The short version for parents
The Reefbound adventure requires an adult-managed account. Children should not enter their own email address. The adventure keeps a local copy of game progress and synchronizes its three save slots through Supabase so the family account can continue on another device or restore progress after local browser data is lost. Saves can include player-entered player and best-friend names, progress, settings, and decks. Reefbound does not offer public chat or player profiles and does not load Google Analytics on adventure or account sign-in pages. Email updates are optional and separate from game access.
An adult can request access to, export, correction, or deletion of account and cloud-save information by emailing maker@seapalstcg.com. We may verify control of the relevant account before acting on the request.
1. Who operates SeaRealm
Sea Realm, LLC (“Sea Realm,” “we,” “us,” or “our”) operates the SeaRealm TCG website, online tools, store preview, surveys, and the Reefbound adventure at searealm.com. This policy applies to information handled through those services.
SeaRealm is designed for families, including children. Parents and legal guardians should review this policy and supervise a child’s use of the site. A public privacy policy does not replace any direct notice or verified parental permission that applicable law may require.
2. Information we collect and why
Adult-managed adventure accounts
We collect the adult account email address, an authentication identifier, sign-in and security information, and records showing when an adult approved adventure access and whether that adult separately requested marketing email. If Google sign-in is selected, Google and Supabase may provide and store basic account details such as the account email, name, profile image, and provider identifier. We use this information to create and secure the account, authorize access, prevent abuse, and answer account requests.
Adventure progress, sync, and device storage
Reefbound keeps save files in local browser storage and synchronizes the account's three save slots to account-owned records hosted by Supabase. A save can include player-entered player and best-friend names, campaign and collection progress, settings, decks, inventory, quests, world position, and other game state. We use this information to let a family account continue across devices, restore an account copy after local data is lost, and resolve synchronization conflicts.
If two devices change one slot independently, Reefbound preserves the conflicting copies and asks which one to keep instead of silently overwriting progress. Removing a profile creates a synchronized deletion record so an older offline device does not restore it as the current save. Clearing a browser's site data removes that device's local copy but does not by itself delete the account's cloud copy.
Optional email updates
If an adult requests updates, we send the email address to Kit. The homepage signup may also collect an optional first name and referral answer. We use this information only for requested SeaRealm news, product announcements, card updates, and parent resources. After a completed game session, the adventure may separately invite the adult account holder to request a confirmation email. Both the adult-account and marketing confirmations begin unchecked, and Kit's confirmation must still be completed. Account creation and continued play do not require marketing consent, and every marketing message must provide an unsubscribe option.
Surveys
Surveys may collect a player’s first name or nickname, age, game preferences, written feedback, and reward-counting status. The raw response is private to authorized Sea Realm administrators. We may publish de-identified totals and summaries. A parent or guardian should submit any survey for a player under 13, and free-text answers should not contain contact details or other identifying information.
Bug reports
Reefbound and the Simulator offer a private bug-report form. It may collect a written description, steps to repeat the problem, the expected result, player-selected impact, and limited technical and game context such as the page, browser, screen size, game phase, round, card identifiers, and board health values. The form does not intentionally attach an account email, account identifier, player name, or Reefbound save file. Reporters should not type personal information into the free-text fields, and a parent or guardian should help a player under 13 submit a report. We use reports to reproduce, prioritize, repair, and verify problems with the games.
Store and transactions
If checkout is enabled, Stripe may collect contact, payment, billing, shipping, tax, and fraud-prevention information. Sea Realm receives order and fulfillment details such as name, email, selected shipping or Elverson pickup method, shipping address when delivery is selected, purchased items, totals, payment state, and receipt references. Sea Realm does not receive or store a full payment-card number.
After Stripe confirms a paid order, Resend processes an email alert to Sea Realm containing the customer contact information, purchased items and quantities, production speed, fulfillment method, totals, and any delivery address needed to prepare the order. These alerts are used only for order administration and fulfillment.
Website analytics, logs, and support
Completed Simulator V2 matches contribute anonymous game counters to public, combined statistics about cards, decks, abilities, resources, and outcomes. Match reports contain a random match identifier, timing, deck identifiers, AI difficulty, and game totals. They do not contain player names, account identifiers, or replay logs. Pending reports are kept in local browser storage for retry. Submission limits use a separate, daily rotating hash of the request address, which is not linked to match reports; expired limit records are cleared during subsequent submissions. Tutorials and Reefbound adventure games do not contribute to these reports.
