Privacy Policy

1. Information we collect

• Account — your email address and a password (hashed, never stored in plain text), or, if you sign in with Google, Discord, or Apple, the basic profile that provider shares (name, email, avatar).
• Profile — a display name, chosen avatar, region, and faction you set yourself.
• Gameplay — match results, decks, progression, currencies, and cosmetics, so your account works across sessions and devices.
• Purchases — when you buy in-game items, payment is handled by Stripe. We never see or store your card number; we keep only a record that a purchase happened (amount, item, date).
• Device & usage — standard technical data (IP address, browser/OS, and basic logs) needed to serve the Game and keep it secure.
• Notifications — if you opt in, a push-notification token so we can alert you to your turn or a new season. You can revoke this any time.

We do not sell your data, and we don’t run third-party advertising.

2. How we use it

• To create and run your account, save progress, and sync across devices.
• To match you with opponents, rank you, and run leaderboards and seasons.
• To process purchases and grant the items you buy.
• To send notifications you’ve opted into, and account emails (e.g. password reset).
• To keep the Game secure, prevent cheating and abuse, and diagnose problems.

3. Service providers

We share data only with the providers that operate the Game, each handling only what their job requires:

• Stripe — payment processing (privacy).
• Railway — application hosting and database.
• Cloudflare — real-time multiplayer infrastructure.
• Google, Discord, Apple — only if you choose to sign in with them.

4. Cookies & local storage

We use a session cookie to keep you signed in, and your device’s local storage for preferences (sound, visual settings). We don’t use advertising or cross-site tracking cookies.

5. Your rights

You’re in control of your data, directly in the Game:

• Access & export — download everything we hold on you as JSON from Settings.
• Deletion — delete your account from Settings. This removes your sign-in and personal data; match history is anonymized.
• Withdraw consent — turn off notifications, or stop using OAuth, any time.

Under the GDPR you also have the rights to access, correct, delete, restrict, and port your data, and to object to processing. We rely on these legal bases: performance of a contract (running your account and the Game),consent (notifications, optional features), and our legitimate interests(security, anti-cheat, improving the Game). You can withdraw consent at any time. If you believe we’ve mishandled your data, you may lodge a complaint with your local supervisory authority — in Portugal, the CNPD (Comissão Nacional de Proteção de Dados, cnpd.pt).

6. Data retention

We keep your data while your account is active. When you delete your account, personal data is removed and gameplay records are anonymized. Purchase records are retained as long as required by tax and accounting law.

7. Children

Pantheon is not directed to children under 13 (or the minimum age in your country, e.g. 16 in parts of the EU). We don’t knowingly collect data from children under that age; if you believe a child has, contact us and we’ll remove it.

8. Security

Connections are encrypted (HTTPS), passwords are hashed, and access to data is limited to operating the Game. No system is perfectly secure, but we take reasonable measures to protect your information.

9. Changes

We may update this policy as the Game evolves. We’ll update the date above and, for material changes, notify you in-game.

10. Contact

Questions or requests: [email protected].