Privacy policy

Last updated 14 November 2026

Wildspark is made by Natchland Studios. This page says what the game keeps about you and why. The short version: a username if you pick one, your cards and coins plus a record of any coins you buy. No email address, no ads, no tracking.

What we keep

• An account id. The first time you open Wildspark it makes a guest account with a random id, so your cards have somewhere to live. A guest account nobody opens for 30 days is deleted with everything in it, unless something was bought on it. Saving a username keeps your account however long you're away.
• A username and password, if you save your account. The password is stored as a scrypt hash, so we can check it but never read it back.
• Your game. Cards (including which copies are reverse holos or shinies), coins, packs opened, how many packs since your last Ultra Rare and Secret Rare in each set (for the guaranteed pull), missions, game results, your player level and XP, creature levels, each creature's essence and boosts, gym badges, creatures in training, your ranked rating and defence team, your friends and friend requests, the card backs and pack designs you've bought with coins and which ones you're using, settings and favourites, with the time each happened.
• Sign-in tokens. Each device you sign in on gets a token. We store a hash of it. Your device keeps the token itself in local storage. There are no cookies.
• What other players see. Once you set a ranked defence team, players matched against it see that team, your rating and your username, or "Guest" and the last four characters of your account id if you haven't saved one. Players with a username who've played ranked show on the top players list with their rating and record. In a live battle, the players you're matched with or team up with see your username (or your guest label), your rating and the creatures you bring. Your friends see your rating and whether you're online, which the app works out from it checking in once a minute while it's open. Once you've saved a username, other players can open your profile from a faction's member list or their friends list. It shows your level, battle rating, ranked record, faction, the month you started playing, whether you're online, how many creatures you've found, how many packs you've opened, your shinies and gym badges, plus your favourite, strongest and rarest creatures with their levels. Faction members also see each other's level, rating and war points for the week.
• Invite links. Your own invite code. If you joined through a friend's link, who that friend was and whether they've had their coins for it. A faction's invite code.
• Trades. Each trade request you make: the card you asked for, the cards you offered, when you made it, when it runs out and whether it's open, cancelled or done. Once someone gives you the card, who it was, which card they took and when. Your friends and the members of your faction see your open requests with your username. So does anyone you share a request's link with. The player who fills one sees it too. Requests are deleted with your account. If the player who traded with you deletes theirs, the trade stays on your side without their name.
• Coins and cosmetics you buy. For each purchase: which bundle or cosmetic, its price, Stripe's id for the payment, whether it's been paid, when you started it, when you ticked the box asking for the coins straight away and when it was paid. We keep it so we can match a payment to your account and show we added what you paid for.
• Your faction, if you're in one. Which faction, your role in it, when you joined and when you last joined and left a faction (for the weekly joining rule and the cost of switching). Requests to join and invites, with who sent them. Factions you start keep their name, tag, crest, colour and description, which anyone can see. Members of your faction see your username, your role and whether you're online. Messages you send in your faction's chat, with when you sent them, which its members can read. They're deleted after 30 days, or sooner if you or an enforcer deletes them. Your faction's tag shows next to your name for your friends, on the top players list and to the players in a live battle with you. For the weekly faction war: the points you earn each week and for which faction, which milestones you've reached, whether you were in your faction when each war began, how each faction placed and any packs you've won and not opened yet.
• Your Pass, if you have one. Stripe's ids for you as a customer and for the subscription, whether it's on, when the month you've paid for ends, whether it's set to renew, when you ticked the box to start it and the day you last opened its daily Booster.
• What you buy in the Microsoft Store app. For each purchase: Microsoft's id for it, what it was and when we added it, plus how many coins it gave or when a Pass's 30 days end. For a cosmetic, which one you were buying when Microsoft's window opened, and any you've paid for but not picked yet. We keep it so each purchase is only added once.
• Players you block. Who you've blocked and when, until you unblock them.
• Reports. When you report someone: who sent it, who it's about, the reason, your note and a copy of the message if it's about one, plus what we did about it. The reported player is never told who sent it. If we mute or ban an account, we keep when. Reports go when either account is deleted.
• Your Discord account, if you link one. Your Discord user id, your Discord display name and when you linked it. Our bot in the Wildspark Discord server reads the list of linked accounts, with whether your Pass is on and your ranked rating, so it can give you roles there. Everyone in that server can see those roles, so a Supporter role tells them you have the Pass. Unlink from the account sheet any time and the roles our bot gave you come off within a few minutes. If you play Wildspark inside Discord, you sign in with your Discord account there. The first time, a new Wildspark account is made and linked to it, unless you'd already linked one on the website. While Discord is linked and "Post my big pulls in Discord" is on in Settings, your Holo or better pulls, shinies and every fifth level are kept for three days so our bot can post them, with your username and the card, in Discord servers you're in that have the Wildspark bot. Everyone in those servers can see the posts. Switch it off in Settings any time.
• Two things only your device keeps. Your battle team and whether you've put off the reminder to save your account sit in local storage on that device and are never sent to us.

