Last updated: 24 August 2026

Privacy Policy

This policy explains how the Objection mobile game and playobjection.com handle personal data. The controller is Birol Aksu, at the address in the Impressum. Privacy questions and requests can be sent to contact@playobjection.com.

1. Data stored on your device

Objection stores settings, tutorial progress, the local card collection, earned Case Files, crafting progress and deck drafts on the device. Sign-in and session credentials are kept using the operating system’s secure-storage facility. Local data remains until you delete it in the app, clear the app’s data or remove the app.

2. Account and multiplayer data

• Guest accounts. The app sends a random installation identifier to create a device-bound guest account. The server stores only a keyed hash of that identifier. Guest accounts cannot be recovered on another device.
• Sign in with Apple. We receive the Apple account identifier and, when Apple supplies them, your name and email address. Apple controls its own processing under its privacy terms.
• Email accounts. We store the email address, display name, password salt and password hash. We never store the plain-text password. If you request a password reset, we send a short-lived code by email and store only a keyed hash of that code until it is used or expires.
• Profile and play. We store an internal user ID, display name, rating, win/loss record, saved ranked decks, matchmaking status, match actions and results, reconnect state, concessions and timeout outcomes. This is required to provide accounts, ranked play, match history, fair results and abuse prevention.
• Security and operations. The service processes session identifiers, IP addresses and limited request or error information to authenticate requests, enforce rate limits, diagnose failures and protect the service. Authentication tokens and guest identifiers are stored as server-side hashes where the service needs a durable record.

3. Why we process the data

Account, deck and match data is processed to provide the service you request and perform our agreement with you (Article 6(1)(b) GDPR). Security, fraud prevention, service reliability and preservation of competitive match integrity are legitimate interests (Article 6(1)(f) GDPR). Where consent is legally required, we ask before that processing begins.

4. What this release does not do

• No advertising, ad network or sale of personal data.
• No cross-app tracking or targeted advertising.
• No client gameplay analytics SDK.
• No access to contacts, photos, precise location, camera or microphone.
• No in-app purchase or payment data in this free release.

5. Service providers and transfers

Objection’s API and PostgreSQL database run on infrastructure provided by Hetzner Online GmbH. The public website is delivered through Vercel Inc. Sign in with Apple is provided by Apple. Transactional account emails and incoming messages addressed to playobjection.com are processed by Resend, Inc.; incoming messages are forwarded to the operator’s Outlook mailbox, provided by Microsoft. These providers process the limited account, message and technical data needed to deliver their services. A provider may process data outside your country under its applicable data-protection terms and legally required safeguards. Website fonts are served from the Objection domain.

6. Retention and deletion

Account and saved-deck data is retained while the account exists. Sessions expire or are revoked when you sign out or delete the account. Routine database backups cover the previous seven days and expire through rotation. Limited pseudonymous completed-match records may remain after deletion so that ratings, opponent histories and competitive results cannot be rewritten; they no longer contain the deleted sign-in identity or active public profile.

You can start account deletion inside Objection under Counsel Profile → Delete account. The full process is described on the account-deletion page. You may also email contact@playobjection.com if you cannot access the app; we will need to verify that the account is yours.

7. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or an objection to processing. You may withdraw consent where processing relies on consent. Requests can be sent to the contact above. You also have the right to complain to a data-protection authority; for a controller in Berlin, this is the Berlin Commissioner for Data Protection and Freedom of Information.

8. Children

Objection is a general-audience strategy game and is not directed specifically at children. A child should use account or online features only with a parent or guardian where local law requires permission.

9. Changes

If Objection adds a new use of personal data, this policy and the App Store privacy disclosure will be updated before that use begins. The revision date above identifies the current version.