Privacy Policy

VARZ TCG is operated by 株式会社VAZ (VAZ Inc.), which is responsible for the personal data described in this policy.

• 株式会社VAZ / VAZ Inc.
• 代表取締役：谷 鉄也 (Representative Director: Tetsuya Tani)
• 個人情報保護管理者：コーポレート部門 ゼネラルマネージャー (Personal Information Protection Manager: General Manager, Corporate Division)
• 〒104-0061 東京都中央区銀座4-2-15 塚本素山ビル2F
• Tsukamoto Sozan Building 2F, 4-2-15 Ginza, Chuo-ku, Tokyo 104-0061, Japan
• support@vaz.co.jp

株式会社VAZ also publishes a company-wide personal-information protection policy covering all of its business, which you can read here: 株式会社VAZ 個人情報保護方針.

This page is not a copy of that policy. The company policy states how 株式会社VAZ handles personal information in general; the section below states what the VARZ TCG online service specifically collects, what it does with it, and who else touches it. Where the two overlap, the company policy governs the company’s management system and this page governs this product.

Within the VARZ TCG online service we collect and use the following personal information, and nothing else:

• Sign-in identity — your name, email address, profile picture URL and provider account identifier, received from Google or Discord
• Profile — display name, country, languages, time zone, avatar choice, and the optional profile details you fill in yourself
• Play records — decks, matches and their results, replays, ratings, tournaments, follows, favourites and notifications
• Technical data — the session cookie that keeps you signed in, plus the IP address, user agent and request logs inherent in serving a website
• Service-usage records for signed-in accounts — the calendar days on which you use VARZ Online, compact CPU Battle lifecycle records, whether you use VARZ as an installed/standalone web app, and the time a VARZ push notification brings you back to the service. We do not store a page-by-page trail or card-by-card action history for this purpose.
• Newsletter — only if you opt in: your email address and a record of the consent you gave

We use it for these purposes, and we do not repurpose it for anything else:

• Account, authentication and profile — creating your VARZ account, signing you in via Google or Discord, keeping you signed in, and showing you to other players under the name and avatar you chose
• Providing the online game — matchmaking, online presence, running and spectating matches, tournaments, and the notifications that go with them
• Decks, match history, replays and ranking — saving the decks you build, recording matches and their results, storing replays including any you choose to share, and calculating your rating and ranking
• Security and abuse prevention — detecting and stopping cheating, harassment, ban evasion and attacks on the service, and keeping the logs needed to do it
• Fault handling and improving the service — diagnosing errors and outages from server logs, measuring signed-in retention and feature adoption with the low-resolution service-usage records described above, and using aggregated reports to decide what to fix, simplify or build next
• Responding to enquiries — answering the questions, reports and requests you send us
• Optional newsletter — sending VARZ news to people who asked for it, and proving what they agreed to

Using VARZ and receiving the newsletter are two separate decisions. Agreeing to the Terms of Service and this handling of personal information is part of having an account; the newsletter is an optional opt-in that starts switched off and that you can withdraw at any time without affecting your account.

You can sign in to VARZ with Discord, Google, or Apple. We do not offer password accounts, so we never receive or store a password for you.

From whichever provider you choose, we receive only basic sign-in identity: your name, your email address, your profile picture URL, and an account identifier for that provider. We ask for no other scopes and have no access to your Google Drive, Gmail, contacts, calendar, or to your Discord messages, servers or friends.

We use that data to create and identify your VARZ account, to show you to other players under a name you control, and to contact you about your account. If you signed in with Discord, we also store your Discord user ID so the community bot can mention you for sessions you booked.

If you use Sign in with Apple and choose Hide My Email, the address we receive is Apple’s private relay address rather than your own. We treat it as your email address and can reach you at it; we cannot see the address behind it. Because that relay address is unique to VARZ, signing in that way creates a separate VARZ account from any you already have under your own address.

Your provider sign-in tokens are stored only for as long as the sign-in session needs them, and they are deleted when you sign out or delete your account.

When you set up or edit your profile we store what you enter:

• display name
• country, if you choose to give one
• languages you can play in
• a VARZ preset avatar, if you pick one instead of your provider picture
• optional profile details such as a short bio, favourite hero and colour
• whether you have joined our Discord or registered for the Kickstarter campaign
• an optional separate email address used only to check Kickstarter or pre-registration bonus eligibility

Your time zone is detected, not asked for. Your browser reports it and we save it so match times display correctly; if your browser does not report one, we fall back to a default for the country you selected. You can correct it at any time.

Choosing a preset avatar replaces the profile picture shown across VARZ. We keep your original provider picture URL so that you can switch back to it.

