← Back

Lordfall™ Privacy Policy

Last updated: October 10, 2026

1. Who we are

Lordfall ("the Game") is made by Cardboard Throne Games LLC, a Kansas limited liability company ("we", "us"). We are the "controller" of the personal information described here.

Contact for privacy questions and requests: support@lordfall.com
Mailing address: 8743 W 121st Terrace, Overland Park, KS 66213

This policy goes with our User Agreement. If anything here is unclear, email us.

2. The short version

• We collect what we need to run an online card game: an account, your collection and decks, your games, your chats with friends, and a few safety records.
• We don't sell your personal information, and we don't show ads.
• Other players can see your display name, emblem, colour, title, crest, favourite faction, rank and record, and what you do in a game with them. They can't see your email.
• Friends you accept can message you, and can watch your online games (after a short delay, with your hand and deck hidden) if you allow it. You can turn watching off.
• You can delete your account yourself (the bottom of the Profile screen → Delete my account), or ask us at the address above. Section 6 says exactly what is deleted and what is kept.

3. What we collect

A. Information you give us

B. Information the Game creates while you play

• Your collection (cards, Lords), Gold, Dust, Diamonds, packs, missions, decks, settings, achievements, daily login progress and stats.
• Your Faction Pledge choice and wins, and cosmetics you earned (card backs, alternate art).
• Your challenges, queue entries and matches. This includes the whole game state, the moves made, and the result. In Ranked games we also record every input you make, so our server can check the game against the rules. For games others are allowed to watch, we keep a delayed copy of the game with hands and decks hidden, and a list of who is watching.
• Your Draft, Sealed and Tournament entries: your picks, packs you opened, the deck you built, your wins and losses, prizes, and your tournament seat and result.
• Emotes you send during a game.
• Your rank, season history, event (Weekend Ladder) points and rewards, and Mailbox messages and claims.
• Your first-week quest rewards and any Diamonds or Gold exchanges you make.
• When you were last active in an online game (a check-in every 15 seconds, used for the disconnect and idle rules), and when you join or leave a game you watch.
• Records about timeouts, surrenders, reports, and games our automatic checks flagged, to enforce the rules.

C. Technical information

• Our providers (Supabase for the database and Cloudflare for the website) automatically receive technical data such as your IP address, browser type and the time of each request. We use it to run and protect the Game. Supabase keeps server logs for a limited time.
• Our own usage log (the "event log"). To understand how the Game is used and to find crashes, the Game records simple events in our own database: screens you open, when a game starts and ends and its result, packs opened, crashes and errors. Each record carries a random device identifier created in your browser and, if you are signed in, your account identifier. It does not contain your name, email, passwords or the contents of your decks. Records are deleted automatically after 180 days.
• Invite requests (Oct 11). If you ask for an invite code on lordfall.com, we keep the email address you typed, the invite code we made for it, and a one-way scrambled form of your network address (to stop abuse). We use them only to email you that code, and we delete them 30 days later. We don't add you to any mailing list.
• Invite links. If you join through a friend's link, we record which friend invited you, so we can give you both a free pack once you have played your first game (a streamer's link gives the pack right away). The friend only sees how many friends joined, not who they are.
• We don't use third-party analytics, advertising or tracking tools.

D. Information stored on your device

The Game saves a few things in your browser's local storage: your sign-in (a refresh token, so you stay signed in), your settings (game speed, sound, music, volume, graphics level, accessibility options, card-detail style, chat mute), which tutorials, puzzles and first-time rewards you finished, replays of your last few games, some progress counters used for achievements, the random device identifier used by our usage log, and (for guests) your local profile and collection. These are needed for the Game to work. They aren't used for tracking. Clearing your browser data removes them.

If you turn on turn alerts, your browser may ask permission to show notifications. You can say no, and you can change it in your browser settings.

E. Payments (not available yet)

Today no real-money purchases exist, and Diamonds can't be bought with money. When we add them, they will be handled by a payment provider (for example Stripe or Paddle). The provider will collect your payment details; we won't see or store your card number. We will receive confirmation of what you bought, the amount, and a transaction reference. We will update this policy before purchases launch.

4. How we use information

• To run the Game: accounts, collections, matchmaking, ranked play, Draft, Sealed, Tournaments, events, rewards and the Mailbox.
• To let friends talk to each other and, if you allow it, watch your games.
• To keep it fair and safe: stopping cheating (including checking Ranked games against the rules on our server), win-trading, harassment, ban evasion and name abuse, and handling reports.
• To contact you: sign-in and password-reset codes, security notices, and important changes to the Game or our terms. We only send marketing email if you agree to it, and you can opt out at any time.
• To fix bugs, balance cards and improve the Game, using game results and the usage log.
• To meet legal obligations and to protect our rights.

If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, our legal reasons (bases) for using your information are:

• To perform our contract with you (providing your account, collection, matches, chat, rewards and the Mailbox);
• Our legitimate interests (keeping the Game secure and fair, preventing cheating and abuse, fixing bugs and improving balance), which we balance against your rights;
• Your consent (marketing email, if offered, and the usage log for EEA/UK players once the consent notice exists), which you can withdraw at any time; and
• Legal obligation (for example tax and accounting records).

