Privacy policy

Last updated 11 October 2026.

glint.skin is made so what’s yours stays on your device, unless you choose otherwise.

Who’s responsible

Daniel Tolenaar runs glint.skin and is responsible for your personal data in it (the “controller”).
Email: tolenaardaniel@gmail.com.

Your pictures. Cards are made right here, and pictures are only uploaded if you turn on cloud save.
Your cards, shards, trophies and Clash record, saved in this browser. Clearing your browser data deletes them, unless cloud save is on.

A Clash link: your Clash name, one card and a tiny 20 × 15 pixel version of its picture. It goes only where you send it.
Anything you share: the image, clip or text goes wherever you share it.
Your Roblox username, if you bring in your Roblox avatar: glint.skin’s server asks Roblox for your public avatar and name, and keeps nothing. Your username is also remembered in this browser, for next time, unless you’re under 13.

Other players who have glint.skin open at the same time see your Clash name, rating, best card and what you’re doing, through glint.skin’s server (or, in the claude.ai version, claude.ai’s live room). Nothing of it is saved. You can hide yourself in Settings.

On the website, your best card of the week (its name, stats and looks, never its picture) and your Clash name are kept on glint.skin’s server for 8 weeks, for the board. Hiding yourself in Settings takes them off.

If you sign in (with Google, Roblox, Discord, Apple or a code sent to your email), glint.skin keeps a copy of your progress in your glint.skin account: your cards with their pictures, shards, looks, trophies, streaks, receipts, Clash name and record, and Roblox username, so you can get them back on any device.
From Google, Discord or Apple, glint.skin gets your email address and name; with an email code, just your email address; and from Roblox, just your Roblox user ID (a number).
The sign-in service also keeps the rest of what Google, Discord or Apple sends (such as a link to your profile picture), and records when you sign in, and the internet address and browser you sign in from, to keep accounts safe.
It’s all kept on glint.skin’s server (Supabase), and other players never see it. Sign out or delete your account, its save and its pictures any time in Settings, under Save and backup.
Cloud save is for 13 and over.

On glint.skin, Vercel Web Analytics counts visits: the page, the site you came from, and your country, browser and kind of device. It uses no cookies, keeps nothing that identifies you, and can’t follow you to other sites.

To stop cheating and spam, glint.skin’s server counts code tries, new players, reports and checkouts started without an account from each internet address. It keeps only a scrambled form of the address, and forgets it within a day.

If you report someone, glint.skin’s server keeps what you reported (their name and card name, and for a challenge its code, with the tiny picture), why, and a scrambled form of your internet address for up to 6 months, to check it. They aren’t told who reported them.

You pay on Stripe’s checkout page. It may say Link (part of Stripe), which can sell it to you for glint.skin. glint.skin never sees your card or bank details, and Stripe’s own privacy policy covers what you give it there.
glint.skin keeps a record of each purchase (what it was, its price, when it was paid, and any refund), so it reaches your game and is never lost: with your glint.skin account if you’re signed in, or else with a random code that only your browser has, until you sign in there. Deleting your account deletes these records too, though Stripe keeps its own record of the payment, as the law asks.
Once you’ve paid, glint.skin emails you a confirmation at the address you gave Stripe. It doesn’t keep the address (Resend, which sends the email, keeps a log of it for a short while).

Supabase: glint.skin’s server, for sign-in, cloud save, Top Cards, the live board, reports and purchases. What it keeps is in Ireland.
Vercel: the website, and counting visits.
Stripe, and Link (part of Stripe): payments.
Google, Discord, Apple and Roblox: signing in, if you choose one of them. Roblox also sends the avatar you bring in, and its pictures load from Roblox.
Resend: the emails with sign-in codes and purchase confirmations.
Google Fonts, cdnjs and jsDelivr: the game’s fonts and code. Like any website, they see your internet address when your browser loads them.

Cloud save, the leaderboards and what you buy: to give you what you asked for (our agreement with you, in the Terms).
Keeping it fair and safe (the scrambled addresses and reports) and counting visits: glint.skin’s legitimate interest in running the game well, kept small so it doesn’t outweigh your privacy.
Records of purchases: to give you what you bought and put right any problem (our agreement with you). Stripe or Link keeps its own record of each payment, as the law asks.

Your account, cloud save and pictures: until you delete them.
Top Cards: 8 weeks.
Reports: up to 6 months.
Scrambled internet addresses: a day, or with a report, as long as the report.
Purchase records: with your account, until you delete it. Bought without an account, they hold no name or email address, and are kept as a record of the sale.

What glint.skin’s server keeps is in Ireland. Some of the services above are in the US. For what they get, glint.skin relies on the safeguards they offer for that, such as the UK–US data bridge, the EU–US Data Privacy Framework or standard contract clauses.

glint.skin asks for your birth month and year before you sign in, buy something with money, or pick a name other players see. Your answer stays in this browser and is never sent anywhere. Until you answer, the leaderboards show nothing you typed.
Under 13: you can play everything. Your Clash name is one glint.skin makes up, and on the leaderboards your cards show their titles, never what you typed. Cloud save and buying with money are for 13 and over.
Under 18: ask a parent or guardian before you buy anything.
Parents and guardians: to see or delete what’s kept about your child, email tolenaardaniel@gmail.com.

You can ask to see, copy, correct or delete your personal data, or object to how it’s used: email tolenaardaniel@gmail.com. Most of it you can also delete yourself, in Settings.
If you’re unhappy with how it’s handled, you can complain to the Information Commissioner’s Office (ico.org.uk), or in the EU to your own country’s data protection authority.

No chat, no tracking across sites and no selling of data. No account is needed to play.