Privacy Policy

This Privacy Policy explains:

• What information we collect about you
• How we use that information
• What information we share with others
• Your rights and choices about your information

We are Twisted Candies LLC (“Twisted Candies LLC”, “we”, or “us”). This Privacy Policy applies to The browser game Prism TCG, its website, and any other connected services or programs. (we’ll refer to this as the “Service”).

This Privacy Policy, together with our End User License Agreement, describes how we handle your personal data. Please read the End User License Agreement as well, for general guidance about your use of the Service.

We collect and process different types of personal data depending on how you interact with our Service. Here’s an overview of the information we collect:

Contact Information

When you interact with us (such as when you provide feedback or report issues, you request or receive customer or technical support, or participate in contests, surveys, and other promotional events), we collect certain contact information such as your email address, and name.

Account and Profile Information

When you create or update an account with us, we collect certain information to manage your account, including your, account creation date, account preferences, account settings, account status, display name/profile name, email address, login history, name, profile picture/avatar, and username. Some of this information may be tied to a third party account and is provided to us by that service provider.

We use this information to authenticate identity and secure access, create and manage your user account, enable account features (including recovery, personalization, preferences), enable multiplayer features, enable social features, enforce platform rules and security measures, track game progress, track purchases, and deliver watch rewards through Twitch Drops.

When you create an account we also ask for your date of birth. We use it to check that you are old enough to use the Service, and to give you a small in-game present on your birthday. Only you can see it, and it is deleted with your account. If you are under 13, we do not keep the date you entered, and the sign-in you made is deleted.

For counsel: The paragraph above is ours (14 October 2026), not yours: since your revision we ask for the full date of birth at sign-up, as you advised, and use it for one more purpose, a yearly birthday present (a card pack and a set of birthday emotes). Please confirm or rewrite it. Since 16 October an under-13 answer also deletes the sign-in at once, and the browser remembers the refusal for a day (a timestamp in local storage, no date and no account) so a reload cannot simply try an older date.

Service Usage Information

As you use our Service, we automatically collect information about your interactions, including your, Service customization settings, actions taken within the Service, content interaction history, content you created or uploaded, login times and frequency, pages/screens viewed, service settings, session duration, and user preferences. Ranked game information is stored and tied to your account for as long as your account exists while casual matches are only stored for 24 hours.

We use this information to enable multiplayer features (matchmaking, other multiplayer services), maintain competitive features (leaderboards, achievements), manage user preferences and settings, provide core functionality, save and sync progress across devices, and track gameplay statistics and history.

Device and Behavior Information

We automatically collect certain technical and analytic information from you and your device when you use our Service, including your device specifications (device type, model, OS, browser), gameplay statistics (progression, engagement, retention), network data (IP address, connection info), performance metrics (crashes, errors, load times), system information (performance, language, timezone), usage patterns (features accessed, time spent, navigation), and security reports that your browser sends automatically when it blocks content on a page.

We use this information to analyze user behavior and preferences, develop new features, ensure Service compatibility and performance, improve design and user experience, monitor system stability and performance, prevent fraud and abuse, and troubleshoot technical issues.

Location Information

We may collect information about your location when you use our Service, including your IP-based location. These addresses appear only in server and security logs in case there is an issue. You can control location data collection through your device settings.

We use this information to detect suspicious activity.

Transaction Information

When you make purchases or other transactions through our Service, we collect certain payment and transaction information, including your purchase history, refund history, transaction amounts, transaction dates, Stripe payment reference IDs, a record of consent to the purchase, and transactions made with in-game currency. Please note that we do not store complete payment card information - this is handled by our secure payment processors.

We use this information to comply with financial regulations, handle purchases, maintain purchase records, manage refunds and disputes, prevent fraudulent activity, and process transactions.

User Communication and Content

If you choose to use communication or content sharing features on the Service, we may collect any community contributions, feedback submissions, support tickets, user-generated content, and user reports that you transmit to us or other users through the Service.

We use this information to enable user-to-user interaction, investigate reported violations, maintain community standards, moderate user-generated content, improve localization, and answer support requests.

Beyond what is strictly needed to let you play, we may process gameplay telemetry — such as performance and balancing data and technical signals like lag, frame drops, and crashes — to fix problems and improve our Service. This telemetry is technical, but because it can be linked to you through identifiers, it is personal data.

We rely on our legitimate interest in improving our products. The in-game setting is on by default and lets you object and switch it off at any time; switching it off does not affect your ability to play.

We limit telemetry to what the purpose needs, secure it, and retain it only as long as necessary.

The setting is Send crash reports, in Settings.