Playing online creates records that are part of the service:

• decks you build, including whether you publish them to the community
• matches, results, and the actions taken during an online match
• compact CPU Battle start/end records used for service performance and retention
• matchmaking queue entries and online presence while you are looking for a game
• rating and ranking, overall and per colour
• replays, including any you choose to share by link
• tournaments, invitations, trophies, follows and favourites
• notifications, and web-push subscriptions for any device you enable them on
• the players you have blocked, and any report you send us about someone’s content

A report records who sent it, whose content it was about, the reason chosen and anything written in the note. It is read by the VARZ team so that we can act on it, and it is never shown to the person reported. Blocking takes effect immediately, is visible only to you, and the person blocked is not told.

A match belongs to both players. That has consequences for deletion, which are described below.

Running VARZ on the internet means our hosting and database providers process ordinary technical data on our behalf — including your IP address, browser and device information, and server request logs — for delivery, security, abuse prevention and debugging.

We do not build advertising profiles, we do not sell personal information, and we do not use your data to train machine-learning models.

VARZ uses cookies, but only ones the service cannot work without and the optional analytics cookies you choose to allow. We audited every cookie and browser-storage key this application sets. The result:

• A sign-in session cookie — set when you sign in, deleted when you sign out or delete your account. It identifies your session; without it there is no logged-in service at all.
• An entry-choice cookie — remembers the guest-or-sign-in choice you made at the online prototype gate, so you are not asked again on every page.
• A sidebar-state cookie — remembers whether you left the sidebar open. First-party, expires after a week, and used for nothing else.
• An analytics-consent cookie (varz.analytics_consent) — remembers whether you accepted or rejected analytics cookies, so you are not asked again on every page or when you move between the website and VARZ Online. It stores one of two words and is never used for measurement.

Analytics cookies — only if you accept them. If you press “Accept analytics”, Google Analytics sets the following. If you reject, or have not answered, none of them are set, because nothing that would set them is loaded.

• _ga — provider: Google Analytics. Purpose: distinguish visitors for analytics. Default expiry: up to 2 years.
• _ga_<container-id> — provider: Google Analytics. Purpose: persist session state. Default expiry: up to 2 years.

Those are Google’s defaults; your browser may cap them to a shorter lifetime. You can change your answer at any time through Cookie Settings in the footer — withdrawing consent deletes these cookies and reloads the page so nothing measured stays running.

We also use your browser’s local storage for your own settings — interface language, sound and volume, game-timing preferences, Learn-track progress, and flags recording which one-off animations and toasts you have already seen. If you accept analytics and arrive with campaign tags, VARZ Online may also use session storage temporarily to carry those campaign labels through the sign-in round trip; it is cleared after they are attached to the signed-in account and is not a unique identifier.

We set no advertising cookie, no cross-site identifier and no tracking pixel. Analytics cookies are the only optional cookies, and we ask before setting them rather than asking retroactively.

We use Vercel Analytics for aggregated traffic measurement. It is cookieless and does not build a profile of you.

Signed-in service health is measured separately from optional Google analytics. VARZ stores one low-resolution active-day record per signed-in account per Japan calendar day, compact CPU Battle start/end records, PWA/standalone adoption milestones, and the first/last time a VARZ push notification brings the account back on that day. We use these records to calculate retention, repeat play, app adoption and whether notifications lead back to play. They do not contain a page-by-page browsing trail, IP address, email address, display name, full referrer URL, board state or card-action log, and they are deleted when the account is deleted.

Campaign attribution remains optional. If — and only if — you accept analytics, we may save the first campaign source, medium and campaign labels that brought you to VARZ, plus the host name of an external referrer. We never save the full referrer URL for this purpose. Campaign labels already present in the website URL may be copied onto a link you click to play.varztcg.com so they survive that handoff; this creates no anonymous identifier or additional cookie. If you reject analytics, VARZ does not save this first-touch attribution to your account.

VARZ also records optional product analytics events — for example that a screen was reached or a button was pressed — and those deliberately carry no personal identifiers: no email address, account ID or display name is sent to analytics.

We do not use advertising, remarketing or cross-site tracking tags, and we set no advertising cookie.

Embedded videos. Some pages — the Play Guide, How to Play, the story episodes and the Rule Book — embed a YouTube player so a video can be watched without leaving VARZ. These embeds use YouTube’s privacy-enhanced address, www.youtube-nocookie.com, which does not set cookies for a visitor who never presses play. If you do play a video, Google receives that request — including your IP address and browser — as the operator of the player, and its own terms apply to it. Nothing about your VARZ account is sent with it, and we do not receive anything about what you watch.

We also use Google Analytics 4, loaded through our Google Tag Manager container (GTM-PFXG5JLC). It is loaded only if you accept analytics cookies. Until then — and permanently, if you reject — no Google script is requested, no data is sent to Google, and no Google cookie is set.

Rejecting analytics does not affect your use of VARZ: every game feature, the online matchmaking, Learn and your account work exactly the same either way. You can change your analytics answer at any time through Cookie Settings in the footer.

Signing in does not subscribe you to anything. The VARZ newsletter is a separate, optional choice, its checkbox starts unticked, and leaving it unticked has no effect on your account.

