This policy explains what Duelists Unite ("we", "us") collects when you use next.duelistsunite.org (the "Hub") and the API behind it, why we collect it, who else receives it, and what you can do about it. Duelists Unite is the fan project that runs YGO Omega. We are not affiliated with Konami. The forum at forum.duelistsunite.org has its own policy.
The short version: you sign in with Discord, and we only get your Discord ID, username and avatar. We keep what you create on the Hub so we can show it back to you and to the people you share it with. Ads pay for the servers, and our ad partner uses cookies to run them. We never sell your data for money. You can ask us for a copy of your data or for its deletion at any time.
What we collect
When you browse without signing in
- Your language, in a cookie, if you pick one.
- What every web server receives with a request: your IP address, your browser's user agent, the page you asked for and the time. Our servers write this to their logs.
- A daily view count for wiki articles. For a visitor who isn't signed in, the count uses a keyed hash of the IP address. We don't store the IP address itself for it.
- Whatever our ad partner collects. See Ads.
When you sign in with Discord
Only a Discord account that already has a YGO Omega account can sign in. We ask Discord for the identifypermission only. It gives us your Discord user ID, username and avatar. We never see your Discord password, email address, servers or messages, and we don't keep the access token Discord gives us. Each sign-in creates a session. For each session we store a hash of its token, the IP address and user agent you signed in from, and when it was created, last used and set to expire.
Your YGO Omega game data
Your Hub account is your YGO Omega account. The Hub reads from the game's servers and shows your in-game name, rating, rank and VIP status, the duels you played (opponent, region, results, the decks used and the cards played in each game), and your season and tournament results.
What you add on the Hub
- Your profile: bio, region, status message, cover image, favourite card and deck, social links, a "now playing" YouTube video, who can see your profile, and whether you appear online.
- The messenger: your contacts (friend or rival, plus the private nickname and note you give them), the people you block, and the messages you send and receive, with their read status.
- Decks and combos you save in the deck builder and simulator, with their revision history.
- Wiki articles and their revisions, images you upload, comments and likes.
- Tournament registrations.
When staff use the admin tools, we log each action, its target and result, and the staff member's IP address and user agent.
What stays on your device
Unsaved drafts (deck builder, simulator, wiki editor) and small preferences (the banlist view you chose, whether you finished the calculator tour) stay in your browser's storage. We only receive a draft when you save it.
Donations
VIP comes with a donation made through PayPal. PayPal processes the payment under its own privacy statement. We never see your card or bank details.
How we use it
- To run the Hub: sign you in, show your profile, deliver your messages, save your decks, publish your wiki edits.
- To show game results: leaderboards, match history, tournament pages and player profiles.
- To build statistics: meta reports, card and archetype usage, win rates. Site-wide statistics are aggregates. A player's own statistics appear on their profile.
- To keep the Hub safe: limit request rates, detect abuse, investigate reports and enforce our Terms.
- To show the ads that pay for the servers, unless you are VIP.
We don't sell your personal information for money. Some US state laws count letting ad partners collect data for personalised ads as "selling" or "sharing". You can opt out of that; see Ads.
Legal bases
If you are in the EEA, the UK or Brazil, we rely on these legal bases:
- Contract: to provide the account and the features you ask for (sign-in, profile, messenger, decks, wiki).
- Legitimate interests: security and abuse prevention, server logs, wiki view counts, statistics and public game results. You can object to these; see Your rights.
- Consent:personalised ads and the cookies behind them, where the law requires consent. You can withdraw it at any time with "Manage consent" at the bottom of the page.
- Legal obligation: when the law requires us to keep or disclose data.
Who receives your data
- Other players see what your profile shows, within the visibility you chose, plus your wiki contributions under your name, leaderboard and match results, and the messages you send them.
- Discord, to sign you in (privacy policy).
- Cloudinary stores and serves profile covers and wiki images, and screens uploaded covers with automated moderation (privacy policy).
- Nitro (NitroPay, owned by Overwolf Ltd) and its advertising partners serve the ads (privacy policy).
- YouTube(Google) receives your IP address when you play an embedded video. Players load from youtube-nocookie.com, YouTube's privacy-enhanced mode, and only when you press play. Before that, a wiki page loads only the video's thumbnail from YouTube's image server (privacy policy).