• Technical Service Providers: We may share certain personal data with trusted service providers who help us operate and improve our Service, to backup and protect your data, deliver content efficiently, enable real-time features, host our services and store your data securely, manage databases and infrastructure, manage user authentication, monitor service performance and errors, process and route email communications, and provide content delivery services.
• Payment Processors: We share data with our third-party payment processors partners to comply with financial regulations, detect suspicious transactions, handle chargebacks, handle payment disputes, maintain payment records, prevent credit card fraud, prevent fraudulent transactions, process international payments, process payments and transactions, process refunds, reconcile payments and accounts, validate billing information, and verify payment methods.
• Social Platforms: When you utilize social functionality of the Service, we share data with social networks and other third parties to enable social login, enable streaming features, and provide social rewards.
• Legal Requirements: We may disclose personal data where required by law, legal process, or a government request, or where necessary to protect the rights, safety, or property of Twisted Candies LLC, our users, or others.
• Business Transfers: If we are involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, and it will remain subject to this Privacy Policy.

We only keep your personal data as long as it’s required to provide you with the Service. Sometimes a longer period might be required by law.

We retain personal data according to the following schedule of periods or criteria per category:

• Account, profile, card collection, and decks are kept while the account exists and deleted when the player deletes the account.
• Match rooms and live game state are deleted automatically after 24H after game ends
• Rank history and totals (win/losses/draw) are kept as long as the account exists
• Purchase records are kept for 7 years
• Server and security logs are kept for 90 days

After that, we will delete your personal data within a reasonable time.

Please note that we may retain some data, if necessary to:

• resolve disputes,
• enforce our user agreements,
• follow any technical and legal requirements related to the Service.

Our Service is not directed to children under 13, and we do not knowingly permit children under 13 to use it or knowingly collect their personal data. Where a product collects a date of birth or applies an age gate, we use that information for age assurance and children’s-privacy compliance and keep only what is necessary. If we learn we have collected personal data from a child under 13 without the consent required by law, we delete it. If you believe a child has provided personal data, contact us at privacy@prismtcg.gg.

• California: we will not sell or share the personal data of a consumer we know to be 13 to 15 years old without their opt-in consent.
• New Jersey: for consumers we know to be at least 13 and younger than 17, we obtain consent before any sale, targeted advertising, or covered profiling.
• Connecticut: for consumers we know (or willfully disregard) to be at least 13 and younger than 18, we do not sell personal data, deliver targeted advertising, or conduct covered profiling.
• Other states, including Maryland, impose heightened restrictions for known minors under 18, and we apply them where required.

EU/EEA: where processing relies on consent offered directly to a child, the digital-consent age is 13 to 16 depending on the member state; below the applicable age we make reasonable efforts to obtain or verify parental consent, or we do not offer the feature. UK: for services likely to be accessed by children we apply age-appropriate measures under the UK Children’s Code, including high-privacy defaults, data minimization, and limits on profiling.

We use cookies and similar technologies on the Service. To find out more about what cookies are and how we use them, see our Cookie Policy.

We believe in giving users control over their personal data. This section outlines your rights (some of which may be based on where you reside) and how to exercise them.

All Users:

Regardless of your location, you have the right to:

• Request deletion of your personal data
• Opt out of marketing communications
• Access and update your account information
• Control cookie settings through your browser
• Manage notification preferences

If you would like to exercise any of those rights, please email us at privacy@prismtcg.gg. We may ask for additional info to verify that you’re the owner of that data.

EU and UK Residents:

We are regulated under the General Data Protection Regulation (GDPR), which applies across the European Union. We are responsible as a controller of personal data for GDPR purposes.

We process your personal data under the GDPR and UK data protection law on these legal grounds: to perform our contract with you, by providing the Service and its features; our legitimate interests in keeping the Service secure, fixing errors, and improving it, which you may object to; compliance with our legal obligations; and your consent, where we ask for it, which you may withdraw at any time without affecting earlier processing.

If you are in the EU/EEA or the UK, you have rights under the GDPR (and UK GDPR) to access, correct, delete, restrict, and port your personal data, to object to processing and withdraw consent, and to lodge a complaint with your supervisory authority. To exercise any of these, email privacy@prismtcg.gg.

Additionally, UK residents have similar rights to the above under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For more information on your rights under the UK GDPR, you can visit the Information Commissioner’s Office (ICO) website at www.ico.org.uk.

US State Privacy Rights

Your rights depend on where you live, and we honor them where your state’s law provides them and applies to us. Not every right exists in every state (for example, Iowa and Utah provide neither a correction right nor a profiling opt-out).

