Privacy policy

1. Controller

The controller of your personal data is Mox Sapphire s.r.o., Příčná 1892/4, 110 00 Praha 1, Czech Republic, IČO 30003580, registered in the Commercial Register kept by the Municipal Court in Prague, file C 455694. Contact for privacy questions: privacy@moxou.com.

Your account is shared with mox.cz, our Czech and Slovak website: you sign in with the same account on both, and we process your data in the same way on both.

2. What we collect

• Account: your email address and an account identifier. When you sign in with Google, Google passes us your email address and your Google account identifier.
• Visitor country: on every visit we derive your country from your IP address to set the consent flow and the choice of shops. We do not store the IP address for this.
• Purchases: plan, dates, amounts, country. Card details are handled by Stripe, Apple or Google, we never see them.
• Devices: a random installation ID per extension or app, device name, last activity. For the website, the IP addresses used to access full data.
• Settings and lists: formats, badge style, watchlist, unlocked cards.
• Extension usage counts: only with your consent, daily counts per store. Never URLs, page content or card names.
• Measurement and advertising: only with your consent, data collected on moxou.com by Google Analytics, Google Tag Manager and Google AdSense — pages you view, searches, cards you watch, purchases you start, clicks on shop links, your device, browser and approximate location from your IP address, and, when you are signed in, a pseudonymous account identifier (never your email address). Details in Analytics and advertising.

The extension reads store pages only on your device. Page content and the addresses you visit never leave your browser.

3. Why we process it

• To provide the service and your plan, including your unlocks and watchlist (contract).
• To count devices and prevent sharing of keys (legitimate interest).
• To keep invoices (legal obligation).
• To measure how the site is used with Google Analytics, including Google signals, and to show you ads through Google AdSense: in the EU, the EEA, the UK and Switzerland only with your consent (consent, Art. 6(1)(a) GDPR), in the USA unless you opt out. In other countries we do not use Google Analytics or Google ads.

4. Public tournament and artist data

Tournament results can include player names as they were published with the results, and artist pages list artists’ names, official links and public appearances. We use only what was published publicly, on the basis of legitimate interest. Players and artists can ask us to remove or anonymise their details at privacy@moxou.com.

5. Analytics and advertising

Your choice. Your choices are collected only by Google’s consent tool. In the EU, the EEA, the UK and Switzerland it asks for your consent (IAB Transparency & Consent Framework) and nothing is sent to Google for measurement or advertising before you agree; you can change or withdraw your consent at any time in 쿠키 설정. In the USA, Google’s “Do Not Sell or Share” link lets you opt out of the sale or sharing of your personal information for advertising; if your browser sends Global Privacy Control, ads are not personalised. In other countries moxou.com loads no Google Analytics, Google Tag Manager or Google ads.

Google Analytics. With your consent we use Google Analytics 4 through Google Tag Manager to understand how Moxou is used: pages, searches, watchlist changes, purchases started, clicks on shop links, device and browser, and approximate location. When you are signed in we send a pseudonymous identifier derived from your account (a keyed hash, never your email) so we can see visits across your devices. We have turned on Google signals: for visitors who are signed in to a Google account and have allowed ad personalisation there, Google associates the data with their Google account to give us aggregated cross-device, demographic and interest reports. We keep Google Analytics event data for 14 months.

Data sharing with Google. We allow Google to use Google Analytics data to improve its products and services, for modelling and benchmarking, and for technical support. For these purposes Google acts as an independent controller under the Google Measurement Controller-Controller Data Protection Terms. How Google uses information from sites that use its services: policies.google.com/technologies/partner-sites.

Advertising. In the EU, the EEA, the UK, Switzerland and the USA the free plan shows ads delivered by Google AdSense. With your consent (in the USA unless you opt out), Google and its partners may personalise ads based on your interests and measure how ads perform; in the EU, the EEA, the UK and Switzerland no Google ads load without your consent. Google acts as an independent controller for ad serving. You can also manage ad personalisation in your Google account at adssettings.google.com. Remove ads and subscriptions turn ads off.

Transfers. Google may process data outside the EEA, including in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, and Google also relies on the European Commission’s standard contractual clauses.

6. Who helps us

Hosting and database providers, Stripe for web payments, Apple and Google for in-app purchases, an email delivery provider for receipts and alerts, and Google (Google Ireland Limited in the EEA) for Google Analytics and Google Tag Manager. They process data on our behalf under data processing agreements. Google is an independent controller for ad serving and for the data sharing described above.

7. How long we keep it

Account data until you delete your account. Invoices for 10 years as required by Czech tax law. Web IP addresses for device counting are stored only as salted hashes, for 30 days. Server logs for 30 days.

8. Your rights

You can access, correct, export and delete your data in your account under Privacy & data. You can also ask us to restrict processing and object to processing based on legitimate interest; write to privacy@moxou.com. You may lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.gov.cz) or with the supervisory authority in your own EU country.

9. Cookies

We use necessary cookies for sign-in and settings. Measurement and advertising cookies are used only as described in Analytics and advertising; in the EU, the EEA, the UK and Switzerland only if you allow them in 쿠키 설정.

• Necessary (always on): sign-in session, site language, card language and time zone.
• Measurement: Google Analytics _ga and _ga_<ID>, up to 2 years.
• Advertising: Google cookies such as __gads, __gpi and IDE, up to 13 months, and the choices stored by Google’s consent tool (the consent string in the EU, the EEA, the UK and Switzerland, the opt-out in the USA).