Last updated: 10 September 2026

Privacy Policy

This policy explains how the Objection mobile game and playobjection.com handle personal data. The controller is Birol Aksu, at the address in the Impressum. Privacy questions and requests can be sent to contact@playobjection.com.

1. Data stored on your device

Objection stores settings, tutorial progress, the local card collection, earned Case Files, crafting progress and deck drafts on the device. Older app builds may also hold an optional analytics preference and event queue; the replacement 1.1.0 build described below removes these. Sign-in and session credentials are kept using the operating system’s secure-storage facility. Local data remains until you delete it in the app, clear the app’s data or remove the app.

2. Account and multiplayer data

• Guest accounts. The app sends a random installation identifier to create a device-bound guest account. The server stores only a keyed hash of that identifier. Guest accounts cannot be recovered on another device.
• Sign in with Apple. We receive the Apple account identifier and, when Apple supplies them, your name and email address. Apple controls its own processing under its privacy terms.
• Email accounts. We store the email address, display name, password salt and password hash. We never store the plain-text password. If you request a password reset, we send a short-lived code by email and store only a keyed hash of that code until it is used or expires.
• Profile and play. We store an internal user ID, display name, rating, win/loss record, saved ranked decks, matchmaking status, match actions and results, reconnect state, concessions and timeout outcomes. This is required to provide accounts, ranked play, match history, fair results and abuse prevention.
• Security and operations. The service processes session identifiers, IP addresses and limited request or error information to authenticate requests, enforce rate limits, diagnose failures and protect the service. Authentication tokens and guest identifiers are stored as server-side hashes where the service needs a durable record.

3. Gameplay analytics removal

The replacement version 1.1.0 submitted in September 2026 removes optional gameplay analytics and its Settings switch. This build does not collect or upload optional gameplay events. On upgrade it discards earlier local analytics preferences and queued events without reading or transmitting them. When you sign in, it requests that the service disable prior analytics consent and delete your linked raw optional events. If cleanup cannot complete offline, the app retries on a later launch or foreground; collection remains removed.

Older app builds may still offer optional gameplay analytics, off by default. Only if you enable it, those builds send limited gameplay and interface events with your internal user ID, random session and event IDs, time, app version, build number, platform and current screen. They exclude typed text, support-message content and advertising identifiers. You can turn off that older switch, update to the replacement build, or contact us to withdraw consent. Necessary account, multiplayer, purchase and support processing described in this policy continues.

4. Website analytics

On playobjection.com, Vercel Web Analytics records anonymous, aggregated page-view information so we can understand which pages are visited and keep the website reliable. This may include the page path, referrer, approximate location, browser, operating system and device type. It does not use cookies, and its daily visitor identifier cannot be used to track you across different websites or days. We do not send custom events or information you type on the website. We process these statistics for our legitimate interest in operating and improving the public website (Article 6(1)(f) GDPR).

5. Purchases and support

• In-app purchases. Apple processes payment and storefront information. To verify, grant, restore, refund or revoke fixed, non-consumable Counsel Dossiers and consumable Case Files, we receive and store the product identifier, Apple transaction and original-transaction identifiers, purchase state and dates, storefront environment and the internal account identifier attached to the transaction. For paid Case Files, we also store the Apple-reported purchase quantity, purchase-grant, consumption and revoked counts, the refund or revocation percentage, and link each paid opening to its originating transaction. For a partial refund or revocation, we apply Apple’s percentage to the original Case File grant, round the result to a whole Case File and remove no more than the unconsumed balance. We remove all unconsumed Case Files for a full or legacy refund (an older Apple refund notice without a percentage) and prevent duplicate credits when a request is retried. If Apple reverses the refund or revocation, we restore exactly the number previously removed, and do so only once. Opened Case Files cannot be restored after use. We do not receive or store your full payment-card details.
• Support form. If you send feedback or ask for support, we process the category, message, optional reply email and any app diagnostics you choose to share. The backend sends that message through Resend to the operator support mailbox; domain mail may then be forwarded through Resend Inbound to the operator’s Outlook mailbox. Support-message text is not copied into the gameplay analytics database.

6. Why we process the data

Account, deck, match, purchase and support data is processed to provide the service you request and perform our agreement with you (Article 6(1)(b) GDPR). Purchase records may also be processed to meet accounting or other legal obligations (Article 6(1)(c) GDPR). Security, fraud prevention, service reliability and preservation of competitive match integrity are legitimate interests (Article 6(1)(f) GDPR). Optional product analytics in older app builds relies on your consent (Article 6(1)(a) GDPR).

7. What this release does not do

• No advertising, ad network or sale of personal data.
• No cross-app tracking or targeted advertising.
• Paid randomized Case Files disclose their odds, guarantees, duplicate protection and duplicate values in the Game before purchase.
• No access to contacts, photos, precise location, camera or microphone.
• No real-money trading, user-to-user transfer or cash redemption of cards, Case Files, Briefs or Counsel Dossiers.

8. Service providers and transfers

Objection’s API and PostgreSQL database run on infrastructure provided by Hetzner Online GmbH. The public website is delivered through Vercel Inc. Sign in with Apple and App Store purchases are provided by Apple. Transactional account emails, support-form delivery and inbound domain-mail forwarding are processed by Resend, Inc. Incoming messages addressed to playobjection.com may be forwarded to the operator’s Outlook mailbox, provided by Microsoft. These providers process the limited account, purchase, message and technical data needed to deliver their services. A provider may process data outside your country under its applicable data-protection terms and legally required safeguards. Website fonts are served from the Objection domain.

9. Retention and deletion

Account and saved-deck data is retained while the account exists. Sessions expire or are revoked when you sign out or delete the account. Linked raw optional analytics events are kept for no more than 90 days; daily aggregate counts that no longer identify individual players are kept for up to 24 months. Support emails are retained only as long as reasonably needed to answer and document the request. Database backup copies stored on the application host rotate after seven days. The live service does not currently create an off-machine backup copy; this policy will be updated before that processing begins.

Limited pseudonymous completed-match records may remain after deletion so that ratings, opponent histories and competitive results cannot be rewritten. Statutory purchase records may remain for accounting, refund, fraud-prevention and entitlement-audit purposes. These retained records no longer contain the deleted sign-in identity or active public profile. Optional linked analytics events and the consent record are deleted with the account.

You can start account deletion inside Objection under Counsel Profile → Delete account. The full process is described on the account-deletion page. You may also email contact@playobjection.com if you cannot access the app; we will need to verify that the account is yours.

10. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or an objection to processing. You may withdraw consent where processing relies on consent. Requests can be sent to the contact above. You also have the right to complain to a data-protection authority; for a controller in Berlin, this is the Berlin Commissioner for Data Protection and Freedom of Information.

11. Children

Objection is a general-audience strategy game and is not directed specifically at children. A child should use account or online features only with a parent or guardian where local law requires permission.

12. Changes

If Objection adds a new use of personal data, this policy and the App Store privacy disclosure will be updated before that use begins. The revision date above identifies the current version.