5. Who we share it with

We don't sell your personal information and we don't share it for advertising. We share it only with:

• Other players: the public profile items listed above; your chat messages with the friend you sent them to; and what happens in games you play with them. If you allow watching, accepted friends who watch see a delayed view of your game with hands and decks hidden, and see that you are in a game.
• Service providers who run the Game for us: Supabase (database, sign-in, live notices and the server function that checks Ranked games; servers in US East), Cloudflare (hosts and delivers lordfall.com, and runs the "Turnstile" bot check shown when you create an account, which receives technical data such as your IP address and browser details to tell people from bots), Resend (sends account emails such as password reset codes), and a payment provider if and when we add real-money purchases. They may only use the data to provide their service to us.
• Our Discord community (optional): if you join our Discord server, Discord's own privacy policy applies to what you do there. We don't link your Discord account to your Lordfall account.
• Legal and safety: if the law requires it, to answer a valid legal request, or to protect someone's safety or our rights.
• A business transfer: if we sell or merge the business, your information may move to the new owner, who must follow this policy.

6. How long we keep it, and what happens when you delete your account

• Account data is kept until you delete your account.
• Usage log records are deleted automatically after 180 days.
• Invite requests (email, code, scrambled network address) are deleted after 30 days.
• Finished game records (results, ranks) are kept until an account in the Game is deleted.
• Chat messages are kept until they are deleted. There is no automatic deletion today.
• Backups may keep deleted data for up to 30 days before it's overwritten, if backups exist.
• Server logs are kept by our providers for a short time (usually days to weeks).
• Payment and tax records are kept as long as the law requires (once purchases exist).

When you delete your account (the bottom of the Profile screen → Delete my account, or by email), we delete your sign-in and the records tied directly to it: your profile, collection, decks, friends list, friend requests and challenges, Mailbox messages, queue entries, rank, event scores, survey answers, and public player card. Any game in progress is forfeited. Every game you played is deleted too, which also removes it from your opponent's history. Reports you filed or that were filed about you are kept, with your name and email removed, so we can enforce our rules for up to 2 years.

Records not yet removed automatically. Records that are not tied to your account by a database link are not deleted by the button today: your chat messages (those you sent and those you received), your Draft, Sealed and Tournament entries and results, your Faction Pledge progress, records of which games count for a Pledge or an event, checks of games our system flagged, and the list of games you watched. After you delete your account these are no longer connected to a name, email or profile, but they still carry an internal identifier. We will delete them on request at support@lordfall.com.

7. Your choices and rights

• See, correct or delete your information: you can change your profile in the Game and delete your account in Profile → Delete my account. For anything else, email support@lordfall.com. We'll reply within 30 days.
• Friends and chat: you can remove a friend, mute chat, and turn off "Let friends watch my games" (in Friends and Options). You can report a message or a player.
• Marketing email: opt out at any time with the link in the email or by asking us.
• California (CCPA/CPRA): you may ask what we collected, ask us to delete or correct it, and ask us not to sell or share it. We don't sell or share personal information for advertising. We won't treat you worse for using these rights.
• EEA, UK and Switzerland (GDPR and UK GDPR rights): you may ask for access to your information, correction, deletion, a copy in a portable format, restriction of processing, and you may object to processing based on our legitimate interests or withdraw consent at any time. You also have the right to complain to your local data-protection authority (in the UK, the Information Commissioner's Office, ico.org.uk). We don't make decisions about you based only on automatic processing that has legal or similarly significant effects. (Automatic checks such as the name filter, the chat word filter, timeout losses, the game-move check and anti-cheating rules are reviewed by a person if you ask.)
• EU and UK players: we don't currently have an appointed representative in the EU or UK. You can contact us about your information at support@lordfall.com.
• Cookies and similar technology: we only use storage that's needed for the Game to work (section 3D), so there is no cookie banner right now.

8. Children

The Game is for people 13 and older. We don't knowingly collect information from children under 13. If you think a child under 13 has an account, email us and we'll delete it. In some countries the minimum age to agree to online services without a parent is higher than 13 (for example 14 to 16 in parts of the EU); if that applies where you live, a parent or guardian must agree for you. Chat is only between accepted friends.

9. Security

Passwords are stored as hashes. Other players can only reach the data the Game is built to share (the database is locked down with row-level security, and economy changes only happen through server functions). Watchers only receive a copy of the game with hidden cards removed. No system is perfectly secure, so we can't promise absolute security. In particular, the full state of a live game, including both hands and the order of the decks, is currently shared between the two players' browsers, so a technically skilled player could read it; we are working on hiding it. If a breach affects your information, we'll tell you and any authority as the law requires.

10. International transfers

Our database is hosted in the United States (Supabase, US East). If you play from outside the US, your information is sent to and stored in the US, which may not have the same data-protection laws as your country. When we transfer information from the EEA, UK or Switzerland, we rely on safeguards such as the European Commission's Standard Contractual Clauses and the UK addendum, which our providers offer in their data-processing agreements.

11. Changes to this policy

We may update this policy. If the changes are important we'll tell you in the Game (through the Mailbox) before they take effect. The "Last updated" date at the top shows the latest version.

12. Contact

support@lordfall.com · Cardboard Throne Games LLC, a Kansas limited liability company, 8743 W 121st Terrace, Overland Park, KS 66213

← Back