Cookie Policy

1. What they are and how consent works

Cookies, localStorage and sessionStorage are small pieces of data the site saves on your device. In this document we call them “tracking tools”.

Technical tools, needed for the site to work, are always on and need no consent. Statistics tools switch on only if you accept them.

On your first visit we ask you to accept, reject or choose. Rejecting is as easy as accepting and does not limit use of the site. Until you choose, and if you reject, we switch on no statistical tracking. Closing the banner without choosing counts as a rejection.

If your browser sends the Global Privacy Control signal, we treat it as a rejection until you choose.

Your choice lasts 6 months, then we ask again. To prove we respected it we keep a record: date, choice, version of this document, an encrypted fingerprint of the IP and the browser.

You can change your mind at any time from the “Manage cookies” link at the foot of every page. For personal data in general see the Privacy Policy.

2. CardBrix technical tools (always on, no consent)

• bm_cookie_consent (first-party cookie, 6 months): remembers your cookie choice.

• cardbrix_token (localStorage, until logout): keeps you signed in.

• cardbrix_cart (localStorage, until you empty it): keeps the cart before sign-in.

• i18nextLng (localStorage, persistent): remembers the language you chose.

• bm_geo_lang_checked (localStorage, persistent): remembers that the language suggestion was already shown.

• cardbrix_intro_seen (localStorage, persistent): avoids replaying the opening animation on the same day.

• cardbrix_sell_draft_v1:<id>, cardbrix_auction_draft_v1:<id>, cardbrix_sell_guide_seen, cardbrix_auction_guide_seen (localStorage, persistent): the draft listing or auction you are writing and guides already read.

3. CardBrix the game: preferences on your device

These are functionality technologies we store only because you use the game, and they do not identify you to third parties. They need no consent.

• cardbrix_game_visible (localStorage, persistent): whether you chose to be visible to other players.

• cardbrix_game_tutorial_done:<id> (localStorage, persistent): whether you already completed the tutorial.

• cardbrix_game_return (sessionStorage, until the tab is closed): remembers where you were on the map when you come back from the website.

• cardbrix_game_rotate_dismissed (sessionStorage, until the tab is closed): remembers that you closed the “rotate your phone” hint.

The game and site fonts are hosted on our own servers: we do not contact Google Fonts or other external services to load them.

4. Necessary third-party tools

These services are essential for security and payments. They may set their own cookies and process technical data (such as the IP) under their own policies.

• Cloudflare Turnstile (Cloudflare, Inc., United States): anti-bot protection on sign-in and registration. Legal basis: legitimate interest. Transfer: EU-US Data Privacy Framework. [DA VERIFICARE: duration, to inspect in production]

• Stripe.js (Stripe Payments Europe Ltd, Ireland; Stripe, Inc., United States): secure payment and fraud prevention. Legal basis: contract and legitimate interest. [DA VERIFICARE: duration, to inspect in production]

• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg): payment, if you choose it. Legal basis: contract.

• Sign in with Google (Google Ireland Limited) and Sign in with Apple (Apple Inc.): the button, where shown on the sign-in and registration pages, loads a script from the provider. Legal basis: contract. See their policies for details. [DA VERIFICARE: whether loading should happen only on click]

5. Statistics tools (only with your consent)

These are first-party: the data stays on CardBrix and we do not share it with advertising networks.

• bm_visitor_id (first-party cookie, HttpOnly, 400 days): random visitor identifier to count unique visits.

• bm_session_id (sessionStorage, until the tab is closed): random session identifier.

With consent we record pages visited, visit duration (a periodic signal every 30 seconds), clicks on links and buttons (label, type and destination), events such as registration or sign-in, and the country derived from the IP. Legal basis: consent (Art. 6.1.a GDPR). We do not use this data for advertising profiling. If you withdraw consent, collection stops at once.

6. Marketing or profiling cookies

We use no marketing cookies, social-network pixels or third-party profiling tools. [DA VERIFICARE prima della pubblicazione]

7. How to manage, withdraw or delete cookies

• From CardBrix: use the “Manage cookies” link at the foot of the page; withdrawing is as easy as giving consent.

• From your browser: settings, privacy, cookies and site data (Chrome, Firefox, Safari, Edge). Deleting bm_cookie_consent brings the banner back.

• Global Privacy Control signal: turn it on in your browser or with an extension and we will respect it.

Blocking technical tools may prevent sign-in, the cart or the game from working.

8. Consequences of refusing

If you reject statistics tools nothing changes in using the marketplace or the game. If you block technical ones, some features such as sign-in, cart and payments may not work.

9. Controller and contacts

[DA COMPILARE: as in the Privacy Policy]. To exercise your rights write to [EMAIL PRIVACY]. You can lodge a complaint with the supervisory authority of your country: see the Privacy Policy.