Privacy Policy

This policy explains what Oskii does with personal information. It covers the website at oskii.app, including the waitlist, and the Oskii software used in game stores: the counter kiosk, the staff pick list, Deck Forge and the admin tools.

Oskii is a trade name for the individual who operates it, and that individual is the person responsible for the information described here. To contact us about anything in this policy, email hello@oskii.app.

Two different roles

For the website and the waitlist, we decide what is collected and why. In data protection terms, we are the controller.

For information a game store puts into Oskii — its customers’ email addresses, its staff accounts, its inventory — the store decides, and we act on its instructions. There we are a processor, and the store’s own privacy policy governs what it does with that information. Section 6 covers this.

When you join the waitlist

• Your email address. That is the only field on the form, and the only thing we keep from it.
• Your IP address, briefly. The form is rate-limited to five submissions per hour per connection. The limiter holds recent submission times against your IP address in the server’s memory for up to an hour, and that memory is discarded when the server process restarts or is replaced. It is never written to a database and never linked to your email address.

The form also contains a hidden field that real visitors never see or fill in. If it is filled in, we treat the submission as automated and discard it. Its contents are neither stored nor logged.

When you visit the website

Our host, Vercel, keeps ordinary server logs: the pages requested, the time, the IP address the request came from, the browser’s user agent, and the referring page. These are used to keep the site running and to investigate abuse or faults. We do not run analytics software on this site.

The site’s fonts are served from our own domain rather than a font network, so visiting the site does not tell anyone else you visited it.

When you email us

We keep the message, your address and our reply, so we have a record of the conversation and can pick it up where it left off.

When you use Oskii in a game store

The store decides what it collects. Set up as designed, that is:

• from a customer at the kiosk: an email address, so the store can send status updates on a fetch request; optionally a phone number; and the contents of the request — the cards, quantities, finishes and the estimated total;
• from store staff: a name or identifier, a numeric sign-in PIN, the device a sign-in came from, and a record of which staff member marked which line found or not found;
• from Deck Forge: the questionnaire answers given, and the deck produced from them.

We do not ask for, and Oskii has no field for, payment card details. Payment happens at the store’s own till.

• To email you about the launch, if you joined the waitlist. Basis: your consent, given by submitting the form. You can withdraw it at any time.
• To confirm your signup. We send one confirmation email when you join. Basis: consent, and our legitimate interest in making sure an address really belongs to whoever entered it.
• To keep the site up and stop abuse, including rate-limiting the form and reading server logs when something breaks. Basis: our legitimate interest in a working, non-abused service.
• To answer you when you write to us. Basis: our legitimate interest in replying, or the steps leading to a contract.
• To provide the Service to a store and support it. Basis: our contract with the store, and the store’s instructions.
• To meet legal obligations, where one applies to us. Basis: legal obligation.

We do not use personal information to make automated decisions that produce legal or similarly significant effects about you. We do not use it to train machine-learning models, and we do not permit our vendors to train their models on it.

This site sets no advertising cookies, no analytics cookies and no cross-site tracking of any kind. There is no third-party pixel embedded in these pages.

Our host may set a cookie that is strictly necessary to route or secure a request. Where a part of the Service needs a cookie to work — keeping a staff member signed in to the pick list, for instance — that cookie is strictly necessary for a feature you asked for, and it is removed when the session ends.

If we ever add analytics, we will say so here first, and in a region that requires consent for it we will ask before setting anything.

Our Cookie Policy lists every cookie Oskii sets, what each one does and how long it lasts.

We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not hand it to data brokers.

We use a small number of service providers to run Oskii. Each one gets only what it needs, is bound by a written contract to use it only on our instructions, and is listed here:

Beyond those, we disclose personal information only:

• to the game store whose customer or staff member you are, which is whose information it is;
• when the law requires it — a valid subpoena, warrant or court order. Where we are permitted to tell you first, we will;
• to protect someone’s safety, or to investigate fraud or a security incident;
• to a buyer or successor, if Oskii is ever sold or merged. We will tell you before your information becomes subject to a different policy, and you will be able to delete it first.

