What we store

If you create a club, we keep:

• your e-mail address, so you can log in and reset your password;
• a hash of your password. Not the password - we never have it, and we cannot tell you what it is;
• your club name, your language, your theme, your crest and your kit colours. The club name is shown to the people you play and on the ranking;
• your matches: the score, the cards each side played, every turn, and the share picture your own browser drew at the final whistle;
• your rating, your cards, your packs, your daily missions and your cup runs. That is the game;
• when the account was made and when it was last used.

We also count what happens in the game, in a table called events: a page being opened, a match starting, a match ending, an account being created, somebody coming back the next day. It is how we find out whether the game is any good. There is no advertising network in it and nothing is sold to anybody.

You can play without an account at all. Then there is no e-mail and no password, only a signed id in a cookie so the match you are in knows which side you are.

Cookies

Four, all of them ours, none of them for advertising: pm_session is your login, pm_auth is a flag that says a login exists so the page does not have to ask, pm_guest is the id of a player without an account, and pm_notrack is how we switch our own test runs out of the numbers. Your language and theme live in local storage, not in a cookie. There are no third-party cookies and no tracking pixels.

Who else can see it

Three companies, because they run things we do not:

• Railway runs the servers and the database. Data sits in their infrastructure in the EU and the United States.
• Resend sends our e-mail. They see your address and what the mail says - which is only ever a password reset link.
• Stripe takes the payments if you buy Pro. They get your e-mail and your club name; we never see your card. Nothing goes to Stripe if you never buy anything.

That is the whole list. Nobody else gets your data, and it is not for sale.

Deleting your account

On your squad page there is a Delete account button. It asks for your password and then, straight away: your e-mail is replaced with an address that cannot receive mail, your club name becomes "Retired club" everywhere including in old matches, the share pictures of those matches are thrown away, and your password stops working. You cannot log in again and we cannot undo it.

The matches themselves stay, without your name. They are somebody else's history too: the duel you lost last week is on their record, and it cannot have an empty side in it. If you had a Pro subscription, we tell Stripe to stop renewing it at the end of the period you already paid for.

How long we keep it

While the account exists. Delete it and the parts that point at you are overwritten the same second; the anonymous match record and the counted events stay, because the first belongs to your opponents and the second has no name on it. We do not have a backup that can bring a deleted account back.

Your rights

Write to privacy@golduel.com and ask for a copy of what we have about you, a correction, or deletion. One person reads that address, so give us a few days. You can also complain to your national data protection authority.

Children

Gol Duel is not meant for children under 13, and we do not knowingly keep data about them. If that has happened, mail us and it goes.

Changes

If this page changes in a way that matters, the date at the bottom changes with it. Last updated: 8 October 2026.