- PayPal, for donations (privacy statement).
- Hosting providers that run our servers and databases, only to provide that service.
- Authorities, when the law requires it, or when we need to protect someone's safety.
- A successor, if the project changes hands. This policy would keep applying to your data.
Ads
The Hub shows ads through Nitro. Nitro and its partners use cookies and similar technologies to show ads, limit how often you see the same one, measure them and, with your consent where the law requires it, personalise them.
- EEA, UK and Switzerland:Nitro's consent tool asks before any personalised ads. Change your choice any time with "Manage consent" at the bottom of the page.
- US states with privacy laws(such as California): use "Do Not Sell or Share My Personal Information" at the bottom of the page to opt out.
These links appear only where the law covers you. VIP accounts see no ads, and some pages never carry any: sign-in, the messenger, profile editing, the wiki editor and the admin pages.
Cookies and local storage
omega_session: set by our API on duelistsunite.org when you sign in. It keeps you signed in. Your browser's scripts can't read it, and it lasts 30 days. Strictly necessary.- Sign-in cookies: set by our API during Discord sign-in, to protect it from forgery. They expire after 10 minutes. Strictly necessary.
NEXT_LOCALE: the language you picked. It lasts one year. Functional.- Nitro and its partners: advertising and consent cookies. See Ads.
- Local and session storage: drafts, preferences, and the page to return to after you sign in. These stay in your browser.
The Hub can't work without the strictly necessary cookies. You can delete any cookie in your browser; deleting omega_session signs you out.
How long we keep it
- Your account, profile, decks, combos, contacts and messages: for as long as your account exists.
- Clearing a conversation in the messenger hides it for you. The other person keeps their copy until they clear it too.
- Sessions stop working after 30 days or when you sign out. The session record, with its IP address and user agent, stays with your account until the account is deleted.
- Wiki articles and revisions are part of the wiki's history and stay published. If your account is deleted, they stay credited to a deleted account.
- Server logs: only as long as we need them for security and debugging.
When you ask us to delete your account, we delete or anonymise your data within 30 days. We keep only what the law requires, or what we need to enforce a ban. Copies in backups disappear as backups are replaced.
Your rights
Depending on where you live (for example under the GDPR, the UK GDPR, Brazil's LGPD, Canada's PIPEDA or the CCPA), you can ask us to:
- tell you what data we hold about you and give you a copy, in a portable format;
- correct data that is wrong;
- delete your data or your account;
- stop or restrict a use of your data, or object to it;
- withdraw a consent you gave;
- stop selling or sharing your data for personalised ads.
Many changes you can make yourself: edit your profile and who can see it, delete decks and combos, remove contacts and sign out. For the rest, email [email protected]. To confirm the request is yours, we may ask you to message us from the Discord account linked to your YGO Omega account. We answer within 30 days, or sooner if your law requires it. It costs nothing, and using these rights never changes how the Hub treats you.
You can also complain to your data protection authority, such as your EU country's authority, the UK ICO, Brazil's ANPD, the Office of the Privacy Commissioner of Canada or the California Privacy Protection Agency.
Children
The Hub is for people 13 and older. If your country sets a higher age for agreeing to this on your own (up to 16 in parts of the EU), you need a parent's or guardian's permission. If you think a child under 13 has an account, email us and we will delete it.
International transfers
Our servers and the providers above may process your data outside your country, including in Canada, the United States, the EU and Israel. Where the law requires it, we rely on our providers' safeguards for these transfers, such as standard contractual clauses.
Security
The Hub runs on HTTPS. The session cookie is out of reach of page scripts and only travels over HTTPS, and we store only a hash of each session token. Discord sign-in uses PKCE, and we never handle your Discord password. Every admin action is logged. Messages are not end-to-end encrypted. No system is perfectly secure: if a breach affects your data, we will tell you as the law requires.
Changes to this policy
When this policy changes, the date at the top changes too. Before a significant change takes effect, we announce it on the Hub or on our Discord. The Terms of Service cover the rest of the rules for using the Hub.
Contact
Duelists Unite: [email protected].