Duel Log Privacy Policy — Information on the processing of personal data
Last updated: 13 October 2026
This is a courtesy translation. In case of any discrepancy, the Italian version prevails.
This privacy policy is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter, the "GDPR") and describes how the personal data of the users of the Duel Log application (hereinafter, the "Application") are processed.
This privacy policy also applies to those who visit the duellog.net website without registering: in that case, only the technical browsing data referred to in Art. 2.4(c) are processed.
Art. 1 — Data controller
1.1 The data controller is IAGENCY, an independent group of developers not incorporated as a company, which develops and operates Duel Log (hereinafter, the "Controller").
1.2 For any request relating to the processing of personal data and for the exercise of the rights referred to in Art. 10, the User may write to info.duellog@gmail.com.
1.3 The Controller has not designated a Data Protection Officer (DPO), as the legal conditions for doing so are not met.
Art. 2 — Personal data processed
2.1 Data provided by the User. The Controller processes the following data, provided directly by the User:
a) email address and password; the password is stored exclusively in encrypted form by the provider of the authentication service and cannot be known by the Controller;
b) nickname, profile photo, background and frame;
c) Decks, with the related names, lists, hashtags, groups and covers;
d) recorded matches, with date, format, Decks used, opponent, result, duration and notes;
e) friendships, invites and duels with other users, as well as the list of blocked users;
f) report and feedback messages, associated with the nickname.
2.2 Data received from third parties. Where the User signs in through a Google account, the Controller receives from Google an account identifier, the email address and the basic data of the public profile (name and image), which the Controller does not use: the nickname is chosen by the User. The Controller does not receive the password, the contacts or any other content of the account.
2.3 Data entered by other users. Another user may record a match played with the User, indicating the User's nickname as the opponent.
2.4 Data generated by the use of the Application. The following are also processed:
a) where the User turns on push notifications, the technical address and the keys that enable the device to receive them;
b) the presence status (online or in a match), visible to the User's friends, which can be turned off from the Application's settings;
c) technical browsing data (IP address, type of browser and device, date and time of requests), logged by the infrastructure providers in order to ensure the operation and security of the service;
d) the language in which the User uses the Application, associated with the account and not visible to other users;
e) automatic reports of malfunctions of the Application: the technical error message, the point in the code where it occurred, the version of the Application, the screen that was open, the type of browser and device and the language, associated with the account and not visible to other users. They do not include the content entered by the User.
2.5 Data not processed. The Controller does not request first name and surname, date of birth, address, telephone number or geolocation data, and does not process payment data. The Controller does not intend to process special categories of data within the meaning of Art. 9 GDPR: the User is invited not to enter them in nicknames, notes or messages.
2.6 Camera. Where the User allows it, the device's camera is used for the sole purpose of reading the Application's QR codes. The images are processed on the device and are neither transmitted to the Controller nor stored.
Art. 3 — Purposes and legal bases of the processing
3.1 Personal data are processed for the following purposes and on the basis of the conditions of lawfulness set out below:
a) registration, management of the account and provision of the features of the Application, including the display of the profile, of shared Decks and of matches in common to other users: performance of the contract to which the User is a party (Art. 6(1)(b) GDPR);
b) sending of push notifications: consent of the User, which may be withdrawn at any time (Art. 6(1)(a) GDPR);
c) handling of reports and feedback and improvement of the service, including by means of aggregate counts, such as the number of accounts and their breakdown by language: legitimate interest of the Controller in the proper functioning and development of the Application (Art. 6(1)(f) GDPR);
d) security, prevention of abuse and establishment of breaches of the Terms: legitimate interest of the Controller in protecting the service and the users (Art. 6(1)(f) GDPR);
e) compliance with legal obligations and response to requests from the authorities: legal obligation (Art. 6(1)(c) GDPR).
3.2 The Controller does not process the data for advertising or profiling purposes and does not take decisions based solely on automated processing.
Art. 4 — Nature of the provision of data
The provision of the email address and password (or signing in through a Google account) and of the nickname is necessary for the creation of the account; failure to provide them makes it impossible to use the Application. The provision of any other data is optional.
Art. 5 — Recipients of the data
5.1 Other users. The following are visible to other users: nickname, profile photo, background and frame; the number of competitive matches played, the number of wins and the related percentage (Win Rate); shared Decks, to anyone who has the relevant link; matches in common, in the other player's history; the presence status (online or in a match), to friends and unless turned off. The email address, non-shared Decks, the match history and the detailed statistics are not visible to other users.
5.2 Data processors. The Controller uses the following providers, which process the data on its behalf pursuant to Art. 28 GDPR:
a) Supabase, for the database, authentication and image storage (servers in the European Union, Ireland);
b) Cloudflare, for the publication of the website and of the Application;
c) Netlify, for the registration and management of the duellog.net domain.
