Privacy Policy

Effective date: 15 June 2026  ·  Last updated: 15 June 2026

This Privacy Policy explains how the Smash&Clash game (the “Game,” “we,” “us,” “our”) handles information when you play it on the web at www.smashandclash.in, through our Android and Windows app editions, or inside one of the platforms that hosts the Game (Whop, Discord, and ChatGPT). Smash&Clash is the official digital edition of the Smash&Clash strategic card-battle game, operated by Harshit Khemani, an individual creator and Founder based in India, who is the data controller for the Game.

1. Information we handle

Smash&Clash is designed to be playable with no sign-up. The information involved depends on how you choose to use the Game:

a. Information you can play without giving us

The core single-player experience (versus the AI opponent), the local hotseat two-player mode, the tutorial, and mutators mode all run entirely on your device. You do not need to create an account, and we do not require your name, email, or any personal identifier to play. Your rating, match history, and the friendly display name the Game suggests for you are generated and stored locally on your device until you choose to use a feature that needs the network. In these modes, no personal data is transmitted to us at all.

b. Optional account information (only if you sign in)

If you choose to sign in — for example, to keep your progress and identity across devices — authentication is handled by our identity provider, Clerk. In that case we receive a limited account profile:

• a unique user ID;
• your chosen username or display name;
• your profile image, if you set one; and
• your primary email address.

When you are signed in, a small “progress envelope” — your rating, games played, a progress timestamp, your chosen display name, and your chosen avatar token — is written into your Clerk account metadata so it follows you across devices (using a simple last-write-wins reconcile). Clerk also sets strictly-necessary authentication cookies (__client, __session, and __clerk_*) so it can keep you signed in; these are described in our Cookie Policy. Signing in is entirely optional, the Game never blocks on it, and sign-in is skipped inside the Whop, Discord, and ChatGPT embeds. If you never sign in, none of this is collected. You can delete your account at any time from the in-app account settings; see Account & data deletion.

c. Display name & avatar

Your display name is cosmetic. Guests get a friendly random name (for example, “SneakyOtter47”) the first time one is needed; you can rename yourself at any time. Your avatar is stored as a tiny token that points either to one of the Game’s own champion artworks or to your account photo (if signed in) — we do not upload or store your own images. These cosmetic values appear to others only on the surfaces you choose to use (a public profile, a leaderboard, an online match, or a nearby game). In two-player hotseat, the seat names you type stay on your device.

d. Online play / connection data

When you use online multiplayer, technical connection data is processed to set up and maintain the peer-to-peer match — including network/IP address information, transient signaling messages, and lobby or room codes. See Online multiplayer & WebRTC below.

e. Public profiles & community standings

If you open or share your public profile, or join a community leaderboard, the Game publishes a cosmetic stats snapshot so others can view it. See Public profiles & community features for exactly what is included and how to remove it. No email, contact detail, or IP address is included in these snapshots.

f. Usage & diagnostic data

On the production website we use privacy-friendly, aggregated analytics (Vercel Web Analytics) to understand overall traffic — such as page views and approximate referrer/region — without cookies and without tracking you across other sites. This data is aggregated and is not used to identify you. It is not loaded on localhost or inside the Whop, Discord, or ChatGPT embeds. Separately, the Vercel-hosted serverless functions that power our embeds and the Agent Arena process standard server logs and the request bodies sent to those endpoints — including the Discord OAuth code at /api/token and the Whop user token at /api/whop-verify — purely in transit to complete the request (see Distribution surfaces).

In addition, only if you accept the consent banner, we enable two optional analytics tools on the website: Google Analytics 4, which uses cookies to measure traffic and gameplay (with IP anonymisation enabled), and Microsoft Clarity, which provides session replay — recording anonymised session interactions such as clicks, scrolling, and the pages you view — together with aggregated heatmaps, to help us improve the Game. Clarity masks the content you type by default. These tools load only after you accept; they do not fire before consent, and if you decline they are never loaded. You can change your mind at any time (see Your rights & choices). They are not used on the Android or Windows app editions, and they are not loaded inside the Whop, Discord, or ChatGPT embeds. For full details of every cookie, see our Cookie Policy.

g. Feedback you send us

The Game may offer optional feedback forms (powered by Tally) and bug reports. Anything you submit is voluntary. If you are signed in, your email address may be pre-filled to help us follow up — you can edit or remove it before sending. To help us triage, a bug report may also carry a few non-personal diagnostics (the app build version, your rating, the current screen, your browser user-agent, and the last error message — no personal content). If Tally is unavailable, the Game falls back to drafting an email to support@smashandclash.in.

