← Back to Fortress:Card

Privacy Policy

Published by DSE Deep System Entertainment · Last updated: 2026-08-10

1. Introduction

This Privacy Policy (“Policy”) describes how DSE Deep System Entertainment collects, uses, stores, and otherwise processes information when you use Fortress:Card—the web application and related online services.

Fortress:Card is operated by DSE Deep System Entertainment. DSE Deep System Entertainment is the data controller for personal data processed through Fortress:Card unless stated otherwise.

By using Fortress:Card, you acknowledge this Policy. Where this Policy conflicts with mandatory local law, mandatory provisions of that law prevail.

This Policy should be read together with the Terms of Service, which describe account features, eligibility, and your responsibilities. If the Terms and this Policy differ on data matters, this Policy governs.

DSE Deep System Entertainment has not appointed a formal Data Protection Officer (DPO). For privacy requests, use the contact details in Section 17.

2. Service covered

  • The Fortress:Card web application (browser client) and its online account and game services.
  • Static legal pages (Terms of Service and this Privacy Policy).
  • An internet connection is required for account creation, session management, and online multiplayer when enabled.

3. Privacy posture

Fortress:Card is not fully offline: clicking Enter on the welcome screen creates or resumes a guest account on DSE Deep System Entertainment servers, and online features require a connection to those servers.

DSE Deep System Entertainment is the data controller for personal data processed through Fortress:Card. We do not sell your personal data to advertisers or data brokers.

  • Solo play against AI runs primarily in your browser; account metadata is still stored on our servers when you enter the game.
  • We minimize data collection to what is needed to operate accounts, run matches, secure the service, and comply with law.
  • This Policy does not apply to third-party websites or services you may access outside Fortress:Card.

4. Purposes of processing

We process personal data for the following purposes, depending on how you use Fortress:Card:

  • Providing the service: creating and maintaining guest and registered accounts, running game sessions, and delivering tutorial and gameplay features.
  • Authentication and account security: session validation, guest-to-registered upgrades, and abuse prevention.
  • Service operation and improvement: technical reliability, debugging, and understanding aggregate usage.
  • Legal compliance: responding to lawful requests and retaining data where required by law.

5. Data categories

Depending on how you use Fortress:Card, we may process the following categories of information:

  • Account (server): username (display name), guest or registered status, password hash for registered accounts (never plain text), internal account identifier, internal persistent UUID (not shown in the game interface), one-time tutorial choice (accepted or declined), account creation timestamp, and IP address recorded at account creation and on subsequent connections.
  • Session (client and server): a signed session token stored in your browser’s local storage and validated on our servers to keep you signed in. Session tokens are not stored as a permanent server-side session archive.
  • Gameplay (when online): game moves, display names, session identifiers, and related match metadata transmitted to run matches and anti-abuse measures, as described in the Terms of Service.
  • Client preferences (browser local storage): interface language, sound on/off, and optional UI panel open/closed states (journal, character guide, turn order). These stay on your device unless you clear site data.
  • Technical: IP address associated with your account record; standard web server or hosting logs may also record request metadata (such as IP address, user agent, requested URL, and timestamps) for security and operations. We do not use those logs to build advertising profiles.

6. Account and authentication

  • Guest accounts: when you click Enter, we create or resume a guest account with a system-generated display name (format User##xxxx). Guest accounts are linked to your session and originating IP address for abuse prevention.
  • Registered accounts: you may upgrade a guest account with a unique username (3–16 characters, letters and numbers only, case-sensitive) and a password. Passwords are stored only as bcrypt hashes.
  • Each account receives an internal UUID for technical operations; it is not displayed in the game interface.
  • We do not currently collect email addresses for Fortress:Card accounts.
  • You are responsible for your device security. If you lose your session and have not created a registered account, we are not obligated to restore access.
  • You may request account deletion by email once our support address is published; until then, contact us through the channels listed in the Terms of Service.

7. Retention

DSE Deep System Entertainment online services for Fortress:Card are hosted in France. Unless stated otherwise, account data is retained while your account exists.

  • Username, account status, password hash (registered), internal identifiers, UUID, tutorial choice, creation timestamp, and last-known IP: kept while your account exists; deleted when you delete your account or when we remove it under the Terms of Service.
  • Session token: issued for up to 30 days on your device; validated server-side when sent with requests; not kept as a permanent server-side session log.
  • Browser local storage (language, sound, UI state, session token): remains on your device until you clear site data or uninstall/reset your browser profile for this site.
  • Hosting or security logs: rotated according to operational need; not used to build a permanent profile of your gameplay content.