Rights you may have

• Know and access the personal data we hold about you, including the categories, sources, purposes, and categories of third parties.
• Correct inaccurate personal data.
• Delete your personal data, subject to the exceptions permitted by applicable law (for example, completing a transaction you requested, security and fraud prevention, legal compliance, and exercising or defending legal claims).
• Receive a portable copy of your data.
• Obtain a list of the specific third parties to which we have disclosed your personal data, if you live in Oregon or Minnesota. Where your state’s law allows, we may instead provide a list of the specific third parties to which we have disclosed any personal data. For Oregon residents, the list does not include third parties who are individuals.
• Opt out of the sale or sharing of personal data, targeted advertising, and certain profiling.

Sale, sharing, and targeted advertising

We do not sell or share your personal data as those terms are defined under US state privacy laws, and we do not process it for cross-context behavioral advertising.

How to exercise your rights

• Email privacy@prismtcg.gg.
• For access, correction, deletion, and portability requests we may ask for information to verify your identity; authorized agents may submit requests with proof of authority; we respond within 45 days, extendable once by 45 days where permitted.
• Opt-out requests (sale, sharing, and targeted advertising) are not subject to identity verification and take effect without the verified-request process.
• Where your state grants an appeal right, you may appeal a denial by replying to our decision or emailing privacy@prismtcg.gg; if you remain unsatisfied you may contact your state Attorney General.
• We will not discriminate against you for exercising these rights.

California residents (CCPA/CPRA)

California residents also have the right to know the specific pieces of personal data we hold, the right to opt out of the sale or sharing described above, rights under California’s “Shine the Light” law, and the minors’ opt-in rights described in the children’s section. California residents also have the right to direct us to limit our use and disclosure of sensitive personal information to what is reasonably necessary to provide the goods or services you requested; to exercise this right, email privacy@prismtcg.gg.

Canadian Residents:

For Canadian residents, we handle personal information under PIPEDA and applicable provincial private-sector laws, including Quebec’s Law 25 and the Alberta and British Columbia PIPA. Under PIPEDA you may access and request correction of your personal information and withdraw consent, subject to legal or contractual limits that we will explain. Where provincial law provides additional rights — for example, Quebec Law 25’s data-portability right and its disclosures about decisions based solely on automated processing — we honor them. To exercise your rights, email privacy@prismtcg.gg.

Brazilian Residents:

We are regulated under the Lei Geral de Proteção de Dados (“LGPD”), which applies to Brazilian residents.

If you are in Brazil, you have rights under the LGPD to confirm and access your personal data, correct or delete it, request anonymization or portability, be informed about how we share it, and withdraw consent. To exercise any of these, email privacy@prismtcg.gg.

These rights apply to any personal data collected or processed in Brazil, as well as any personal data processed for the purpose of providing goods or services in Brazil.

Our headquarters is in the United States.

No matter where you live, by using the Service your personal data may be processed and transferred in the United States.

Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards — principally the EU Standard Contractual Clauses and the UK International Data Transfer Agreement or Addendum — with transfer-impact assessments and supplementary measures where needed, and we apply onward-transfer controls to our processors and other recipients. You can request information about these safeguards using the contact details below.

If you would like more information, please contact us (see “How to contact us” below).

We have taken steps and put security measures in place to prevent the accidental loss or misuse of personal data.

For example, we limit access to those who have a genuine business need. Those processing your information will do so only in an authorized manner.

We use other security measures, as well:

• Encryption at rest
• Encryption in transit
• Firewall
• Regular backups
• Role-based access controls

Lastly, we have procedures in place to deal with any suspected data security breach. We’ll notify you and any applicable regulator of a suspected data security breach when legally required.

We hope that we can resolve any questions or concerns you raise about our use of your personal data. Please contact us at privacy@prismtcg.gg to let us know if you have questions or concerns. We will do our best to resolve the issue.

For EU residents, the GDPR also gives you right to lodge a complaint with a supervisory authority. You may do this in the EEA state where you live, work, or where any alleged infringement occurred.

We last updated this Privacy Policy on November 1, 2026.

We may make further updates from time to time, which will be reflected in the latest version posted on the Service. For material changes, if we have your email address on file we will inform you via email; otherwise, we will post a message on the Service about the change. For material changes to processing that relies on your consent, we will obtain fresh consent where required; we do not treat continued use as agreement to materially new processing.

More than one document may apply to your use of our products: a title-specific in-game notice, our Cookie Policy, the applicable End User License Agreement, and this Privacy Policy.

• A title-specific in-game notice supplements this policy for that title’s specific processing and is presented to you before that collection begins. It does not reduce your statutory rights and does not override this policy where they conflict on those rights.
• Contractual terms (such as a EULA) do not displace the statutory privacy rights and disclosures in this policy.

Please contact us if you have any questions about this Privacy Policy or your personal data.

You can do so by sending us an email at privacy@prismtcg.gg.