2. How we use information & our legal bases

We use the limited information described above only to:

• provide and run the Game and its features;
• enable optional sign-in and keep your progress consistent across devices;
• set up and maintain online multiplayer matches between players;
• render the public profiles, friends, and community leaderboards you choose to use;
• run Agent Arena challenges and verify their results;
• measure overall usage so we can improve performance and gameplay;
• respond to feedback, support requests, and bug reports; and
• maintain the security and integrity of the Game and prevent abuse.

We do not use your information for advertising, profiling, or automated decision-making that has legal or similarly significant effects on you.

Where European/UK data protection law applies, our legal bases under the GDPR / UK GDPR are: consent (loading the optional analytics cookies; signing in; publishing a public profile or community standing) — which you can withdraw at any time; performance of a contract / steps taken at your request under Article 6(1)(b) (running the online matches, friends, leaderboards, and Agent Arena challenges you initiate); and our legitimate interests under Article 6(1)(f) (keeping the Game secure, preventing abuse, and measuring aggregate, cookieless usage). Under India’s DPDP Act, we process personal data for the specified purposes described here on the basis of your consent or the legitimate uses permitted by the Act, and you may withdraw consent as easily as you gave it.

3. Public profiles & community features

Smash&Clash includes optional social features that make some of your cosmetic stats visible to other people. These features are opt-in — nothing is published until you act, and what is published is limited to gameplay cosmetics, never your email, your account ID, or any contact detail. They are only available when our backend (Supabase) is configured for the edition you are using.

a. Public profile pages (/player/:id)

When you open or share your profile, the Game publishes a public snapshot to our backend (Supabase) so anyone with your link can view a live profile card at /player/<id>. That snapshot contains only:

• your stable player id (your “friend code”) and display name;
• your rating, rank label, games played, a provisional flag, and win rate;
• your recent form (a short string such as “WWLDW”); and
• your favourite champion.

The win rate shown on a public profile reflects your versus-AI play; the win rate shown in a community standing (below) reflects all eligible games, including online matches, so the two figures may differ. A snapshot is (re)published when you open your profile, rename yourself, change your avatar, or finish a rated game. Each device holds a one-time secret “write token” that gates updates — only its sha256 hash is stored on the server, while the secret stays on your device — so only you can change your own snapshot. A profile snapshot is public by nature, readable by anyone with the link, so treat the display name you choose accordingly. You can stop publishing and remove the snapshot at any time; see Account & data deletion.

b. Community leaderboards, clubs & standings

You can create or join a club (a hand-formed group with a 6-character invite code) or appear on a community leaderboard tied to the platform you are playing in (a Discord server or a Whop community). When you belong to a community, the Game publishes a standing snapshot — the same cosmetic stats as your profile plus your wins/losses/draws, with a win rate computed across all of your eligible games (including online) — into that community’s leaderboard so members can see the ranking. These writes are gated by the same per-device write token as your profile. Your club memberships and active community are stored locally on your device. Leave a club, or delete your data, to remove yourself; see Account & data deletion.

4. Friends & camera QR scanning

Your friends list is stored locally on your device — it is not uploaded to us. Each friend entry is just their stable player id, their display name, and a cached copy of their public profile snapshot for offline display (up to 200 friends). You add friends by pasting a friend code or /player/<id> link, or by scanning a friend’s profile QR code.

5. Offline nearby play (Android)

On the Android app, you can play a local match against someone nearby with no internet, using Google Nearby Connections (Bluetooth LE plus Wi-Fi). One device advertises a game by your display name; nearby devices discover it and tap to connect, and game moves then travel directly between the two phones. There is no server and no internet on this path, and we do not receive any of this data. To work, this feature uses the device’s nearby-devices / Bluetooth (and, on some Android versions, Wi-Fi and location) permissions, which Android requests from you at runtime; these are used strictly as the proximity transport for offline play and never for tracking. The only personal detail exchanged is the display name you choose to advertise. This feature exists only on the Android edition.

6. Online multiplayer & WebRTC

Online matches use WebRTC, a standard peer-to-peer technology, so game moves travel as directly as possible between the two players. To establish a connection, a signaling service (Supabase Realtime) exchanges short setup messages and a room code, and a public STUN server (stun.l.google.com, operated by Google) helps the two devices find a path to each other. As is inherent to all WebRTC connections, your network/IP address may become visible to the peer you are connected with — and to the STUN server — so that the direct link can be formed. We do not use this for tracking, and the signaling messages are transient: they are exchanged over Realtime channels (not written to a database) and are not retained as a permanent record of your gameplay. Friends presence (showing which of your friends are online) and the live “challenge doorbell” use the same transient Realtime presence mechanism, and open only if you have at least one friend.

Inside the Discord Activity, WebRTC is not available, so Discord matches instead relay their lockstep game frames through a Supabase Realtime broadcast channel. As with signaling, these relay messages are transient and are not stored. See Distribution surfaces.

7. The Agent Arena

The Agent Arena lets an external AI agent (for example, Poke, ChatGPT, or Claude) challenge a human to a match. The agent plays through a named in-game CPU persona — you are always playing the Game’s own AI on your device, not chatting with the external agent, and the external agent does not receive your camera, microphone, contacts, or any device data. This is our one server-authoritative feature: when you open a challenge link and finish the match, your browser sends the match result (the moves, seed, and ruleset, the cosmetic in-game name you chose, and your rating) to our backend API, which re-simulates the deterministic match to verify it before recording the outcome and letting the challenging agent learn the result.

Because the Arena keeps a public match history that the challenging agent can read back, the cosmetic in-game name you used and your rating, together with the verified outcome and a replay link, are stored on the Arena backend and may be visible to the agent or its tooling. Please use a name you are comfortable showing publicly. We use your IP address only as a short-lived rate-limiting key for the Arena API and do not store it. This data is used only to run and validate the challenge; it is not used to profile you. You can ask us to remove your recorded Agent Arena match rows at any time; see Account & data deletion.

8. Distribution surfaces

The same Game runs in several places, all from one codebase. The identity it uses, and who you are visible to, depends on where you are playing:

When the Game runs embedded inside Whop, Discord, or ChatGPT, that platform is the host and its own privacy policy also applies to your use of the platform itself; we are not responsible for the platform’s own processing of your data. The display names from Whop and Discord are used only as your cosmetic in-game name (and, for community scope) and are not synced to your account.

A separate physical Smash&Clash card game is sold through a Whop storefront (“Get the physical game”). That checkout is operated by Whop as the merchant of record under Whop’s own terms and privacy policy; the digital Game itself is free, with no in-app purchases.

9. Third-party services

We rely on a small number of reputable service providers to operate the Game. Each processes data only as needed to provide its service and under its own privacy policy:

The character voices in the Game are pre-generated audio assets created with ElevenLabs and shipped with the Game; producing them does not involve any of your personal data, and no voice or audio of yours is captured or sent anywhere.

10. On-device storage & cookies

The Game stores your settings and preferences (such as audio, haptics, accessibility, and input options), your analytics consent choice, your local player id and rating, your match history (kept to the most recent matches in your browser’s database), your display name and avatar token, your friends list, your clubs and active community, and your per-device profile/standings write token, locally on your device using your browser’s or app’s local storage. This data stays on your device, is not sent to us except where a feature you use explicitly publishes a snapshot (see above), and you can clear it at any time by clearing the Game’s browser/app storage.

We do not use advertising or cross-site tracking cookies. Vercel Web Analytics is cookieless. The optional website analytics described above (Google Analytics 4 and Microsoft Clarity) set their own cookies, but only after you accept them in the consent banner; your consent choice itself is remembered in local storage (not a cookie), so clearing it re-shows the banner. If you sign in, Clerk sets strictly-necessary authentication cookies. The native Android and Windows apps do not load Google Analytics or Clarity at all. See the Cookie Policy for the full, named list of cookies and their durations.

11. Notifications

On the web, the Game can optionally show an operating-system notification when a friend challenges you while the tab is in the background. We never prompt for this on load — the browser’s permission is requested only when you turn the feature on from Settings, and your opt-in choice is stored locally on your device. You can revoke the permission at any time in your browser or system settings.

12. Advertising & selling of data

Smash&Clash contains no third-party advertising. We do not sell or rent your personal information, we do not “share” it for cross-context behavioural advertising (as those terms are used under California law), and we do not share it with data brokers or advertising networks. We do not build advertising profiles, and we do not offer financial incentives in exchange for your data — the Game stays free and fully playable regardless of the privacy choices you make.

13. Children’s privacy

Smash&Clash is a family-friendly card-battle game suitable for general audiences (rated ESRB E, PEGI 3, IARC 3+, and marketed as age 7+). The core Game can be played entirely on-device with no account and no personal information. Accounts and online/social features (online multiplayer, public profiles, friends, clubs, leaderboards, and the Agent Arena) are gated to players who are at least 13. Our age policy works as follows:

• Core play, any age. Vs-AI, hotseat, tutorial, and mutators run on-device and collect no personal data, so younger children can play without anything being transmitted.
• Minimum age 13 for accounts & social features. Creating an account and using any online or social feature requires you to be 13 or over (or the higher minimum age required in your country).
• Under 13 (COPPA). The Game is not directed to children under 13, and we do not knowingly collect personal information from them. Because we do not knowingly collect data from under-13s, we do not operate a COPPA verifiable-parental-consent (VPC) mechanism; instead, any under-13 personal data we discover is deleted. If you are a parent or guardian and believe a child under 13 has provided us with personal information (for example, by signing in or publishing a profile), please contact us and we will delete it. Parents may also contact us to review or refuse further collection of a child’s information.
• Under 18 (India / DPDP Act). Under India’s Digital Personal Data Protection Act, 2023, a user under 18 is a child. For accounts and social features used from India, we require verifiable parental/guardian consent (which may be obtained through a registered Consent Manager or government-backed means) before processing a child’s personal data, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children, or any processing likely to harm a child’s well-being. Our no-ads, no-profiling design supports this.

14. Data retention

We keep information only for as long as needed for the purposes described here:

• Online signaling / relay / presence: transient — exchanged in memory and discarded; not stored as a gameplay record.
• Cookieless Vercel analytics: retained only in aggregated, non-identifying form.
• Google Analytics / Clarity (if accepted): per their cookie lifetimes — GA cookies last up to roughly 2 years (the legacy _gid 24 hours), and Clarity per Microsoft’s cookie durations.
• Optional account data (Clerk): retained by Clerk while your account exists; deleting your account removes it.
• Published profile & community standing snapshots: persist until you stop publishing or ask us to delete them (see below).
• Agent Arena: challenge links expire after 7 days; verified match rows are retained as the public match history until removed on request.
• Feedback: kept in our support inbox / Tally for as long as needed to address it.
• On-device data: stays on your device until you clear it (your local match history is automatically pruned to the most recent matches).

15. Your rights & choices

Because most players never create an account, in many cases we hold no personal information about you. Where we do, you have rights under the laws that apply to you, and you can exercise the day-to-day choices below at any time:

• play without signing in (no personal information is collected);
• accept or decline optional website analytics in the consent banner, and change your choice at any time by clearing the site’s storage (which makes the banner appear again so you can choose differently);
• manage or delete your optional account from the in-game account settings (Clerk);
• stop publishing your public profile or leave a community at any time; and
• delete your data as described in Account & data deletion.

a. GDPR / UK GDPR (Europe & the UK)

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to access your personal data, and to its rectification, erasure, restriction, and portability, as well as the right to object to processing based on legitimate interests. Our legal bases are set out in How we use information. You can withdraw consent at any time (without affecting prior processing), and you have the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner’s Office). We do not carry out solely-automated decision-making that produces legal or similarly significant effects.

We are an individual operator established in India, outside the EU/UK. We have assessed our processing against Article 27(2) of the GDPR / UK GDPR and consider that we are not required to appoint an EU or UK representative: the personal data handling offered to players in the EU/UK is occasional, does not include large-scale processing of special-category data, and is unlikely to result in a risk to individuals’ rights and freedoms (we run no advertising, profiling, or behavioural tracking, and most play involves no personal data at all). We keep this assessment under review and will appoint a representative if the nature or scale of our processing changes such that the exemption no longer applies. EU/UK data subjects may exercise their rights, and raise any representative-related query, through the address in Contact us.

b. India — Digital Personal Data Protection Act, 2023 (DPDP)

If you are in India, you are a Data Principal and you may exercise the rights to access a summary of the personal data we process and the processors it has been shared with, correct, complete, or update it, request erasure, and nominate another individual to exercise your rights in the event of death or incapacity. You may withdraw consent at any time, as easily as you gave it — including, where applicable, through a registered Consent Manager — and you have the right to readily available grievance redressal. We process personal data only for the specified purposes described here and do not use it for tracking or behavioural advertising. As noted under Children’s privacy, we require verifiable parental/guardian consent before processing the personal data of a user under 18 in India. In the event of a personal data breach, we will notify the affected Data Principals and the Data Protection Board of India as required by the Act (generally without undue delay and, as a matter of posture, aiming within 72 hours of becoming aware). Our Founder, Harshit Khemani, handles data-protection and grievance redress — see Contact us. We aim to respond to verified grievances within the time required by law, and you may complain to the Data Protection Board of India.

c. California — CCPA / CPRA

If you are a California resident, you have the right to know, access, correct, and delete your personal information, the right to opt out of the sale or sharing of personal information, and the right to limit the use of sensitive personal information — and you will not be discriminated against for exercising any of them.

• Categories we collect. Identifiers (a player id and, if you sign in, a username and email); internet/usage activity (only if you accept analytics on the web); and gameplay content you publish (profile / leaderboard cosmetics). We do not collect government IDs, precise geolocation, financial account numbers, or biometric data.
• Purposes & retention. Each category is used only for the purposes in How we use information and retained as described in Data retention.
• No sale, no sharing. We do not sell your personal information and we do not “share” it for cross-context behavioural advertising. We have not done so in the preceding 12 months.
• Global Privacy Control. The website detects opt-out preference signals such as the GPC sent by your browser and treats a recognised GPC signal as a request not to sell or share your personal information. Because we never sell or share personal information in the first place, no further action is needed to honour the signal; it is handled consistently with our consent banner. This matches the statement in our Cookie Policy.
• Sensitive personal information. The only information that could be considered “sensitive” is your account log-in credential via Clerk, which is used solely to sign you in; we do not use it for any purpose that would trigger the right to limit, so that right is not engaged.

You may exercise any of these rights by emailing us at the address in Contact us, or, for an authorised agent, by providing written proof of authorisation. We will respond to verified requests within the timeframe required by applicable law.

16. Account & data deletion

What you can delete, and how:

• Your optional account, in-app (if you signed in). Open the in-game account settings and choose Delete account. This control is provided by our identity provider (Clerk) and is initiated entirely inside the app — no email or support ticket is required. Deleting your account removes your Clerk account profile (user id, username, profile image, email) and the progress envelope (rating, games, display name, avatar) stored with it. You can also email us to request account deletion if you prefer.
• On-device data (everyone, no login). Your local rating, match history, display name, avatar, friends list, clubs, write token, and preferences live on your device. Clear them instantly by clearing the Game’s browser/app storage (browser site settings → “Clear data”, or uninstalling the app). This removes everything stored locally.
• Your public profile & community standings (no login). If you published a profile or appeared on a leaderboard, email us the player id / profile link you want removed and we will delete the published snapshot(s) and any community standing rows. Because your device holds the write token for your own rows, you can also overwrite or stop publishing them from the Game. (If you clear your storage you lose that token, so email us and we will remove the rows for you.)
• Agent Arena match history. Email us with your player id / in-game name to have your recorded Agent Arena match rows removed.
• Delete everything. To request deletion of all data we hold that is associated with you, email support@smashandclash.in with “Delete my data” in the subject and include your player id / profile link (and, if applicable, your account email) so we can locate and erase it. A parent or guardian may use the same route to delete a child’s data. We will verify the request and complete the deletion within the timeframe required by applicable law.

We may retain a minimal record where the law requires it (for example, to confirm a deletion request was handled); we do not retain your data for any other purpose after deletion.

17. Security

We use industry-standard safeguards, including encryption in transit (HTTPS/TLS everywhere), and rely on established providers (Vercel, Clerk, Supabase) for hosting and authentication. The website restricts who may embed the Game (a content-security policy limiting framing to our own site and the approved Whop, Discord, and ChatGPT/OpenAI surfaces) and disables the microphone, geolocation, and payment browser features, allowing the camera only for first-party QR scanning. Backend writes for profiles and leaderboards are gated by per-player write tokens (only their hash is stored) and default-deny row-level security, and Agent Arena results are re-verified server-side. No method of transmission or storage is completely secure, but we work to protect your information, limit what is collected in the first place, and — where required — notify affected users and the relevant authority (such as the Data Protection Board of India) in the event of a breach.

18. International data transfers

We operate from India and our service providers may process data on servers located in other countries, including the United States and the European Union. Where required, these providers maintain appropriate safeguards for international transfers (such as the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, or an adequacy decision) under their respective privacy programs. Cross-border processing of personal data may also be subject to any restrictions issued by the Government of India under the DPDP Act.

19. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and post the new version at this URL (www.smashandclash.in/privacy). Material changes will be highlighted within the Game where appropriate. Your continued use of the Game after an update means you accept the revised policy. This Privacy Policy is governed by the laws of India and is designed for global compliance (GDPR, UK GDPR, CCPA/CPRA, COPPA, and the DPDP Act 2023).

20. Contact us

If you have any questions, requests, or concerns about this Privacy Policy or your information — or to exercise any of your rights or raise a grievance — contact our Founder:

Harshit Khemani — Founder
Email: support@smashandclash.in
Website: www.smashandclash.in

This policy applies to the Smash&Clash web edition, its Android (Google Play) and Windows app editions, and the Whop, Discord, and ChatGPT surfaces, which share the same codebase and data practices. See also our Cookie Policy, Terms of Service, and Code of Conduct.