Privacy policy

Last updated 11 November 2026

AlleyWay Brawlers is an online trading-card fighting game made and run by a small independent team ("we", "us"). This policy explains what we collect when you play, why, who can see it, and how to delete it. Questions: support@alleywaybrawlers.com.

What we collect

• Your account: your email address, the username you choose, and your password. We never store the password itself, only a one-way scrambled version (a bcrypt hash) that can check it but not reveal it. We also keep whether your email is confirmed and, for a short time, the links in activation and password-reset emails.
• Steam: if you play the Steam version and sign in with Steam (or link Steam to your account), we keep your Steam ID, the number that identifies your Steam account, so we can sign you in. Steam confirms the sign-in to us; we never get your Steam password. The first time you sign in with Steam, we read your Steam display name once to suggest a username. A Steam account doesn't need an email address or password with us.
• Your game: your cards and packs, decks, Karat, Contraband and Dust, level and XP, rank, wins and losses, achievements, quests, daily rewards, clan mastery, your chosen clan, title, profile picture and card back, and when you last played. For each card you have played: how many matches you played it in and how many of those you won (its card XP and veteran frame). On the turf map: the influence you won for a clan in each district each week, and the weekly rewards you claimed.
• The auction house: the cards you put up for auction, their reserve and Buy Now prices, the bids you make, and who bought what for how much. To spot one person using several accounts to move cards or Karat between them, we also keep a scrambled form of the IP address you signed up from and of the ones you list and bid from: a one-way code that shows when two accounts used the same connection, not the address itself.
• Friends and messages: your friends list and friend requests, the direct messages you send and receive, and the messages in your in-game mailbox.
• Matches: the result of each online match, and recordings of your 3 most recent matches (the decks, the moves made and the players' names and profile pictures) so you can watch them back. We also keep match statistics that are not linked to any account (which clan and cards were in each deck, which were played, who won) to balance the cards.
• Purchases: if you buy Contraband, the payment is handled by Stripe. We never see or store your card details. We keep the payment reference, the bundle you bought and the Contraband it gave you. In the Steam version, you pay through your Steam Wallet and Valve handles the payment: we keep the Steam order number, your Steam ID, the bundle, its price and currency, and whether the purchase went through.
• Error reports: when the game hits an error, it sends us the game version, your operating system, the error message and where it happened, and your account id, so we can fix it. These are deleted after 30 days.
• Connection details: our server sees the IP address your game connects from. We use it to keep the service running and safe (for example, to limit repeated password guesses), and it can appear in our server's logs.
• Our website: when you visit alleywaybrawlers.com, we count the visit: for each day, how many people visited, how many pages they opened and which ones, how many were on a phone, and which site sent them (for example a search engine). We keep only those daily totals. To count each visitor once a day, the server makes a scrambled code from your IP address and browser that changes every day and is kept only in its memory for that day, never saved. The website sets no cookies and loads nothing from other companies.
• On your device: the game saves your settings and your sign-in session in its own folder on your computer. This stays on your device.

We don't use advertising, ad trackers or third-party analytics, and we don't collect your real name, address, phone number, contacts or location.

How we use it

• To run the game: sign you in, save your progress, match you with other players, and run matches and rewards on our server.
• To email you about your account: activation and password resets. We will only send news or offers if you have chosen to receive them.
• To fix bugs, balance cards, and stop cheating, abuse and attacks on the service.
• In the Steam version: to unlock the achievements you earn on your Steam account as well.

What other players can see

Your username, profile picture, title, level, rank and win record (on the leaderboard and your profile), the cards you play in a match and their veteran frames, replays of matches you played against them, and your username on the cards you sell in the auction house (bidders' names aren't shown). On the turf map, the player who won the most influence in a district for the clan holding it is shown by username. Direct messages are seen only by the person you send them to. Your email address and Steam ID aren't shown to other players.

Who we share it with

We don't sell or rent your information. We only share what's needed with the services that help run the game:

• Stripe, to take payments for Contraband (their privacy policy covers your payment details);
• Valve (Steam), if you play the Steam version: to confirm your Steam sign-in, to take Steam Wallet payments (we send your Steam ID and the item and its price) and to unlock your achievements on Steam. Valve's privacy policy covers what Steam does with your information;
• our email provider, to deliver activation and password-reset emails;
• DuckDNS, which points our web address at our server (it doesn't receive your game data).

We may also share information if the law requires it, or to protect players and the service from fraud or abuse.

How long we keep it

We keep your account and game data for as long as your account exists. Error reports are deleted after 30 days, finished auctions and their bids are deleted 90 days after they end, and only your 3 most recent match recordings are kept (a replay you save to your own computer is yours to keep). When you delete your account, everything listed above that belongs to it is deleted straight away, except purchase records: a record of each purchase (the Stripe payment reference, or the Steam order with your Steam ID; the bundle and what it cost) is kept without your account, so a payment can't be claimed twice and so we can handle refunds and keep the accounts we have to. The anonymous match statistics are kept, and other players' match history keeps the match without your account in it. Auctions you were running are cancelled (anyone who bid gets their Karat back), and auctions you finished stay in the other player's history without your account. Deleting your account here doesn't affect your Steam account.

Deleting your account and your other choices

• Delete your account in the game (Settings → Account → Delete account) or on the delete your account page. If you sign in with Steam and have no password with us, delete it in the game and type DELETE to confirm. This can't be undone.
• You can ask us for a copy of your data, or to correct it, by emailing support@alleywaybrawlers.com.
• Depending on where you live (for example in the UK, the EU or California), you may have further rights, such as to object to how we use your data or to complain to your local data protection authority. Contact us and we'll help.

Children

AlleyWay Brawlers isn't made for children under 13, and they shouldn't create an account. If you're under the age where you can agree to this policy yourself where you live, ask a parent or guardian first. If you think a child under 13 has made an account, contact us and we'll delete it.

Keeping it safe

Passwords are stored only as hashes, the game talks to our server over an encrypted (HTTPS) connection, and access to the server is restricted. No system is perfectly secure, so use a password you don't use anywhere else.

Where it's stored

Your data is stored on a server run by us. It may be in a different country from yours.

Changes to this policy

If we change this policy, we'll update the date above. If the change is significant, we'll tell you in the game before it applies.