8. About DSE Deep System Entertainment

DSE Deep System Entertainment (DSE) is the publisher and operator of Fortress:Card and related online services. We are in the process of formalizing our legal structure under this name in France; a SIRET and official registration number will be added to these documents once assigned. We operate Fortress:Card in line with applicable requirements, including the GDPR (RGPD), consumer-protection rules, and other obligations that apply to online services offered from France. Protecting your security and personal data remains a priority. You may contact us to exercise your data-protection rights as provided by law. DSE Deep System Entertainment develops Fortress:Card out of passion; there is no guarantee that the service will remain available indefinitely if the project does not gain enough users or support.

9. Children

Fortress:Card is not directed at children under 13. Users must be at least 13 years old (or the minimum digital consent age in their country, if higher), as stated in the Terms of Service.

If you believe a child under 13 has created an account, contact us using the channels in Section 17 so we can take appropriate steps, which may include account deletion.

10. International users

Data is processed in France. By using Fortress:Card from other countries, you consent to transfer and processing in France to the extent permitted by applicable law.

You are responsible for ensuring your use of Fortress:Card complies with laws in your country of access.

11. Legal bases for processing (GDPR)

Where the GDPR applies, we process personal data on the following legal bases, depending on the activity:

  • Contract performance (Article 6(1)(b)): providing accounts, game sessions, and features you request when you use Fortress:Card.
  • Legitimate interests (Article 6(1)(f)): securing the service, preventing abuse, and operating the game—balanced against your rights.
  • Legal obligation (Article 6(1)(c)): complying with applicable law and responding to lawful requests.

12. Your data protection rights

Depending on your location, you may have rights regarding your personal data, including under the GDPR.

  • Access: request confirmation of whether we process your data and receive a copy of personal data we hold about your account.
  • Rectification: request correction of inaccurate account data where applicable.
  • Erasure: request deletion of your account; see Section 6 for how to contact us.
  • Restriction and objection: request restriction of or object to certain processing where provided by law.
  • Complaint: lodge a complaint with your local supervisory authority. In France, the CNIL (www.cnil.fr) is the lead authority for hosting in France.
  • To exercise rights, contact us as indicated in Section 17. We may need to verify your identity before fulfilling requests.

13. Local storage and similar technologies

Fortress:Card uses browser local storage to operate the service. We do not use third-party advertising cookies.

  • fortress-session-token: your signed session token for account authentication.
  • fortress-lang: your selected interface language.
  • fortress-sound: whether sound effects are enabled.
  • fortress-journal-open, fortress-character-guide-open, fortress-turn-order-open: optional UI panel states on desktop layouts.
  • Clearing site data may sign you out and reset local preferences; your server account may still exist until you request deletion.

14. Security measures

DSE Deep System Entertainment implements technical measures appropriate to the risk, including:

  • Password hashing with bcrypt; plain-text passwords are never stored.
  • Signed session tokens validated server-side.
  • Hosting on servers operated by DSE Deep System Entertainment in France with access limited to authorized operators.
  • No method of transmission or storage is completely secure; you use Fortress:Card at your own risk regarding device compromise or credential theft.

15. Data breaches

If DSE Deep System Entertainment becomes aware of a personal data breach likely to result in a risk to your rights and freedoms, we will notify affected users and the relevant supervisory authority as required by applicable law, including the GDPR where it applies, without undue delay.

16. Changes to this Policy

  • DSE Deep System Entertainment may update this Policy to reflect changes in the service, law, or our practices. Material changes may be announced in the application or on the website.
  • Continued use of Fortress:Card after the effective date constitutes acceptance where permitted by law.
  • If you do not agree to an updated Policy, you must stop using Fortress:Card and may request account deletion.

17. Contact

Questions and data-protection requests: contact DSE Deep System Entertainment, publisher and operator of Fortress:Card, through the channels indicated in the Terms of Service.

A dedicated support email address will be published in these documents when available. Until then, use the contact methods listed in the Terms of Service.

For GDPR requests, we aim to respond within one month, extendable where permitted for complex requests. In France, the CNIL (www.cnil.fr) is the lead supervisory authority.