Privacy Policy

Last Updated: September 2026

At Virus Cards MLBB ("we", "us", "our"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Discord bot, website, and related services (collectively, the "Service"). Please read this policy carefully.

We collect only the minimum information necessary to provide and improve the Service:

1.1 Information You Provide to Us

• Discord Account Data: When you authenticate via Discord OAuth2, we receive your Discord user ID, username, global name, display name, avatar URL, and discriminator. We do NOT access your email address, private messages, friends list, or any other Discord account data unless explicitly authorized.
• Local Account Data: If you register locally, we collect your chosen username and a securely hashed password (bcrypt). We never store plain-text passwords.
• Card Submissions: When you submit card art, we collect the images you upload and your Discord user ID for attribution.
• Feedback & Communications: Any feedback, messages, or support inquiries you send us.

1.2 Information Collected Automatically

• Gameplay Data: Card rolls, inventory contents, diamond balances, collection statistics, leaderboard rankings, trading history, and interaction timestamps.
• Usage Data: Command usage frequency, feature interactions, API request timestamps, and basic error logs.
• Device & Connection Data: IP address (temporarily logged), browser user agent, referring URLs, and basic session information.

We use the collected information exclusively for:

• Service Operation: Running the Discord bot, maintaining your game inventory and profile, processing trades and claims, and operating the website.
• Authentication: Verifying your identity through Discord OAuth or local login to access your account and data.
• Leaderboards & Profiles: Displaying your chosen username and avatar on public leaderboards and profile pages (you can opt out of public display by not competing).
• Communication: Sending you administrative messages (e.g., gift notifications, ban notices) via the Discord bot.
• Anti-Abuse: Detecting and preventing automated abuse, cheating, exploitation, and violations of our Terms of Service.
• Improvement: Analyzing usage patterns to improve the Service's performance, features, and user experience.

If you are in the European Economic Area (EEA), our legal basis for collecting and using your personal information depends on the specific data and context. We rely on:

• Contractual Necessity: Processing is necessary to perform our obligations under our Terms of Service with you.
• Legitimate Interests: Processing is necessary for our legitimate interests in operating and improving the Service, preventing abuse, and ensuring security.
• Consent: Where required by law, we obtain your consent (e.g., via the %start command) before collecting or processing your data.

We do NOT sell, rent, trade, or share your personal information with third parties for their marketing purposes. We may share information only in the following limited circumstances:

• Service Providers: We use trusted third-party services for hosting (Render.com), database (Neon/PostgreSQL), payment processing (Stripe, NOWPayments), and image hosting (ImgBB). These providers have access to only the data necessary to perform their services and are contractually bound to protect your data.
• Legal Compliance: We may disclose information if required to do so by law or in response to valid legal requests by public authorities (e.g., a court order or government agency).
• Protection of Rights: We may disclose information where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, or potential threats to the safety of any person.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you via the Discord bot or website before your data becomes subject to a different privacy policy.

We retain your personal information only for as long as necessary to fulfill the purposes described in this Policy:

• Active Accounts: Your data is retained while your account is active and for a reasonable period thereafter (up to 6 months after last activity).
• Deleted Accounts: When an account is deleted (by you or by us), we delete or anonymize your personal data within 30 days, except where retention is required by law.
• Log Data: Server and error logs are retained for up to 90 days for security and debugging purposes before being anonymized or deleted.

We implement appropriate technical and organizational security measures to protect your data:

• Encrypted connections (HTTPS/TLS) for all web communications.
• Passwords hashed using bcrypt with a cost factor of 10+.
• Database hosted on secured, access-controlled servers with encryption at rest.
• Regular security audits and dependency updates.
• Access to production data restricted to authorized administrators only.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security but will take all reasonable steps to protect your data.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Deletion ("Right to be Forgotten"): Request deletion of your personal data, subject to certain exceptions.
• Restriction: Request restriction of processing your data in certain circumstances.
• Data Portability: Request a copy of your data in a structured, machine-readable format.
• Objection: Object to the processing of your personal data for legitimate interests or direct marketing.
• Withdraw Consent: Withdraw your consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal).

To exercise any of these rights, please contact an administrator through our official Discord server. We will respond to your request within 30 days.

We use minimal cookies and browser local storage for essential functionality only:

• Session Cookie: A secure, HTTP-only session cookie to keep you logged in. This cookie is essential for the website to function.
• Local Storage: Used to store UI preferences (e.g., filter selections on the gallery page). This data never leaves your browser.

We do NOT use tracking cookies, advertising cookies, or any form of cross-site tracking. We do NOT use Google Analytics or similar analytics services that track individual users.

The Service is not intended for children under 13 years of age (or the applicable age of digital consent). We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without verified parental consent, we will delete that information promptly. If you believe a child under 13 has provided us with personal data, please contact us immediately.

Your data may be processed on servers located in the United States, European Union, or other countries where our service providers operate. By using the Service, you consent to the transfer of your data to these locations. We ensure appropriate safeguards (such as Standard Contractual Clauses) are in place for transfers from the EEA to non-adequate countries.

The Service integrates with the following third-party services. Each has its own privacy policy governing data handling:

• Discord: Authentication and bot messaging. See Discord's Privacy Policy.
• Top.gg: Bot voting verification. See Top.gg's Privacy Policy.
• Stripe & NOWPayments: Payment processing for premium subscriptions. See Stripe's Privacy Policy and NOWPayments' Privacy Policy.
• Render.com: Web and bot hosting. See Render's Privacy Policy.
• Neon (PostgreSQL): Database hosting. See Neon's Privacy Policy.
• ImgBB: Image hosting for card art. See ImgBB's Privacy Policy.

We may update this Privacy Policy from time to time. We will notify you of material changes through the Discord bot or a notice on our website. Your continued use of the Service after the effective date of the revised policy constitutes your acceptance of the changes. We encourage you to review this policy periodically.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to us through:

• Our official Discord server (contact an administrator)
• Website contact form (if available)

We will respond to privacy-related inquiries within 30 days.

The bot operations and development team ("Bot Staff") reserves the right to join and inspect any Discord server where the application is installed. Because the bot operates inside your server, authorized staff may access the information needed to run it — such as guild identifiers, server name, and the invite links generated for the bot's Join buttons. This access is strictly limited to the following purposes:

• Uptime & Performance Monitoring: Ensuring the bot runs reliably and monitoring its operational performance.
• Anti-Abuse & Anti-Exploit: Preventing misuse of the Service, cheating, or any attempt to tamper with the game systems, cards, or economy.
• Security & Infrastructure Protection: Safeguarding the bot against hacking attempts or malicious attacks that could harm the Service infrastructure.

The bot operations team reserves the right to join and inspect any Discord server where the application is installed. This is strictly to ensure bot functionality, protect against exploits or malicious usage, and maintain system security.

يحتفظ فريق عمل وتطوير البوت بالحق في الانضمام والوصول إلى أي سيرفر يتواجد فيه البوت، وذلك لحصر استخدام الخدمة في الأغراض المصرح بها، وضمان استقرار النظام، وحماية البوت من أي ثغرات أو محاولات اختراق.