Who is responsible
QuickFire Entertainment Holdings, LLC, operating Triune TCG. Privacy contact: Craig McCullough, craig@quickfiretalent.com, 731-446-0153. Mailing address: 1328 Cherokee Trail, Tallassee, AL 36078.
Contact Craig for access, correction, deletion or privacy questions. Do not email passwords, authenticator codes, identity documents or a child’s private details.
Information used for accounts
The initial account service is for the United States and Canada. Standard player accounts are for people aged 14 or older. A parent or legal guardian must use the separate guardian process for a younger player. We ask for an age range, not a full birth date.
Standard accounts use an email address, password credentials, country, age range, chosen display name, assigned player ID, account permissions and status, sign-in/security records, and the notice versions you acknowledge. Authentication providers process credentials; passwords are not published in your profile. If you enable an authenticator, the authentication service processes the information needed to verify it.
We use these details to confirm eligibility, provide sign-in and recovery, maintain your player identity, enforce permissions, prevent abuse and record your choices. Browser storage keeps sign-in sessions. The child sign-in uses a separate tab-scoped session. Signing out on a shared device is important.
Community visibility and moderation
If you use enabled community features, we store your submitted text, its revisions and moderation state, reports, appeals, topic follows and in-site notices. Approved contributions and your display name can be visible to people who can read that discussion. Do not post names, contact details or identifying information about children or other people.
Craig reviews held content, reports and appeals. Automated screening can send submitted comment text to OpenAI’s moderation service and also apply local safety rules. Screening can make mistakes; a flag is not an automatic finding of misconduct or an account ban. Ask for review through the available appeal control or contact Craig. Private store documents and signed guardian forms are not submitted to this comment-screening service.
Private account details, guardian forms and store evidence are not community posts. An account does not grant access to another person’s private records. Existing event-testing tools are not a public player directory.
Service providers and processing locations
Vercel hosts the website and processes web requests and operational security data, such as IP addresses and browser/request details. Supabase provides authentication, the account database and private file storage. The current database is hosted in the United States.
Cloudflare Turnstile checks IP addresses and browser signals to help detect automated abuse on account flows, including guardian and child sign-in. Triune does not put passwords, email addresses, comments or uploaded documents into its Turnstile checks. Cloudflare processes the browser signals under its Turnstile privacy notice.
Resend delivers generic store-account and invitation notices using a recipient email address and generic message. We do not include application text, private documents, child details or sign-in credentials in those notices. Account confirmation and password-reset email currently use Supabase Auth with Google mail transport; those messages necessarily contain a one-time account link. Replies and support inquiries reach Craig’s Google-hosted mailbox.
OpenAI receives submitted comment text for moderation when screening is enabled. Our integration uses the moderation API, not a public ChatGPT conversation. Provider security processing and subprocessors are separate from the application’s own retention schedule.
Information may be processed in the United States and other countries where these providers and their subprocessors operate. It is not confined to Canada. Local authorities may have lawful access under the laws of the processing country.
Website measurement, email and applications
The public production site uses Vercel Web Analytics for aggregate visits to an explicit set of public pages. Account, guardian, child and private document routes are excluded. Public page measurements omit query strings and fragments; custom analytics events are not accepted. Essential hosting and security logs are separate from traffic measurement.
Triune does not use account registration as permission for marketing. There is no preselected marketing choice. Store notices use direct Triune links without email open or click tracking in the verified notification configuration. Receiving-server acceptance does not prove inbox delivery.
New website store applications will use Triune’s private service when intake opens. The old Google Form is no longer linked for new applications; any historical submission is handled separately when you request access or deletion. The contact form prepares a message in your email app; it does not send the message until you choose to send it.
Retention and deletion
Account and contribution records support the account and chosen features while your account is active. After a verified standard-account closure request, our operating deadline is to remove the login identity, profile and identifying contribution copies from active systems within 30 days. This requires owner review, not simply a timer. We protect other people’s legitimate records and remove identifying references before keeping shared content; removing a display name alone does not make text anonymous.
Closed, withdrawn or declined store application business and decision records are kept for 12 months after the final decision or appeal. Approved-store records are kept while the relationship is active and for 12 months afterward. Ordinary support and application correspondence is kept for 12 months after resolution. These periods are handled through owner review and do not describe automatic deletion jobs.
Only specifically necessary security or dispute records may be retained under a documented reason and review date, reviewed at least every 90 days. An exception covers identified records, not an indefinite hold on the whole account. We explain relevant limits when responding to your request.
Child-account and guardian-form handling is described in the guardian notice. Store evidence images follow the store notice’s shorter 30-day and 90-day schedules. Business-record retention does not extend those image deadlines.
Triune’s daily email-metadata cleanup removes attempt records older than 48 hours and detailed delivery events older than 30 days. Provider correlation records become eligible after 90 days, except when a recent report or active job still needs them. Bounded batches and outages can delay cleanup. A minimal hashed-address block is kept to prevent further sends following a bounce, complaint or suppression. A hash is pseudonymous, not anonymous.
Child sign-in counters use keyed hashes rather than raw usernames or IP addresses. Counters unused for 24 hours and expired short-lived sign-in tickets are cleared on a 15-minute schedule. Provider request logs follow separate retention practices.
Deleting active records does not instantly erase older backups, provider logs, email already delivered to a mailbox or copies someone has downloaded. Supabase’s Pro plan provides a seven-day daily database-backup window; those backups do not contain uploaded file bodies. At initial launch, Triune does not keep a separate recovery backup of uploaded documents. A lost or damaged upload may be unrecoverable, and we may ask you to submit a new redacted copy. Resend publishes 30-day email/log retention and a seven-day backup period. These are different from Triune’s application cleanup periods.
Your choices and requests
Email Craig with the subject “Triune privacy request” and the type of help you need. Use your account email where possible. We will verify account control or parental authority before disclosing or deleting private records, ask only for information needed to handle the request, and explain any records that must be retained or any additional steps. We will respond under the requirements that apply to your request.
You can ask to review or correct information, close an account, withdraw applicable consent, or raise a privacy concern. Guardians also have in-account withdrawal and child-deletion controls. Taking away a permission can stop the feature that needs it. Do not use ordinary email to send identity documents.
Material changes to collection, purposes or disclosures will be explained before the affected collection resumes, with a new notice version and renewed choices where required. Reading this notice alone does not enroll you or record consent.