Games Privacy Policy

Effective date: October 10, 2026

This policy explains what information Carew Enterprises LLC, a Florida limited liability company doing business as Darkspace Press (“Darkspace Press,” “we,” “us”), collects through our games, and what we do with it. It covers:

Spellstick Live, the real-time spellstick game you play against the computer
Spellstick Cardgame, the spellstick card game, played against the computer or online against other players, including inside Discord as the Discord Activity “Spellstick - The Card Game”
the Discord apps we run for these games: the Darkspace Games sign-in app, the Spellstick Live app, and the Spellstick - The Card Game app
the games page at games.darkspace.press

The games are hosted at games.darkspace.press and its subdomains. While we finish setting up those addresses, the games can also be reached at temporary Microsoft Azure addresses ending in azurecontainerapps.io. This policy applies at those addresses too.

The Darkspace Press store at darkspace.press has its own privacy policy. Discord has its own privacy policy. HexBot, our Discord coin bot, is a separate app and isn’t covered by this policy. The games don’t exchange any information with HexBot.

The short version

You sign in with Discord. We never see your Discord password or email address.
Spellstick Live keeps nothing about you on our servers. Your sign-in lives in a cookie in your browser.
Spellstick Cardgame keeps a small account for online play: your Discord ID, username, and avatar, the manager name you choose, and your online matches.
Playing Spellstick Cardgame against the computer needs no account and stores nothing about you.
There are no ads, no analytics, and no trackers, and we don’t sell your information.
Email us to see or delete your information.

What we collect and why

When you sign in with Discord

Both games use Discord to sign you in. Discord asks you to approve two permissions:

identify: your Discord user ID, username, and avatar.
guilds.members.read: whether you are a member of the Darkspace Press Discord server, when you joined it, and which of its roles you have. We only ask about our server. We use this to check whether your roles let you play, and whether you are a moderator or admin.

Discord gives our server a temporary access key for these lookups. We use it during sign-in and then discard it. We don’t store it, and we can’t read your messages or post as you. We don’t receive your email address or password.

Spellstick Live

After you sign in, your Discord user ID, username, avatar, and access role (player, moderator, or admin) are put in a sign-in cookie in your browser. The cookie is signed so it can’t be changed, and it lasts 30 days or until you sign out. We don’t keep a copy on our servers.

The game also remembers your team choices, difficulty, and whether you muted the sound, in your browser’s local storage. That stays on your device.

Spellstick Cardgame

Against the computer: no account, no cookies, and nothing stored.

Online: when you sign in, we keep an account with:

your Discord user ID, username, and avatar, to recognize you (refreshed each time you sign in)
your access role in our Discord server (player, moderator, or admin)
when your Discord account was created (worked out from your user ID) and when you joined our Discord server. We keep these to protect future features, such as trading, from throwaway accounts. Nothing uses them yet.
the manager name you choose, which other players see
when your account was created, when you last signed in, and when you were last active
your online matches: who played, the teams, every move each player made and when, the time left on each player’s clock, and the result
your sign-in sessions. We store only a scrambled (hashed) copy of your sign-in cookie, so a copy of our database couldn’t be used to sign in as you.

Inside Discord

When you launch Spellstick - The Card Game inside Discord, Discord asks you to allow two permissions: identify and rpc.activities.write. We use them only to show what you’re doing on your Discord profile, for example “In the menu” or “Playing the computer · Turn 4 · 1–0”. Our server exchanges Discord’s one-time code for an access key and hands it to the game in your Discord app. We don’t store it. While you play inside Discord, Discord’s servers carry the traffic between you and our server.

The games page

The page at games.darkspace.press sets no cookies and stores nothing. It loads fonts from Google Fonts, so your browser contacts Google, which receives your IP address and browser details. It also shows books and merchandise from the Darkspace Press store, so your browser contacts darkspace.press to fetch the listings. No cookies are sent with that request.

Server logs

Our servers keep technical logs so we can keep the games running and look into problems. The logs record the type of request and the page or API path (without any query string), the response status and timing, and errors. For Spellstick Cardgame they also record our internal account number when someone signs in, and the Discord user ID when a sign-in is refused (for example, because the person isn’t in our Discord server). Our games don’t record IP addresses. Microsoft Azure, which hosts the games, may process IP addresses as part of running its network.

What we don’t collect

We don’t collect your email address, password, payment details, Discord messages, friends list, other servers, location, or contacts. The games have no chat and don’t use your microphone or camera. We don’t use analytics, advertising, or tracking tools.

