Legal
How OPTCG MX collects, uses, shares and protects your personal data, and how you can exercise your rights.
Controller: Sergio Franco (individual), who operates OPTCG MX (“OPTCG MX”, “we”, “us”).
Address: Jalisco, Mexico
Privacy contact: soporte@optcgmx.com
Scope: the OPTCG MX app for Android (the iPhone version isn't available yet), the website optcgmx.com and public portfolio pages. It applies to users in Mexico, the United States, Canada, Spain, the United Kingdom, Colombia and Chile.
This Policy is also our Information Processing Policy under Colombian Law 1581 of 2012.
We only process the data we need to run the app. You can use most of OPTCG MX without an account; in that mode your collection, decks and favorites stay on your device only.
We do not collect: precise location (GPS), contacts, microphone, photos from your gallery (except the profile photo you choose), payment details or your device's advertising ID. We do not store your IP address in our database. We do not process sensitive data.
Necessary purposes (we can't provide the service without them):
Secondary purposes (not required for the service):
If you don't want us to use your data for secondary purposes, email soporte@optcgmx.com. Saying no doesn't affect the service.
We don't use your data for advertising, we don't build profiles to show you ads, and we don't make automated decisions that have legal effects on you.
The OPTCG MX assistant is an artificial intelligence system powered by Claude, from Anthropic: its replies are generated automatically and may contain mistakes. To answer, we send Anthropic your message, part of the conversation and the account context it needs (for example, your deck names or cards in your collection). We don't send your email or name.
We use Anthropic's commercial API. Under its commercial terms, Anthropic does not use this data to train its models and only keeps it for a limited time, to run the service and detect abuse.
The assistant only answers about ONE PIECE Card Game and the app, and declines other topics. You can rate every reply (👍/👎) and tell us why.
We store your conversations on our servers so you can come back to them. If you delete a conversation, it disappears from the app immediately and is permanently deleted within 30 days. Please don't share sensitive personal data with the assistant.
We don't sell your personal data and we don't share it for cross-context behavioral advertising. We only share it with service providers that help us run the service and act on our instructions:
We may also disclose data when required by law or a competent authority, or to protect the rights and safety of our users and the service.
Public content: portfolios you create are public by default. Anyone with the link can see their name, description, cards, quantities, condition, prices and the notes you write, and they may appear in search engines such as Google. We don't show your name, email or ID. You can make a portfolio private or delete it anytime. Your profile photo is stored at a web address that isn't password-protected.
Our servers and most of our providers are in the United States, so your data is processed outside your country. When data leaves the European Economic Area or the United Kingdom, we rely on the safeguards the law requires: the EU-U.S. Data Privacy Framework (and its UK Extension) when the provider is certified, or the Standard Contractual Clauses approved by the European Commission.
For users in Mexico, Colombia, Chile and Canada: transfers to our providers are those needed to provide the service, and providers may only use the data for that purpose.
Deleted data may remain for a limited time in technical backups until they're overwritten. Providers such as Google or RevenueCat keep their own records under their own policies.
Depending on where you live, you can access your data, correct it, delete it, object to or restrict its use, ask for portability and withdraw consent where processing is based on it. You can do many of these yourself in the app: edit your profile; delete cards, decks, favorites, portfolios, alerts and conversations; turn off notifications; and delete your account.
For anything else, email soporte@optcgmx.com from your account email with your request. We may ask for extra information to verify your identity. It's free.
You have the rights of Access, Rectification, Cancellation and Objection (ARCO), plus the right to revoke consent and limit the use or disclosure of your data, under the Federal Law on the Protection of Personal Data Held by Private Parties. We'll reply within 20 business days. If you're not satisfied, you can contact the competent data protection authority.
You have the rights under the General Data Protection Regulation (GDPR) and Spain's LOPDGDD. We'll reply within one month. You can lodge a complaint with the Spanish Data Protection Agency (aepd.es) or the authority in your country.
You have the rights under the UK GDPR. You can complain to the Information Commissioner's Office (ico.org.uk).
Depending on your state (for example, California), you can ask to know what data we hold, correct it and delete it, and you won't be discriminated against for exercising your rights. We don't sell or share personal information for cross-context behavioral advertising. You may use an authorized agent. Our website doesn't respond to “Do Not Track” signals because it doesn't track you across sites.
You have the right to access and correct your data under PIPEDA and, in Quebec, Law 25. The person in charge of the protection of personal information is Sergio Franco, who operates OPTCG MX (soporte@optcgmx.com). You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.
Under Law 1581 of 2012 and Decree 1377 of 2013, you can know, update and correct your data, request proof of your authorization, be informed of how your data is used, revoke your authorization or request deletion, and access your data free of charge. We answer inquiries within 10 business days (extendable by 5) and claims within 15 business days (extendable by 8). Requests are handled by the controller named above at soporte@optcgmx.com. After completing this process, you can go to the Superintendence of Industry and Commerce (SIC).
You have the rights of access, rectification, deletion and objection under Law 19,628 and, once in force, Law 21,719, which adds portability and blocking. You can contact the competent data protection authority.
OPTCG MX is not directed to children. You must be at least 13 years old (14 in Spain and Chile) to create an account. If you're a minor under the law of your country, you need permission from a parent or guardian. We don't knowingly collect data from children under that age; if you believe a child has given us their data, contact us and we'll delete it.
AI assistant and minors: because we accept users from age 13, the assistant has limits designed for them: it only talks about ONE PIECE Card Game and the app, it doesn't ask for personal data and we never send the AI a user's name or email. Replies can be wrong: if one seems inappropriate, mark it with 👎 or contact us. Parents or guardians can ask us to review or delete a minor's account at soporte@optcgmx.com, and use Google Play parental controls for purchases.
We use encrypted connections (HTTPS), passwords hashed with bcrypt, secure device storage for your session and restricted server access. No system is perfect; if we detect a security breach affecting your data, we'll notify you and the authorities where the law requires it.
If your device is in Mexico, the United States, Canada, Colombia or Chile, our website uses Google Analytics to count visits: which pages are viewed, from which country and type of device, what is searched in the card search and whether the Google Play button is tapped. To do so it stores Google Analytics first-party cookies (such as _ga) that last up to 14 months and a random identifier; we don't use this data for advertising or sell it. In Spain, the United Kingdom and the rest of the world the website doesn't load Google Analytics or use cookies. You can opt out with the Google Analytics opt-out browser add-on or by clearing your browser cookies.
The website also saves the language you choose in your browser. To display fonts and some components, your browser downloads them from Google Fonts and jsDelivr, which receive your IP address to deliver those files.
We may update this Policy when the app or the law changes. We'll post the current version on this page with its date and, if the change is significant, let you know in the app.
Effective date: this version applies from October 8, 2026.