
- receive it in a portable format,
- object to processing based on legitimate interest, or restrict processing while we sort out a dispute.
Email robin@foursuitstudio.com and we'll respond within 30 days. If you're unhappy with how we handle it, you can complain to your local data-protection authority — in the Netherlands that's the Autoriteit Persoonsgegevens.
8Children
Gallery Gambit has no age gate for simply playing, but accounts are meant for players aged 13 and up. We don't knowingly collect data from younger children; if you believe a child has created an account, contact us and we'll remove it.
9Changes to this policy
If we ever collect something new or change providers, we'll update this page and the effective date above. Substantive changes will be announced in the game.