What we don't keep

No email address, real name, location, contacts or device ids. Your IP address is used for a few minutes to stop people hammering sign in or making thousands of accounts, it's held in memory and never written down. The server logs which address on the API was called and whether it worked, without your IP. Your country is checked on each visit, only to keep Wildspark out of countries it isn't offered in. It's never stored. There are no analytics, ads or third party trackers. The fonts are served from our own server.

Payments

When you buy coins, the card form in the coin shop is Stripe's, loaded from Stripe into our page. Your card details, country and postcode go straight to Stripe and never reach us. While the coin shop is open Stripe's script also sees details about your browser and device, which it uses to stop fraud. We send Stripe your account id and the bundle you picked, so the payment can be matched back to you. For the Pass we also send your username. Stripe keeps your card on file to take each month's payment until you stop it. Stripe is our payment processor and keeps its own record of every payment, as the law requires, under its privacy policy. We can look a payment up in Stripe, but none of its card or billing details are copied into Wildspark.

In the Wildspark app from the Microsoft Store, Microsoft takes the payment in its own window with your Microsoft account. It keeps its own record of it under its privacy statement. To find out what you've bought, the app asks Microsoft for a key with your Wildspark account id inside. Our server then shows that key to Microsoft. Microsoft tells us what was bought and when, never your name, email or how you paid.

Cloudflare

The site reaches you through Cloudflare, which protects it from attacks. Cloudflare passes your requests on to our server, so it sees your IP address and tells us which country you're in. It doesn't get a copy of your account or cards. See Cloudflare's privacy policy.

Discord

Linking your Discord account takes you to Discord's own sign in, where you say yes to Wildspark seeing your basic profile. Discord sends us back a one time token, which we use once to read your Discord id and name and never store. Discord learns you use Wildspark when you link. In the Wildspark Discord server, Discord itself holds the roles our bot gives you, under Discord's privacy policy.

Where it lives

On our own server at Hetzner in Nuremberg, Germany. Apart from Stripe and Microsoft for payments and the Discord roles above, nobody else gets a copy and we don't sell or share it.

Deleting it

Open the More tab and press Delete account. Everything above goes straight away, every device is signed out and a Pass is cancelled at Stripe. Stripe keeps its record of any payments and Microsoft its record of anything bought in the Store app, because tax law says payments have to be kept. Reset everything in the same tab wipes your progress, bought coins included, but keeps the account. If you'd rather we did it, email [email protected] with your username.

Kids

Wildspark doesn't ask for anything that identifies a person, so it's fine for any age. If you're under 13, check with a parent before saving an account. If you're under 18, ask whoever pays before buying coins.

Your rights

Under UK and EU data protection law you can ask what we hold about you, get it corrected or deleted, or complain to the Information Commissioner's Office (ico.org.uk). Questions go to [email protected].

If this policy changes, the date at the top changes with it.