When a store uses Oskii, the customer and staff information in it is the store’s, and the store decides what happens to it. Our role is to hold and process it on the store’s instructions.

That means:

• we use it to run the Service for that store, and for nothing else;
• we do not use one store’s data to benefit another, and we do not pool it;
• we act on the store’s instructions to correct or delete a record, or to export its data;
• we pass on any request we receive from that store’s customer rather than answering it ourselves, because the store is the one who has to decide;
• we tell the store without undue delay if we become aware of a breach affecting its data.

If you are a customer of a store that uses Oskii and you want your information removed, ask the store. If it is easier to start with us, write to hello@oskii.app and we will route it.

• Waitlist email addresses: until you unsubscribe or ask us to delete them, or until we abandon the launch they were collected for.
• Rate-limit records: at most one hour, in memory only.
• Server logs: kept by our host for a short period on its normal schedule, then discarded.
• Email correspondence: up to two years after the conversation ends, unless it relates to something we need to keep longer.
• Store data: for as long as the store’s account is open. After it closes, we keep it briefly so the store can export it, then delete it. Backups age out on their own cycle.

Traffic to and from oskii.app is encrypted in transit. Data at rest sits with our hosting and email providers and is encrypted by them. Access to production systems is limited to people who need it. Staff sign-ins use a PIN that expires, and the kiosk runs locked to a single app so a customer cannot wander out of it.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information and puts you at real risk, we will tell you and the relevant regulator within the time the law allows.

Wherever you live, you can ask us to:

• tell you what we hold about you, and why;
• give you a copy of it, in a portable format;
• correct it if it is wrong;
• delete it;
• stop using it for a particular purpose, or restrict what we do with it;
• withdraw consent you previously gave, without affecting what we did before you withdrew it.

Email hello@oskii.app. We will respond within 30 days, and we will not charge you or treat you differently for asking. We may need to confirm you are who you say you are before acting on a request; for a waitlist address, replying from that address is enough.

If you are in California

The CCPA, as amended by the CPRA, gives you the rights above plus the right to know the categories of personal information collected, the purposes, and the categories of third parties it is disclosed to — all of which are in sections 2, 3 and 5. In the last twelve months we have collected identifiers (email address, IP address) and internet activity information (server logs), for the purposes described in section 3.

We have not sold personal information and have not shared it for cross-context behavioural advertising in the last twelve months, and we do not do either now. We do not knowingly sell or share the personal information of anyone under 16. You may use an authorised agent to make a request; we will ask for proof of their authority.

If you are in the EU or the UK

You also have the right to object to processing based on legitimate interests, and the right to complain to your data protection authority. We would rather you came to us first, but the right is yours either way.

If you are elsewhere in the US

Several states — including North Carolina’s neighbours Virginia and Connecticut, and others — give residents similar rights. We apply the rights above to everyone rather than sorting requests by state, so just ask.

We are based in the United States, and our providers process data in the United States. If you are outside the US, using Oskii means your information is transferred there, where the privacy laws differ from your own. Where a transfer out of the EU or UK requires a safeguard, we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum, as incorporated in our contracts with the providers listed in section 5.

Oskii is not directed at children under 13, and we do not knowingly collect personal information from them. The waitlist is for adults running or following a business.

Game stores serve younger players, and a store can only use Oskii’s kiosk with a child if it has the parental consent that the law where it operates requires. That is the store’s responsibility. If you believe a child under 13 has given us information directly, email hello@oskii.app and we will delete it.

When this policy changes we update the “last updated” date at the top of the page. If a change materially affects how we use information we already hold about you, we will email you before it takes effect, so that you can object or delete your information first.

Email hello@oskii.app with anything at all — a question, a request to see what we hold, or a request to delete it. A person reads that address.

See also our Terms of Service.