WINGED

A trading card game
🎬

☁ THE SKY — fight with WINGS

their sky is open
your sky is open

⛰ THE GROUND — fight with ROOTS

their ground is open
your ground is open
YOUR HAND

WHAT JUST HAPPENED

GAME

SYMBOLS

WINGED

A trading card game
WINGED·Studios 11
·

THE CIRCUIT

Start the circuit over?

Every Skyhold goes back to locked and you choose a circuit again — this is how you take the other faction's. Your Flight returns to that side's starter. Decks you have already won, your saved free-play decks and your duel record are not touched.

CHOOSE YOUR FLIGHT

PLAY A FRIEND

SHOP

COLLECTION

My cards The whole set All ⚡ Stormcrest 🌳 Deeproot 🔥 Emberfall Everything Beings Gales Guards

SETTINGS

LanguageMenus, prompts and card text. English rules text stays the rules authority.
SoundImpacts, card plays, the turn bell and Guardian speech.
VolumeHow loud the game is overall.
OpponentApprentice misplays often. Master always takes its best line.
Their paceHow long each of the opponent's moves is shown for.
Guardian voicesSkarra, Vessa and Ashka speak a few times a match, with captioned audio.
Reduce motionShortens the versus intro and trims animation. Helps if movement is uncomfortable.
AnalyticsGoogle Analytics — page views only, no ads, no cross-site tracking. Off by default; see Privacy & Imprint.
BuildThe client this tab loaded. Quote it in a bug report.
Release notesWhat shipped in this version, and what's coming.
Play backgroundThe picture behind the menus and behind the board. Clear an act of the Circuit to earn another.
Card backThe picture on every face-down card — your hand as it is dealt, and a hidden hand.

PRIVACY & IMPRINT

Imprint

WINGED is made by Studios 11 (Wings and Roots Visions GmbH), part of the Winged Games brand, based in Switzerland. Wings and Roots Visions GmbH is the legal entity behind it, and is the controller of everything described below.

  • Registered address: Wings and Roots Visions GmbH, Lohngasse 44, 2562 Port, Switzerland
  • Commercial register (UID): CHE-257.301.121
  • Data-protection contact: [email protected] — write here to ask what is held about you, to have it corrected, or to have it deleted.

What is collected, and by whom

Playing the game itself collects nothing. WINGED plays fully offline and signed out — no account, no analytics, no request to anyone but the page you loaded (AGENTS.md rule 9). Two things are optional and separate:

  • An account, if you create one. Email, display name, a password hash (never the password itself), session metadata, your decks, your settings and your match summaries — stored so the feature you asked for (staying signed in, keeping your collection) works. This is not gated by the analytics choice below: it is strictly necessary for the feature itself, the same reasoning the session cookie already documents (server/README.md § "Personal data"). Delete it any time from an in-account option that removes everything, immediately, with no soft-delete.
  • Google Analytics, only if you accept it. Page views and basic technical data (browser type, rough location from IP, approximate device) — nothing that identifies you by name. Nothing loads, and no cookie is set, until you click Accept on the banner or turn the Analytics switch on in Settings. Declining is exactly as easy as accepting, and changing your mind later works the same way in both directions.
    Processor: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland) — the Google entity that contracts with customers in Switzerland and the EEA — under the Google Ads Data Processing Terms, which Google states supersede and replace the earlier Google Analytics Data Processing Amendment. Which entity and which terms this property was actually signed up under is recorded in the Google Analytics admin console and nowhere in this codebase, so it is stated here as the expected answer rather than a checked one: TODO: verify against the terms accepted on the property (tracked with the other console settings as issue #347).

Legal basis

Google Analytics runs on your consent (Art. 6(1)(a) GDPR / Swiss revDSG) — withdrawable at any time via the Settings toggle, with immediate effect for that browser tab. Account data is processed because you asked for the account (performance of a contract with you / a legitimate interest in running the service you signed up for).

Retention

Account data: sessions are purged 7 days past expiry; everything else is kept until you delete the account (server/README.md § "Personal data" is the source of record for this — read it for the exact schedule).

Google Analytics: IP anonymisation is set in code (anonymize_ip: true, on every gtag('config', …) call — see consent.js). The GA property's data-retention window and Google Signals are configured in the Google Analytics admin console, not in this codebase. This release deliberately leaves both at Google's own defaults; choosing a shorter retention window and switching Google Signals off is scheduled work, tracked internally as issue #347. This page will state the exact window once it has been read off the console — it does not guess one here.

Children

WINGED is played in part by children, and there is no age check in front of the analytics choice — everybody is asked the same question, at any age. What this release relies on instead is that nothing is collected from anyone without an explicit opt-in: decline, or simply never answer the banner, and Google Analytics is never loaded, never called, and sets no cookie.

Whether an age gate is nevertheless required — by US COPPA, the UK ICO children's code, any Swiss or EU equivalent, or by Google Analytics' own terms for a service used by children — is an open legal question. It has been deliberately deferred to a later release rather than answered here, and is tracked internally as issue #346. Until it is answered, nothing on this page is a claim of compliance with those rules. The only claim made is the factual one above, about what the code does and does not do.

How to object

Click Decline on the banner the first time you see it, or open Settings → Analytics at any later point and switch it off — both stop Google Analytics from loading or being called again in that browser tab, and clear the GA cookies this page can still reach. For account data, delete your account from within it; nothing here can act on that request on your behalf, since only you are signed in to it.