This Privacy Policy explains what personal data Mexico Club collects when you visit our websites or play the game, why we collect it, who we share it with, and what choices and rights you have.
1. Who we are
Mexico Club (mexico-club.com and game.mexico-club.com, together the "Service") is an online card game run by Aleksandar Kamenjašević, Belgrade, Serbia. He is the controller responsible for your personal data.
If you have any questions about this policy or your data, write to info@mexico-club.com.
2. Data we collect
Depending on how you use the Service, we process the following data:
- Account data: your email address, display name (first and last name or nickname), profile picture and password. Passwords are stored only in hashed form, never in plain text.
- Sign-in data: if you sign in with Google (or, for some older accounts, Facebook), we receive your name, email address and profile picture from that provider. We never receive the password of that account.
- Game data: the games you play, scores, statistics, ratings and rankings, tournament entries and results, gifts, titles and badges, and your game settings such as card deck and table theme.
- Messages: messages you send in table chat, party chat and private chats with friends.
- Friends and parties: your friends list, friend requests and party invitations.
- Survey answers: answers you give in optional surveys.
- Notification settings: push notification subscriptions for your browser or device, your notification and email preferences, and your preferred language.
- Moderation records: records of mutes, bans and other moderation actions taken to protect players.
- Guest accounts: if you play without registering, we create a temporary guest account with a generated name and store the game data described above for it.
- Technical data: server logs that may include your IP address, browser type, device information, the pages you request and the time of your visit. We also use IP addresses to prevent abuse, for example to limit how many guest accounts can be created.
- Security checks: when you register, Google reCAPTCHA v3 collects hardware and software information, such as device and application data, and sends it to Google to check that you are a real person.
3. How we use your data and legal basis
We use your data only for the purposes below. Where the GDPR or the Serbian Law on Personal Data Protection applies, each purpose relies on a legal basis:
- Providing the game: creating and managing your account, seating you at tables with other players, running games and tournaments, showing statistics and rankings, and providing chat, friends and party features. Legal basis: performance of our contract with you (the Terms and Conditions).
- Public weekly results: if you finish in the top 10 of the weekly ladder, the weekly results page on mexico-club.com shows your first name, the initial of your last name, your place, your points and the pesos you won, but never your picture, profile or email address. You can turn this off at any time with "Show me in public results" in your profile; your row then stays on the page without a name. Legal basis: our legitimate interest in publishing the club's results, with your right to opt out.
- Security and fair play: preventing cheating, fraud, spam and abuse, moderating chat, enforcing our Terms and keeping the Service stable. Legal basis: our legitimate interest in a safe and fair game for everyone.
- Analytics: understanding how the Service is used so we can improve it. Legal basis: your consent, where the law requires it.
- Advertising: showing ads that keep the Service free. Legal basis: your consent to advertising cookies and personalised ads, where the law requires it.
- Emails and notifications: service emails such as account confirmation and password reset (contract), and club announcements and newsletters (consent). Every announcement email contains an unsubscribe link, and you can turn off emails and push notifications in your profile at any time.
- Legal obligations: complying with applicable law and responding to lawful requests from authorities.
We do not sell your personal data.
4. Cookies and local storage
The game uses your browser's local storage and session storage for things it needs in order to work. These entries are not used for advertising:
roulette-access-token— keeps you signed in (short-lived access token).roulette-refresh-token— renews your session so you stay signed in.roulette-user-type— remembers your account type, for example a guest account.mexico-club-lang— remembers the language you chose.mexico-club-notif-prompt— remembers that you dismissed the prompt to turn on notifications.mexico-club-return-url(session storage) — brings you back to the page you were on after you sign in.
We also install a service worker in your browser. It lets you install the game as an app and receive push notifications.
Google Analytics and Google AdSense set their own cookies (for example _ga and __gads) for analytics and advertising, as described below. Where the law requires it, they are used only after you consent. Signing in with Google may also set a short-lived, strictly necessary session cookie.
You can delete cookies and stored data in your browser settings at any time. If you clear local storage, you will be signed out.
5. Analytics
We use Google Analytics 4 to understand how visitors use the Service, for example which pages are visited and how long visits last. Google Analytics uses cookies and similar technologies and collects information such as your device, browser, approximate location and the pages you view. We do not send your name or email address to Google Analytics.
