Privacy Policy

Summary

Chroma maintains server-side records needed to operate the game, preserve progress, run leaderboards, deliver purchases, and protect the integrity of its virtual economy. These records are generally associated with pseudonymous account and player identifiers. You may optionally protect a Chroma account by connecting Sign in with Apple or Sign in with Google. Apple processes App Store payments; Chroma does not receive or store full payment-card information.

Chroma receives cryptographically signed transaction, refund, and revocation information from Apple. Chroma does not currently send purchase-consumption information to Apple.

Information We Collect

• Account and profile data: pseudonymous authentication, player, and leaderboard identifiers, along with profile information you choose to display, such as a player name or profile card. If you choose account protection, Firebase Authentication and the selected provider also process a provider account identifier and may process account information such as an email address, name, or profile image supplied by that provider. Chroma does not use provider profile information as your public player name without your action.
• Game and competition data: card collection, mastery, challenges, XP, virtual-currency balances, rewards, power-ups, vouchers, event participation, pack history, and leaderboard records.
• Purchase-integrity data: Apple product and transaction identifiers, purchase environment, status, timestamps, verification metadata, point grants, and refund, revocation, reversal, balance-shortfall, and related restriction records. We do not receive full payment-card details.
• Support data: first and last name, email address, subject, and message when you use our website contact form.
• Technical and interaction data: Firebase, Firebase App Hosting, and Firebase Analytics may process standard device, browser, diagnostic, request, and interaction information when you use Chroma or this website.

Optional Account Protection

Chroma can be used with a pseudonymous guest account. If you voluntarily connect Apple or Google, that sign-in becomes a way to return to the same Chroma account and collection on supported devices. Connecting a provider does not move your collection to that provider, publish your provider email or name, or replace the player name you selected in Chroma.

Authentication credentials are exchanged through Apple, Google, and Firebase Authentication. Chroma does not place raw identity tokens, authorization codes, passwords, or cryptographic nonce material in its game database or analytics logs. Authentication SDKs may retain the session information needed to keep you signed in. Account protection is separate from iCloud synchronization.

How We Use Information

We use this information to operate and synchronize Chroma, preserve collections and progress, deliver and verify purchases, award challenges and prizes, run events and leaderboards, prevent duplicate grants and fraud, reconcile refunds and revocations, provide optional account recovery, provide support, secure and troubleshoot the service, and understand how Chroma can be improved.

In-App Purchases and Refund Protection

Apple processes Chroma's in-app purchases and may send Chroma cryptographically signed notifications concerning transaction status, refunds, revocations, and refund reversals. Chroma uses these notifications to reconcile purchased virtual currency and protect the integrity of its virtual economy and public competitions.

Following a final refund or revocation, Chroma may debit remaining points associated with the purchase, record an attributable point balance shortfall, temporarily restrict point-funded activity, and remove the affected account from public Weekly competition until the balance is reconciled. A refund reversal may restore the corresponding game state when appropriate. Apple—not Chroma—makes the final refund decision.

Chroma does not currently send purchase-consumption information to Apple. If that changes, we will update this policy and obtain any consent required before sending that information.

Service Providers and Sharing

We use Apple for App Store purchases, signed transaction notifications, and optional Sign in with Apple; Google for optional Sign in with Google; Google Firebase and Firebase App Hosting for authentication, databases, backend services, hosting, operations, and analytics; and Resend to deliver messages submitted through our contact form.

Chroma does not sell personal information or share it for third-party targeted advertising. We may disclose information when required by law, to protect users or the service, to investigate fraud or abuse, or as part of a business transaction subject to appropriate protections.

Data Retention

We retain information for as long as reasonably necessary to operate Chroma, maintain account and game continuity, provide support, and meet security and legal obligations. Purchase, refund, duplicate-grant, fraud-prevention, accounting, legal, and dispute records may be retained longer than ordinary gameplay data when needed to preserve transaction integrity. Authentication providers may retain information under their own policies. When a Chroma account is deleted, connected sign-in methods are detached from that Chroma account; deleting Chroma does not delete the underlying Apple or Google account.

Your Choices and Requests

You may request access to, correction of, or deletion of Chroma-held information by contacting us. We may need to verify your identity before completing a request. Some transaction, security, fraud-prevention, accounting, legal, or dispute records may need to be retained even after other account information is deleted.

You can delete a Chroma account from Settings in the app. For a protected account, Chroma may ask you to authenticate again so it can verify the request and revoke or disconnect the provider grant where supported. You can also manage Chroma's authorization in your Apple ID or Google Account settings.

Security

We use reasonable administrative, technical, and organizational safeguards designed to protect Chroma-held information. No method of transmission or storage is completely secure, so absolute security cannot be guaranteed.

Policy Updates

We may update this Privacy Policy as Chroma evolves. If this policy changes materially, we will update this page with a new effective date.

Contact

Questions about this policy can be sent to support@chromacollecting.com.