Privacy Policy

Last updated: March 2026

1. Who we are

Webula is a Star Trek CCG 2nd Edition deck-builder and card-search application. The data controller is the Webula project. For privacy questions, open an issue at the project's GitHub repository.

2. Data we collect

2a. Anonymous analytics (PostHog — always on)

On every visit we collect cookieless, anonymous page-view counts via PostHog. This tracking uses no cookies, stores no persistent identifiers, and does not send your IP address to PostHog. Because no identifying information is collected, individual users cannot be tracked or re-identified across visits.

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)). No consent is required for purely aggregate, non-identifying analytics. PostHog's own cookieless mode is designed to be used without a consent gate under GDPR.

2b. Enhanced analytics (PostHog — with consent)

If you click "Accept" in the consent banner, PostHog is re-initialised with standard persistence (cookies / localStorage). This enables richer analytics such as navigation flows and session-level aggregates. PostHog assigns a pseudonymous device identifier stored in a browser cookie. No personally identifiable information is included in these events.

Legal basis: Consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time by clearing your browser's local storage or clicking "Decline" on a new visit.

2c. Google Sign-In and Drive

If you choose to sign in with Google, we request the following OAuth scopes:

  • userinfo.profile and userinfo.email — to identify your account.
  • drive.appdata — to save and load your decks in a hidden app-specific folder in your Google Drive. Only Webula can access this folder.

Your Google access token and refresh token are stored in a server-side encrypted JWT session cookie and are never shared with third parties.

Legal basis: Contract / legitimate interest (GDPR Art. 6(1)(b)/(f)). This data is processed solely to provide the Drive save/load feature you explicitly requested by signing in.

2d. Browser local storage

Deck data (current deck, saved decks, deck title) is stored in your browser's localStorage under the keys browserDecks, currentDeck, and deckTitle. This data never leaves your device and is not transmitted to any server.

Legal basis: Strictly necessary for the functioning of the application. No consent is required.

3. Data retention

  • Anonymous analytics: PostHog retains aggregate page-view data per their own retention policy. No per-user data is stored because no user identifiers are collected. Enhanced analytics (consent-based): Withdrawing consent stops future enhanced data collection but does not delete past events.
  • Google Drive decks: Deck files remain in your Google Drive until you delete them through the app or revoke app access via your Google Account settings.
  • Local storage: Data persists until you clear your browser storage or uninstall the browser.

4. Your rights

Under GDPR you have the right to access, rectify, erase, and port your data, and to object to or restrict processing. For Drive data, you can delete deck files directly in the app or revoke Webula's access at myaccount.google.com/permissions. For analytics data, please contact us via the project's GitHub repository.

5. Third-party services

← Back to card search