On general site pages, Google Analytics may receive page, device, browser, approximate location, referral, cookie, and usage information. Google Analytics is excluded from adventure, authentication, checkout-result, and administration routes. Cloudflare and other infrastructure providers may process IP addresses, request headers, timestamps, device or browser information, and security signals to deliver and protect the site. If someone contacts us, we receive the information included in that message.
5. Retention and deletion schedule
We limit retention to the period reasonably needed for the purpose described below. At the end of the period, information will be deleted or de-identified unless a longer period is required by law, a payment dispute, fraud prevention, safety, or an active legal matter.
| Category | Maximum period | What happens next |
|---|---|---|
| Pending adventure approval | 1 hour | The signed, essential setup cookie expires automatically or is cleared when setup finishes. |
| Adult account and adventure authorization | While active; deletion within 30 days of a verified request | Limited security records may be kept for up to 90 days when needed to investigate abuse or protect the service. |
| Optional email updates | Until unsubscribe or a verified deletion request | A limited suppression record may be retained to make sure an unsubscribe request is honored. |
| Identifiable survey responses | Up to 12 months | After that period, the response is deleted or stripped of identifying fields. De-identified totals may be retained. |
| Bug reports and game diagnostics | Up to 24 months after submission | Reports are deleted or de-identified sooner when practical after resolution, unless they are needed for an unresolved safety, security, or legal matter. |
| Orders and transaction records | Up to 7 years | Records may be retained for tax, accounting, fraud prevention, chargeback, and legal obligations. Sea Realm does not store full payment-card numbers. |
| Website analytics | Up to 14 months | Analytics are not loaded on adventure or account-authentication routes. Aggregate, de-identified reports may be retained. |
| Routine server and security logs | Up to 30 days; up to 90 days for an active security matter | Hosting providers may retain protected backup or security records for a limited additional period under their own schedules. |
| Support correspondence | Up to 24 months after resolution | A record may be kept longer when reasonably needed to document an unresolved dispute or legal obligation. |
| Reefbound cloud saves | While the profile and account are active; prior versions for up to 30 days | A current deletion record remains while the account exists to stop an offline device from restoring a removed profile. Account deletion removes active saves, deletion records, and save history. Provider backups may take a limited additional period to age out. |
Active cloud saves are kept while the corresponding family account and Reefbound profile remain active. After a profile is removed, prior save versions may be kept for up to 30 days for recovery and security, then deleted. The synchronized deletion record remains while the account exists so an older offline device cannot restore that profile as current. A verified account-deletion request removes active cloud saves, deletion records, and save history with the account. Supabase or other infrastructure backups may take a limited additional period to age out under the provider's backup schedule.
6. Parent and account-holder rights
A parent, legal guardian, or adult account holder may ask us to:
- confirm whether we hold information connected to an account;
- review, receive an export of, or correct that information;
- delete the account and associated personal information;
- stop further collection or use; or
- withdraw optional email consent.
Send the request from the account email, when possible, to maker@seapalstcg.com. Include enough information to identify the relevant account or submission, but do not send government identification unless we specifically request an appropriate verification method. We will verify authority before disclosing or deleting account information and aim to complete verified deletion requests within 30 days. An account export can include the account's cloud saves in a portable form.
Marketing email can also be stopped through the unsubscribe link in the message. Removing a Reefbound profile synchronizes that profile's deletion; deleting the family account removes its active cloud saves and save history. Local copies on devices that remain offline may persist until the profile is removed there, the device reconnects, or the browser's site data is cleared.
7. Children’s privacy
Children should not submit their own email address, full legal name, home address, phone number, school information, or other contact details through SeaRealm. The adventure instructs players under 13 to ask a parent or guardian to create and manage the family account. Adventure access is not conditioned on joining the marketing list.
If you believe a child submitted personal information without appropriate adult involvement, contact us so we can investigate and delete it. The current adult-approval checkbox is an account-access safeguard; it should not be understood as a claim that every possible legal parental-consent requirement has been satisfied.
8. Security
We use measures intended to protect personal information, including encrypted connections, limited administrative access, server-side credentials, signed setup records, and access controls. No service can guarantee perfect security. Please contact us promptly if you believe an account or edit link has been compromised.
9. Changes to this policy
We may update this policy as SeaRealm changes. The effective date at the top will be revised, and material changes affecting previously collected information may also be communicated directly to the relevant adult account holder when required.
The accompanying Terms of Use describes the rules for using SeaRealm.
Operator and privacy contact
Questions, parent requests, account-deletion requests, and privacy concerns can be directed to: