Privacy Policy

Shisui ("the Bot") is a Discord-based card collecting game operated by Shisui LLC. This Privacy Policy explains what data we collect, how we use it, and your rights. By using Shisui, you agree to this policy.

The controller of your data is Shisui LLC, a limited liability company established in Michigan, United States. You can reach us at [email protected] or through our official support server.

Shisui is intended for users aged 13 and older. By using the bot or website, you confirm that you are at least 13 years of age. If we become aware that a user under 13 has provided data, we will delete it promptly.

We collect and store the following data when you interact with Shisui:

We never receive or store your card details. Stripe handles the payment itself and may collect billing information such as your name, email address, or address directly from you under its own privacy policy. Apart from that, we do not collect real names, email addresses, or postal addresses, unless you send them to us yourself, for example by emailing us.

Before you can use some features, we ask you to verify your account on our website. This protects the game from alternate accounts, automation, and blacklisted users. During verification:

• You solve a Cloudflare Turnstile check, which runs in your browser.
• Your IP address is checked with proxycheck.io to see whether it belongs to a VPN or proxy.
• We check how old your Discord account is. It is read from your Discord User ID, and new accounts can be refused.
• We compare your security data with that of blacklisted accounts, so a blacklist cannot be bypassed with a new account.

Security data is stored only as one-way, keyed hashes. We can tell when two accounts share the same IP address, network, device, browser, or connected account, but we cannot turn a hash back into the original IP address or account. The device ID is a random value in a cookie, described in the Cookies section. When we log you in, we read the list of accounts you connected to Discord, if you allowed it, and keep only hashes of them.

If a verification is refused, we keep a record of it with the reason, for example a VPN, a too new account, or a failed check. Staff may place accounts under closer review based on this data.

Every player has a public profile page at shisui.gg/user/<Discord User ID>. It shows your Discord display name, username, avatar, banner, and accent colour, the date you joined Shisui, how often you voted and opened hexes, and, unless you hide them, your card collection and your hexes. Card pages show who currently owns a card. Link previews of these pages, for example in Discord, show the same information.

You can hide your collection and your hexes from your profile in your settings. Hidden items stay hidden on the website and in link previews. If you are blacklisted, your profile only shows that the account is blacklisted, never the reason.

Your data is used exclusively to operate the bot's game features, manage your account and preferences on the Shisui website, process purchases, maintain security and prevent abuse, and generate anonymous usage statistics. We do not use your data for advertising, and we do not sell it to third parties.

If you are in the EEA or the UK, we process your data on these legal bases under the GDPR:

Our servers are located in France, inside the European Union, and your game, account, studio, and security data is stored there.

Shisui LLC is established in the United States, so our staff may access that data from the United States in order to operate and support the service. Where such a transfer requires a safeguard, we rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism. Some of our service providers, such as Discord, Stripe, and Cloudflare, also process data outside the EU under their own transfer mechanisms.

We use a session cookie to keep you logged in on the website. It is strictly necessary: without it, verified pages cannot tell who you are. Cloudflare sets its own cookies for security and bot protection, including for the Turnstile check on the verification page.

A device cookie holds a random ID for up to two years. It is used only for security, to recognise when several accounts are used from the same browser, and we store only a hash of it. A theme cookie remembers whether you chose the light, dark, or device theme.

We also use your browser's local storage for interface convenience, for example to cache your saved colour palette in Pixel Studio so it appears instantly. That data stays in your browser.

We do not use advertising cookies, analytics trackers, or cross-site tracking of any kind.

Wherever you live, you can ask us to do the following with your data. If you are in the EEA or the UK, these are your rights under the GDPR.

To exercise any of these rights, email [email protected] or contact us through the official Shisui support server. We answer within one month. If you think we have handled your data wrongly, you may also complain to your local data protection supervisory authority.

We do not sell your personal information. Under the California Consumer Privacy Act (CCPA), California residents have the right to request that we disclose what personal information we collect and to opt out of the sale of personal information. Since we do not sell personal information, no opt-out mechanism is required, but you may still contact us to confirm this.

California residents may also request access to, or deletion of, their personal information, and we will not discriminate against you for exercising those rights.

We keep data only as long as we need it:

If you ask us to delete your account, we remove your data promptly, except records we are legally required to keep, such as purchase records, and data we need to enforce a blacklist.

Shisui uses the following third-party services:

We do not share your personal data with these services beyond what is technically necessary to operate.

We store your last known IP address when you access the Shisui website. This is used solely for security purposes such as detecting unauthorized access, alting, and abuse. For the comparison between accounts we keep only one-way hashes of your IP address and its network range, as described under Verification and Account Security.

Your IP address is shared with Cloudflare, which sits in front of our website, and with proxycheck.io, which checks whether it belongs to a proxy or VPN. It is never sold, published, or used for advertising.

We take reasonable technical measures to protect your data including encrypted connections and access-controlled infrastructure. However, no system is completely secure.

If a data breach occurs that puts your rights at risk, we will notify the competent supervisory authority and, where the law requires it, the affected users.

We may update this policy at any time. Continued use of Shisui after changes are posted constitutes your acceptance of the updated policy. We will announce significant changes in our support server.

For privacy-related requests or questions, email [email protected] or join the official Shisui support server.