SERVICE INFORMATION

Privacy

Data we use

You sign in with your iaen account (cuenta.iaen.es), the same one for every iaen game and site. That account asks Google only for “openid” (neither your email nor your name) and gives Cromos nothing but a fixed identifier of your account (sub) and your username. We store that, the cards you claim and the sessions needed to keep you signed in. We do not have your email, your real name or your picture.

Other people see you by your alias, which is your iaen username in lower case. If that name changes, the old one leads to your new showcase for 30 days. Accounts created before the iaen account also stored your Google email, name and avatar: they stay in the database as they were and are erased when that account is deleted.

Linked games

You can link an iaen game (Arrakis, for example) from My account: you get a single-use code and type it in the game. Its server then sends us your player identifier in that game and, optionally, your player name; we store them with your account. Later, when you earn an achievement, the game server tells us which one (with that identifier) and we give you a card. We only send back your public alias and the achievements we have already awarded. Games that use the iaen account (Arrakis) need no linking: their server names your account by its identifier (sub) so we can give you an achievement’s card. You can unlink a game whenever you like; the cards you earned stay with you. Each achievement is awarded once per account and once per player: for that we keep a hashed fingerprint of your player identifier, which stays even if you delete your account and cannot be turned back into it.

What for

We use that data solely to identify your account, protect the admin panel and maintain your inventory. We do not sell data and we include no advertising trackers.

Retention and your rights

Data is kept for as long as your account exists. From My account you can exercise your rights yourself:

• Access and portability: “Download my data” gives you a JSON file with your profile, sign-in methods, copies, wishlist, highlights, trades, listings, duels, games and rewards, linked games and achievements, chat messages, scrap and badges. Other people appear only by their public alias.
• Erasure: your Cromos account is your iaen account, the same one for every game and site at iaen.es, so it is deleted in one place: at cuenta.iaen.es. When you delete it there, the iaen account tells us (a signed server-to-server notice, repeated until we receive it) and we delete your Cromos account, just as every iaen game and site deletes what it keeps. Here that ends your sessions, cancels your open trades, listings and duels, retires all your copies for good (their numbers are never reused and the runs do not grow) and erases your name (and, on older accounts, the Google email and avatar), sign-in methods and linked games, sessions, wishlist, highlights, badges, games and messages, the notes you wrote on trades and listings and your player identifier on achievements. Your aliases and name also disappear from the internal log, where you become “@cuenta-borrada”; your aliases stay reserved for the time they have left, without saying whose they were. The account remains as an anonymous record so the history of trades and runs still adds up. To avoid acting on a notice twice we keep its identifier (with nothing about you) until it expires, a day later. If you create another iaen account and sign in, you start a brand-new, empty Cromos account. Download your data first if you want to keep it.

The internal activity log (who claimed or traded what, packs opened) is deleted after 365 days.

To correct data or for any other request, use the contact channels published on iaen.es. Backups keep deleted data for up to 30 days until they rotate out; if one ever had to be restored, the deletions would be applied again.

Who can see your collection

Your inventory starts private: nobody else can see it from the site. The site administration can look at it from its panel to provide support and to check how runs are being handed out.

If you turn the showcase on from your inventory, your collection becomes public at an address of its own (/u/your-alias), next to your alias. No other data of yours appears. You can turn it off whenever you like and that page stops existing for everyone else.

With the showcase on, other signed-in people can propose card trades to you. A proposal shows both parties the copies on each side, its note and the alias of whoever sent it. When a trade is accepted we record who each copy went from and to, and when, to provide support and curb abuse.

Cards held without an account

If you hold a card or open the welcome pack before signing in, we store a technical cookie in your browser (cromos_anon, 30 days) to recognise your hold; our database keeps only a hashed fingerprint of it, never its value. To curb abuse we also keep a hashed fingerprint of your IP address, which cannot be turned back into it. Holds and those fingerprints are deleted after 30 days. We count visits and pack openings as daily totals, without storing people, IPs or cookies.

Providers

Sign-in is provided by the iaen account (cuenta.iaen.es), which in turn uses Google only to recognise you. Some cards have a video hosted on YouTube: the page loads nothing from YouTube until you press play, and then uses its no-tracking-cookie player. Hosting and the database run on iaen.es infrastructure. Card images are public; inventories are not.

Updated · 23 October 2026