If you do opt in, we send your email address to Mailchimp, which delivers the newsletter on our behalf, and we record in our own database when you agreed, from which screen, and which wording you agreed to. That record in our database — not the state of the mailing list — is the authoritative record of what you consented to and when you withdrew it.

The newsletter goes to its own dedicated Mailchimp audience, separate from the Kickstarter campaign list. Being on one does not put you on the other, and having a VARZ account does not make you a newsletter subscriber.

You can unsubscribe at any time from Email Preferences on your account page, or from the unsubscribe link in any newsletter.

Providers who process data on our behalf. These companies handle personal data under our instructions, for the purposes above and no other:

• Vercel — application hosting, request logs and cookieless analytics
• Neon — the PostgreSQL database in which everything above is stored
• Mailchimp — newsletter delivery, for subscribers only, and never for anyone who did not opt in

Sign-in providers you choose to use. When you sign in with Google or Discord, that provider is not acting on our instructions: it authenticates you under its own privacy policy and decides its own processing, and it necessarily learns that you signed in to VARZ. What we receive from it is listed under “Signing in” above. If you would rather not involve one of them, you can use the other.

Where the processing happens. These providers are established outside Japan, so providing the service involves transferring personal data abroad, including to the United States. We use them under their standard data-processing terms.

What we do not do. We do not sell personal information, and we do not provide it to third parties for their own purposes. Information becomes visible to other people only where the feature says so — publishing a deck, playing a match, sharing a replay link — or where we are legally required to disclose it, or where it is necessary to investigate abuse and protect the service and its players.

We keep personal data for as long as your account exists and you are using VARZ, and after that only as long as we reasonably need it for security, abuse prevention or legal obligations. Some records are short-lived by nature — matchmaking entries and online presence exist only while you are queueing.

We deliberately do not promise a fixed number of days, because a promise the product does not enforce would be misleading.

You can delete your VARZ account yourself, at any time, at varztcg.com/account/delete — or from the Danger Zone at the bottom of your account page, which is the same action. It is also reachable inside VARZ Online, under Account on your profile screen. No email to us is required.

Deleting your account removes:

• your name, email address and profile picture
• your profile, including country, languages, time zone and avatar choice
• your Google and Discord associations, and any stored sign-in tokens
• your decks, favourites, follows, trophies and invitations
• your notification settings and any web-push subscriptions
• the players you had blocked, and the reports you had filed
• your session, so you are signed out everywhere
• your newsletter subscription state within VARZ
• your account-linked CPU Battle, active-day, PWA and growth-measurement records
• any Creator or Store application you submitted, including the contact and business details on it

What is kept, and why. A match, a result, a replay and a tournament bracket belong to the other players in them as well as to you. Deleting those outright would erase part of someone else’s history, so instead your identity is removed from them: your name is replaced with “Deleted User”, and no email address or provider identifier remains. The match itself stays usable for the people you played.

If another player reported your content to us before you deleted your account, that report stays on file. It is their statement rather than your data, and account deletion is not a way to clear a moderation record. All it holds about you is the internal account identifier, which no longer leads to a name, an email address or a provider identifier.

If you were subscribed to the newsletter, we also ask Mailchimp to unsubscribe you. If Mailchimp is unavailable at that moment, your VARZ account is still deleted — we do not keep an account alive because an external service was down.

A deleted account cannot be signed into again. Signing in later with the same Google or Discord account creates a new, empty VARZ account.

You can view and correct most of your data directly from your account and profile pages, change your newsletter subscription from Email Preferences, and delete your account yourself as described above. Those three controls need no request and no waiting.

Depending on where you live, you may also have the right to request access to the personal data we hold about you, to ask us to correct or delete it, or to object to or restrict certain processing.

To make such a request, contact 株式会社VAZ 個人情報相談受付窓口 (VAZ Inc. Personal Information Consultation Desk) at support@vaz.co.jp. Requests for disclosure, correction, suspension of use and the other statutory requests (開示等請求) are handled through 株式会社VAZ’s company-wide procedure, which is published with its personal-information protection policy.

For questions about the game or about this policy itself, you can also reach the VARZ team at varz.tcg.official@gmail.com. Formal personal-information requests should go to the desk above.

VARZ is not directed at young children. If you are a minor, or if the law where you live otherwise requires it, you may use VARZ and provide personal data only with the consent of a parent, guardian or other legal representative.

If you believe a child has provided us with personal data without that consent, contact us using the details below and we will remove it.

VARZ is in active development and this policy will change as features launch. The date at the top of this page always reflects the current version, and we will give notice in the app or by email before a change that materially affects how we use your personal data.

• VAZ Inc. / 株式会社VAZ
• VAZ Inc. Personal Information Consultation Desk
• Tsukamoto Sozan Building 2F, 4-2-15 Ginza, Chuo-ku, Tokyo 104-0061, Japan
• Email: support@vaz.co.jp

• 株式会社VAZ 個人情報相談受付窓口
• 〒104-0061 東京都中央区銀座4-2-15 塚本素山ビル2F
• Email: support@vaz.co.jp