Privacy Policy

Last updated October 1, 2026

SHIFT: Card Clash (“SHIFT”) is operated by M2 Interactive, LLC. This policy covers the game and shiftcards.app. Contact us at [email protected] with privacy questions or requests.

Information we collect

• Account and profile. Your player name, avatar, account identifier, and sign-in details. Email sign-in uses your email address and a protected password hash. If you choose Apple or Google sign-in, we receive and keep a provider account identifier to link your player; we do not receive your provider password. Guest play does not require an email address.
• Optional profile photo. SHIFT+ members can upload a personal avatar photo. We resize it and convert it to a square image before storing it; we do not keep the original upload. Your chosen photo appears to other players and can be viewed by anyone who has its image link while your SHIFT+ access is active. Built-in avatars do not require a photo or SHIFT+.
• Gameplay and social activity. Rooms, moves, match history, results, rankings, progress, rewards, owned cosmetics, virtual currency balances, player names, and reactions. Other players in a room can see your name, avatar, card count, plays, and reactions, but not your hand. Match data may appear in rankings.
• Technical and analytics data. Session token hashes and request and diagnostic logs (which can include IP address). In the mobile app, Google Analytics for Firebase collects app and device information and events such as screens opened, controls tapped, matchmaking, card plays, rule changes, draws, match results, tutorial progress, and shop actions. We use an internal player identifier to connect app activity across sessions; analytics events do not include your name, email, room code, card IDs, or the cards hidden in your hand. If you allow notifications, we keep a device push token. Practice progress and some settings are stored on your device.
• Purchases, when available. The app store handles payment. We and RevenueCat receive product, transaction, entitlement, and refund information needed to grant or revoke items. We keep a record of virtual items delivered and spent. We do not receive your full card number.
• Website visits. Our hosting and delivery providers can process standard request data, such as IP address and browser information, to serve and secure this site. The public site does not ask you to create an account.

Why we use it

We use this information to run matches, identify players, save progress, provide support, deliver optional notifications, fulfill purchases, detect abuse, troubleshoot failures, and understand where players encounter friction so we can improve the game. We do not use player data for third-party advertising or sell it.

Who receives it

Railway hosts the game and public site. Cloudflare helps deliver and protect the site. Google Firebase Storage holds optional profile photos, and Google Analytics for Firebase processes mobile app usage events and device information to help us understand gameplay and app performance. Apple or Google handles sign-in only if you choose that option; Firebase Authentication is not used for player sign-in. Expo and the device platform deliver notifications if you enable them. When in-app purchases are available, the relevant app store and RevenueCat process purchase information. These providers process data to provide their services and may have their own privacy notices. Other players see the game information described above.

If you separately opt in under Settings → Privacy and later ask Apple for a refund, we may send Apple the delivery status and the amount of that purchase you used, such as the percentage of purchased Prisms spent. Apple uses this information to assess your refund request. This setting is off by default, and turning it off stops future sharing. Apple handles requests to access or delete consumption information you already shared at privacy.apple.com.

Your choices and deletion

You can change your player name in Settings, disable notifications in your device settings, and delete your player in SHIFT under Settings → Privacy → Delete account. Deletion disables access and removes linked sign-in identities, sessions, and push tokens. It replaces the name in the main account record with “Deleted player.” This action cannot be undone and can remove access to progress and virtual items.

You can replace or remove your uploaded profile photo from your profile. If SHIFT+ expires, we stop showing the photo to other players and stop serving its image link, but keep the stored photo so it can reappear if you renew. Removing the photo or deleting your account deletes it from active storage; the storage provider may retain a deleted copy briefly for recovery or security.

Some match, room, event, analytics, and purchase records currently remain after in-app deletion, including records linked to an internal player identifier. Historical room records may still contain a previous player name. We keep these records for game integrity, purchase and refund handling, security, and legal needs; we do not currently have one fixed retention period for all of them. To request deletion of remaining data or ask what is retained, use our account and data deletion page or email us. We will review the request and explain any data we must retain. You can use that page even if you have uninstalled the app.

You can also contact us to request access to or correction of your information, or to raise another privacy concern. We may need to verify that the account is yours before acting.

Security and children

We use access controls, password hashing, and protected session storage. No online service is perfectly secure. SHIFT is a general-audience game and is not directed to children under 13. If you believe a child under 13 has provided personal information, contact us so we can review and remove it as appropriate.

Changes and contact

We may update this policy as SHIFT changes. We will update the date above and provide additional notice when required. For questions or requests, use SHIFT Support or email [email protected].