Privacy Policy

Stakes, by Himongous LLC. Last updated 1 September 2026.

1. Who we are

Stakes is made and operated by Himongous LLC, which is the data controller for everything described here.

Privacy questions, and any request under section 8: privacy@himongous.com. Please write from, or name, the address or sign-in linked to your account so we can find it.

2. Your account, and why one exists at all

Stakes creates an account for you the first time you launch the game. You are not asked to sign up, and there is no password to invent — an account is simply what lets your rating, your books and your subscription follow you to a second device instead of being stranded on one.

What the account holds

• A device credential. Your device generates a random secret and keeps it. We store only a one-way hash of it. The secret itself never leaves your device except to prove to us that it is the same device.
• The display name you choose. This is public: opponents see it, and it appears on ladders and in match history.
• A sign-in id, if you use one. When you sign in with Steam, Discord, Google, Twitch, X or email, we store the opaque account id that service gives us for you — a SteamID, a Discord user id, and so on. We never receive and never store your password for any of them.
• A verified email address, where the provider gives us one. It is held for two purposes only: telling you when a sign-in method is added to or removed from your account, and support. Steam does not supply an email address, so a Steam-only account has none.

Email is never a key

An email address is never used to find, match or join accounts. Two accounts that happen to share an address are not connected, and will not be connected automatically. The sign-in id identifies your account; the address never does.

3. What else we collect

Play data	Rating, peak rating, games / wins / losses / ties, per-mode ratings, your saved decks, and the results of matches you play.
Payment	Handled entirely by Stripe. We hold a Stripe customer id, a subscription id, its status and renewal date, and a billing email address. We never see or store your card number.
Bug reports	Only when you send one: the category, the message you write, a replay of the match in question, and your client version.
Desync reports	When two players' games disagree about what happened, both clients automatically upload that match's replay so we can find the fault. It contains the match, not you.
Server logs	Our servers log IP addresses to stop abuse and rate-limit sign-in attempts. IP addresses are not stored in our database.

4. What we do not do

Each of these is a property of how the game and the site are built, not a promise of restraint:

• No advertising and no ad networks. We do not sell or share your personal information, and we do not process it for behavioural advertising.
• No third-party analytics and no trackers. This website makes exactly one external request, and it is to our own server.
• No cookies. The site stores your language choice in your own browser, and during checkout a short-lived security value that is erased the moment it is used. Neither is sent to anyone or used to profile you, which is why there is no cookie banner to click.
• No passwords. We do not have one to lose.
• No location, contacts, photos or device fingerprinting.
• No selling of game content. There are no loot boxes and no card packs, so there is no spending profile to build.

5. Signing in with Steam, Discord, Google, Twitch or X

When you sign in with one of these, we ask it for the minimum that identifies you: your account id there, and a verified email address where the service provides one. Where a consent screen appears, it lists exactly what is being requested.

Steam is different and worth stating plainly. If you launch Stakes through Steam, the game signs you in silently using Steam's own authentication — there is no consent screen because there is nothing extra being asked for. We receive your SteamID. We do not receive your Steam password, and Steam does not give us your email address.

Signing in tells that service that you used Stakes. It does not give us access to your account there, and nothing is ever posted on your behalf.

6. Who else processes your data

We use a small number of service providers, each doing one job:

• Fly.io — runs the game server. United States.
• Supabase — the database, replay storage, and the delivery of email sign-in codes. United States.
• Stripe — payments and subscriptions. Stripe is the merchant of record for your purchase and handles card data under its own privacy policy.
• Cloudflare — serves this website.
• The sign-in service you choose — Steam, Discord, Google, Twitch or X, under its own privacy policy.

These providers are in the United States. Where data is transferred out of the UK or the European Economic Area, that transfer relies on the European Commission's Standard Contractual Clauses or an equivalent approved mechanism.

7. How long we keep it

Account and play data	For as long as your account exists.
Match results	Kept as part of the competitive record.
Desync reports	Automatically deleted after 14 days.
Bug reports	Kept until the issue is resolved, or until you ask us to delete them.
Sign-in codes and tokens	Minutes. Single-use, and deleted the moment they are used.
Server logs	For a short period, per our hosting provider's retention.
Payment records	Held by Stripe for as long as tax and accounting law requires.

8. Your rights

Wherever you live, you may ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong;
• delete your account and the data attached to it;
• stop a particular use of your data, or object to it;
• and, if you are in the UK or the EEA, complain to your data protection authority.

Write to privacy@himongous.com. We will answer within 30 days.

On deletion. We remove your account, your sign-in methods, your decks and your ratings. Records of matches you played are retained without your account attached to them, because they are also your opponents' game history and their ratings depend on them. Payment records held by Stripe are kept where the law requires it.

9. Legal bases, if you are in the UK or the EEA

• Performing our contract with you — creating your account, matchmaking, keeping your rating, and running your subscription.
• Our legitimate interests — preventing cheating and abuse, rate-limiting sign-ins, and fixing faults from bug and desync reports.
• Legal obligation — tax and accounting records for purchases.

We do not rely on consent for any of this, and none of it is advertising or profiling.

10. Children

Stakes is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has an account with us, write to us and we will delete it.

11. Changes, and which version governs

If we change this policy we will update the date at the top, and we will tell you in the game or by email before anything material takes effect. This English text is the version that governs.