5.3 Independent controllers. The following process data as independent controllers:
a) Google, where the User chooses to sign in through their own Google account;
b) the providers of the device notification services (Apple, Google, Mozilla), where the User turns on push notifications;
c) the services from which the User's device directly downloads certain content, which receive its IP address: YGOPRODeck (card data and images), wsrv.nl and images.weserv.nl (image optimisation), Google Fonts (typefaces), jsDelivr and cdnjs (technical components).
5.4 The data are not disseminated or transferred to third parties for commercial purposes and are not disclosed to other parties, unless this is required by law or by an order of an authority.
Art. 6 — Transfer of data outside the European Economic Area
Some of the parties referred to in Art. 5 have their registered office or servers outside the European Economic Area, in particular in the United States of America. In such cases the transfer takes place subject to the safeguards provided for in Articles 45 and 46 GDPR, and specifically on the basis of the adequacy decision relating to the EU–US Data Privacy Framework or of the standard contractual clauses adopted by the European Commission. Further information may be requested from info.duellog@gmail.com.
Art. 7 — Storage tools on the device
7.1 The Application does not use profiling cookies or statistical analysis or tracking tools. The counts referred to in Art. 3.1(c) are derived from data already held in the account, without third-party tools and without observing the activity of the individual User.
7.2 The Application uses the browser's local storage (localStorage and cache) for exclusively technical purposes: maintaining the login session, storing preferences and sort orders, speeding up loading. Since these are tools strictly necessary for the provision of the service requested by the User, consent is not required pursuant to Art. 122 of Legislative Decree No. 196/2003.
7.3 The User may delete such data at any time from the browser's settings or by uninstalling the Application.
Art. 8 — Retention period
8.1 The data are retained for the following periods:
a) account data, profile, Decks, matches and friendships: until deletion of the account;
b) data relating to push notifications: until notifications are turned off on the device;
c) invites and duels in progress: for the time necessary for them to take place;
d) reports and feedback: for the time necessary to handle them;
e) technical browsing data: in accordance with the terms of the respective providers;
f) backup copies: for the technical period set by the database provider, after which they are overwritten;
g) automatic error reports: thirty days.
8.2 Deletion of the account. The User may delete their account on their own from the Application's settings. Deletion entails the erasure of the credentials, of the profile and of the related image, of the Decks, of the matches recorded by the User, of friendships, of the list of blocked users, of invites and of the data relating to notifications. Deletion becomes effective seven days after the request; within that period the User may cancel it by signing in to the Application again. The profile photo is removed at the time of the request.
8.3 The following remain stored, without any link to the deleted account:
a) matches recorded by other users in which the User appears as the opponent, with an indication of the nickname used at the time of the match;
b) copies of Decks shared via link, in anonymous form, and those saved by other users;
c) reports and feedback sent, until the end of the period referred to in paragraph 8.1(d), unless earlier erasure is requested.
Art. 9 — Minors
The Application is reserved for persons who have reached the age of fourteen, pursuant to Art. 2-quinquies of Legislative Decree No. 196/2003. The Controller does not knowingly process data of minors under the age of fourteen and, where it becomes aware of such processing, closes the account and erases the related data. Persons exercising parental responsibility may report such cases to info.duellog@gmail.com.
Art. 10 — Rights of the data subject
10.1 The User may exercise at any time, free of charge, the rights referred to in Articles 15 to 22 GDPR, and in particular:
a) obtain confirmation as to whether processing is taking place, access to the data and a copy of them;
b) obtain the rectification of inaccurate data;
c) obtain the erasure of the data;
d) obtain the restriction of processing;
e) object to processing based on the legitimate interest of the Controller;
f) receive the data provided in a structured, commonly used and machine-readable format (portability);
g) withdraw consent to push notifications, without affecting the lawfulness of processing carried out before the withdrawal.
10.2 Requests must be sent to info.duellog@gmail.com, preferably from the email address associated with the account. The Controller responds within one month of receipt, which may be extended in the cases provided for in Art. 12 GDPR.
10.3 A User who considers that the processing infringes the applicable legislation has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the Member State in which they reside or work.
Art. 11 — Security
The Controller adopts appropriate technical and organisational measures to protect the data, including the encryption of communications, the storage of passwords in non-reversible form and access rules applied at database level, by virtue of which each user may view and modify exclusively their own data. In the event of a data breach entailing a high risk for data subjects, the Controller gives notice thereof in the manner and within the time limits provided for in Articles 33 and 34 GDPR.
Art. 12 — Changes to this privacy policy
The Controller may update this privacy policy in the light of the evolution of the Application, of the providers used or of the legislation. Significant changes are communicated in the Application before they come into force.
Art. 13 — Contacts
info.duellog@gmail.com
IAGENCY