Read more in Google's Privacy Policy. You can also block Google Analytics with the Google Analytics opt-out browser add-on.
6. Advertising
Mexico Club is free to play and is supported by advertising. We use Google AdSense to show ads on our website and on some screens of the game. Ads are never shown on the game table while you play.
Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.
Google's use of advertising cookies enables it and its partners to serve ads to our users based on their visit to our sites and/or other sites on the Internet.
Users may opt out of personalised advertising by visiting Ads Settings. Alternatively, you can opt out of a third-party vendor's use of cookies for personalised advertising by visiting www.aboutads.info.
To learn more, see How Google uses information from sites or apps that use its services.
If you do not consent to personalised ads, Google may still show non-personalised ads, which are based on general context, such as the content of the page and your approximate location, rather than on your browsing history.
7. Your consent choices
If you visit from the European Economic Area (EEA), the United Kingdom or Switzerland, we ask for your consent through a Google-certified consent management platform before analytics and advertising cookies are used, where the law requires it.
You can change or withdraw your consent at any time through the privacy and cookie settings link that the consent tool shows on our website. Withdrawing consent does not affect processing that took place before you withdrew it.
8. Service providers
We share data only with providers that help us run the Service, and only to the extent they need it:
- Hosting provider: the servers and databases that run the Service and store your data.
- Google: Google Sign-In, reCAPTCHA, Google Analytics, Google AdSense and Google Fonts (fonts are loaded from Google's servers, which receive your IP address).
- Meta (Facebook): Facebook Login, for older accounts that were created with it.
- Email provider: sends account emails, announcements and newsletters on our behalf.
- Web push services: your browser's push service (for example from Google, Mozilla or Apple) delivers push notifications to your device.
- AI text service: helps us draft announcements and newsletters and generate some short in-game texts. For in-game texts it may receive the display names of players at the table and game events such as scores. It never receives email addresses, passwords or chat messages.
We may also disclose data when the law requires it, to protect our rights or the safety of players, or if the Service is transferred to another operator, who would remain bound by this policy.
9. International data transfers
Some of our providers, such as Google, process data outside Serbia and the EEA, including in the United States. In such cases we rely on the safeguards required by law, such as adequacy decisions (including the EU–U.S. Data Privacy Framework for certified providers) or standard contractual clauses.
10. How long we keep data
- Account data, game data and messages are kept for as long as your account exists.
- Guest accounts are deleted automatically after a short period.
- Server logs are kept for a limited time and then deleted.
- Moderation records are kept for as long as needed to protect other players.
- When you delete your account, we delete or anonymise your personal data, except where the law requires us to keep it.
11. Your rights
Under the GDPR and the Serbian Law on Personal Data Protection (ZZPL), you have the right to:
- access your personal data and receive a copy of it;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we process your data in certain cases;
- receive your data in a structured, machine-readable format;
- object to processing based on our legitimate interest;
- withdraw your consent at any time.
To exercise these rights, email info@mexico-club.com. You can change most of your profile data and notification settings yourself in your profile. To delete your account, follow the data deletion instructions.
You also have the right to lodge a complaint with a supervisory authority. In Serbia, this is the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik, www.poverenik.rs). If you live in the EEA, the United Kingdom or Switzerland, you can also contact the data protection authority in your country.
12. Children
Mexico Club is intended for users aged 13 and older. If you are under 18, you may use the Service only with the permission of a parent or legal guardian.
Where we rely on consent and you are below the digital age of consent in your country (15 in Serbia, between 13 and 16 in EU countries), consent must be given by your parent or legal guardian.
We do not knowingly collect personal data from children under 13. If we learn that we have, we will delete it. If you believe a child under 13 has given us personal data, please contact us at info@mexico-club.com.
13. Security
We protect your data with appropriate technical and organisational measures: connections are encrypted (HTTPS), passwords are stored only in hashed form, and access to data is restricted. However, no method of transmission or storage is completely secure, so we cannot guarantee absolute security.
14. Changes to this policy
We may update this policy from time to time. We will post the new version on this page and update the "Last updated" date. If the changes are significant, we will also let you know through the Service or by email.
15. Contact
If you have any questions about this Privacy Policy or your personal data, contact us at info@mexico-club.com.