Privacy Policy

1. Who we are

DCG Nexus ("DCG Nexus", "we", "us") is a Digimon Card Game community platform operated from the United Kingdom by Thomas Grant, trading as DCG Nexus. We are the data controller for the personal data described in this policy.

DCG Nexus is an independent fan platform. It is not produced, endorsed, supported, or affiliated with Bandai; card names, images, and related trademarks belong to their respective owners.

You can contact us about privacy matters at [email protected].

2. Scope of this policy

This policy is written to meet our obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, which is the law that applies to us as a UK-based controller.

DCG Nexus has users outside the UK, including in the EU and elsewhere. Rather than run separate policies for different regions, we apply the same standard, the protections and rights set out below, to every user of DCG Nexus regardless of where you are located. This will meet or exceed what most other privacy laws require. If you're located somewhere with data protection rights that go beyond what's described here, you can still contact us using the details in Section 13 and we'll do our best to help.

3. Information we collect

Account information

When you create a DCG Nexus account, we collect:

Your email address and a password (we never store your password in plain text, it's hashed and salted before it's saved)
A username you choose
Optional profile details you choose to add: your Bandai TCG+ membership ID, your home region/country, and avatar customization

Signing in with Google

If you sign in with Google instead of a password, we receive your Google account ID and the email address associated with it. We don't receive your Google password.

Content you create

Using DCG Nexus, you may generate the following, which we store against your account:

Decklists you build or save, including version history and, where a deck is shared, who else can edit it
Self-reported match results you log (opponent, wins/losses, deck played, tournament, and any free-text notes you add)
Team memberships and team-related information
Evidence files (e.g. photographs of a decklist) you upload as part of a decklist-amendment request

Information collected automatically

Usage/behavioural data: where enabled, we record events like decks viewed, similar-deck searches, and card searches, tied to your account or, if you're not signed in, an anonymous session identifier. These individual events are kept only briefly (see Section 8) before being rolled into aggregated, anonymised statistics.
Guest deck-building data: if you build a deck without an account, it's linked to a temporary browser session rather than your identity.
Standard technical/log data, such as IP address and browser information, collected as part of normal website operation and security.
Cookies, see Section 7.

4. How we use your information

We use your personal data for the following purposes, and on the following legal bases under UK GDPR:

Purpose	Legal basis
Creating and administering your account, letting you sign in	Performance of a contract with you
Storing and displaying decks, match records, and team data you create	Performance of a contract with you
Sending password-reset and account-related transactional emails	Performance of a contract with you
Reviewing decklist-amendment evidence you submit	Performance of a contract with you / legitimate interest in maintaining fair competitive records
Improving the site through aggregated usage analytics and behavioural telemetry	Legitimate interests (understanding and improving the product), balanced against your privacy, data is aggregated and short-lived
Non-essential cookies (analytics, advertising)	Your consent, given or withdrawn through the cookie banner
Keeping the site secure, preventing abuse, enforcing our Terms	Legitimate interests / legal obligation

6. International data transfers

Some of the providers listed in Section 5 (including Google and Cloudflare) may process data outside the UK, including in the United States. Where this happens, we rely on safeguards recognised under UK GDPR, such as the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, or a provider's adequacy status, to ensure your data is protected to a standard equivalent to UK law.

7. Cookies

We use cookies and similar technologies. You can manage your preferences at any time using the cookie preferences control available on the site (the icon in the bottom corner of the page).

Necessary cookies, always on, these keep you signed in, remember your cookie choices, and support features you're previewing before full release. We can't turn these off, the site won't work properly without them.
Analytics cookies (Google Analytics), help us understand how the site is used, on by default but you can opt out.
Advertising cookies, support personalization/advertising features, off unless you opt in.

We also use an anonymous session cookie for guests building decks without an account, this falls under "necessary" as it's how the deck-builder functions for logged-out visitors.

8. How long we keep your data

Account data is kept for as long as your account is active, and deleted or anonymised within a reasonable period after you close your account or request deletion.
Guest decks built without an account are kept for 30 days.
Individual behavioural telemetry events (e.g. a single "deck viewed" event) are kept for 30 days, after which they've already been folded into aggregated statistics and the underlying event is deleted.
Decks, match records, and team data tied to your account are kept until you delete them or close your account.
We may keep limited data longer where we're required to by law, or to resolve disputes and enforce our agreements.

9. How we protect your data

We use technical and organisational measures appropriate to the data we hold, including encrypting connections to the site, salting and hashing passwords before storage, and restricting internal access to personal data to what's needed to operate the platform. No method of transmission or storage is completely secure, but we work to protect your information and to respond quickly if something goes wrong.

10. Your rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete data
Erase your data (the "right to be forgotten"), for example by closing your account
Restrict how we use your data in certain circumstances
Port your data to another service in a structured, machine-readable format
Object to processing based on legitimate interests, including for analytics
Withdraw consent at any time for anything we do on the basis of your consent, such as non-essential cookies, without affecting anything already done before you withdrew it

To exercise any of these rights, contact us at [email protected]. We'll respond within one month, as required by law.

11. Children's privacy

DCG Nexus is not directed at children, and we don't knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal data, contact us and we'll delete it.

12. Changes to this policy

We may update this policy from time to time, for example as we add new features or change how we work with a service provider. We'll update the "last updated" date at the top of this page when we do, and for significant changes we'll take reasonable steps to let you know, such as a notice on the site.

13. Contact us and complaints

If you have questions about this policy or how we handle your data, contact us at [email protected].

If you're not satisfied with our response, you have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint or by calling 0303 123 1113. If you're based in the EU, you can also complain to your local data protection authority.