Why we’re allowed to use it

If you’re in the European Union, the United Kingdom, or another place with similar laws, these are our legal bases:

What we do	Legal basis
Signing you in, running your account, and refereeing your online matches	Providing the game you asked to play (performance of a contract)
Checking your Discord server membership and roles, keeping account dates to prevent abuse, security, and server logs	Our legitimate interest in running secure, fair games for our community
Showing your game status on your Discord profile	Your consent, given in Discord’s prompt. You can withdraw it at any time by removing the app under Authorized Apps in your Discord settings.
Sign-in cookies and remembered settings	Strictly necessary for the game you asked to use

Who we share it with

We don’t sell or rent your information, and we don’t share it with advertisers. It goes only to:

Other players: your manager name, and the matches you play with them. Each player sees only their own view of a match, so hidden cards stay hidden.
People who can see your Discord profile: your game status, if you play inside Discord.
Discord: to sign you in and to run the game inside Discord. Your browser loads avatar images directly from Discord, so Discord sees your IP address. See Discord’s privacy policy.
Microsoft Azure: hosts our servers, database, and logs, and processes this information on our behalf. See Microsoft’s privacy statement.
Google: serves the fonts on the games page. See Google’s privacy policy.
Others, when required: if the law requires it, to protect people’s rights or safety, or as part of selling or transferring our business.

Where it’s stored

Everything we store is kept in the United States, in Microsoft Azure’s East US 2 region. If you play from outside the United States, your information is transferred to and processed in the United States.

How long we keep it

Spellstick Cardgame account and matches: until you ask us to delete your account.
Spellstick Cardgame sign-in sessions: they expire after 7 days. Signing out removes yours immediately.
Spellstick Live sign-in cookie: 30 days, or until you sign out. Nothing is kept on our servers.
Server logs: 30 days.
Database backups: Azure keeps automatic backups for 7 days, so deleted information can remain in a backup for up to 7 days before it’s gone.
Local storage in your browser: until you clear it.

Your choices and rights

Email us at admin@darkspace.press to:

see the information we hold about you
correct it, or change your manager name. Your Discord details update by themselves each time you sign in.
delete your account. We delete your account and your sign-in sessions, and remove your name and Discord details from your matches. Your opponents’ records of those matches are kept, with your side shown as a deleted player.

To make sure a request really comes from you, we may ask you to confirm it from your Discord account, for example by messaging a moderator in our Discord server. We aim to respond within 30 days.

You can also sign out at any time, and you can remove our apps’ access under Authorized Apps in your Discord settings.

Depending on where you live, you may have other rights, such as the right to object to or restrict how we use your information, to get a copy in a portable format, or to complain to your local data protection authority. Email us to use any of these rights.

Cookies and browser storage

The games use only these. They are all needed for the games to work, and none of them track you on other websites.

spellstick_session (cookie, Spellstick Cardgame): keeps you signed in. Lasts 7 days.
spellstick_oauth_state (cookie, Spellstick Cardgame): protects sign-in from forgery. Lasts 10 minutes.
dsg_session (cookie, Spellstick Live): keeps you signed in, and is shared by our games at games.darkspace.press. Lasts 30 days.
dsg_oauth_state (cookie, Spellstick Live): protects sign-in from forgery. Lasts 10 minutes.
spellstick.selection (local storage, Spellstick Live): remembers your teams and difficulty until you clear it.
spellstick.muted (local storage, Spellstick Live): remembers whether you muted the sound until you clear it.

Children

To use the games you must meet Discord’s minimum age in your country, which is at least 13. We don’t knowingly collect information from children under 13. If we learn that we have, we’ll delete it. If you’re a parent or guardian and think your child has given us information, email us.

Security

All connections to the games use HTTPS.
Discord access keys are used only during sign-in and never stored.
Spellstick Cardgame stores only hashed copies of sign-in sessions. Spellstick Live’s sign-in cookie is signed so it can’t be altered.
Our game server connects to the database with an Azure managed identity instead of a password, and our app secrets are kept in Azure Key Vault. Azure encrypts the database at rest.
Only Darkspace Press administrators can access the database.

No system is perfectly secure. If a breach affects your information, we’ll tell you as the law requires.

Changes to this policy

When we change this policy, we’ll post the new version here with a new effective date. For significant changes, we’ll also announce them in the Darkspace Press Discord server before they take effect. Before we launch card collections, trading, tournaments, or a coin store, we’ll update this policy to describe any new information those features use.

Contact

Carew Enterprises LLC, doing business as Darkspace Press, Florida, USA

Email: admin@darkspace.press