External Data Transmission

Google Firebase — required features

Recipient: Google LLC. Data: Firebase user ID, device, OS, app information, authentication and database operations, and security information such as App Check data. Purpose: authentication, sync, Functions, configuration, diagnostics, and abuse prevention. Required traffic ends when the relevant feature or account is no longer used.

Firebase Analytics / Google Analytics 4 / BigQuery

Recipient: Google LLC. Usage analytics is off by default. Data is sent to Firebase Analytics and its linked GA4 property only after you explicitly enable Torica Settings → Privacy → Share Usage Analytics.

Data: allow-listed event names for consent and onboarding, AI outcomes, scans, decks, Solo and Online battles, rewarded ads, packs, Credits purchases, exchanges, missions, and account-deletion actions and outcomes; controlled category values and master-data IDs; counts, Credits and costs, rarity, durations, AI token counts; app, economy, and event versions; and app language. While enabled, the SDK may also process a pseudonymous app-instance identifier and other app or device identifiers, together with app, session, device, OS, app-version, and approximate-region information. Purpose: product reliability, funnel, game-economy, and aggregate trend analysis.

The current app does not call Analytics.setUserID or attach a Firebase Auth UID to Analytics events. It also does not send images, image hashes, card names, free text, municipalities, coordinates, friend codes, request IDs, or StoreKit transaction IDs to Analytics.

If GA4 BigQuery export is enabled, events, parameters, and related SDK metadata collected after opt-in are exported to an access-restricted Google Cloud dataset. Nothing is exported while that link is not enabled. Turning the setting off stops new Analytics collection. Information processed before withdrawal remains subject to each service's configured retention and deletion conditions.

Google Gemini

Recipient: Google LLC. For Deep Scan, the selected image, analysis and safety instructions, language, and request identifiers are sent once to Gemini 2.5 Flash-Lite for factual analysis, card text, and safety review. Friend Scan sends no image unless you expressly enable online use after obtaining the photographed person's permission. With consent, the image, language, and request identifiers are sent once for safety review, not to determine card performance.

Google does not use transmitted data to train models without our permission. Vertex AI inputs, outputs, and related data may remain in a project-isolated in-memory cache for up to 24 hours. Only when suspected abuse is detected, Google may retain prompts for abuse investigation for up to 90 days. Current scans do not use Google Search Grounding.

Google Mobile Ads / UMP

Recipient: Google LLC. Data may include device and network data, ad events, and consent status. Purpose: ad delivery, frequency control, fraud prevention, and consent management. Choices can be changed in Ad Privacy Choices. Personalized advertising is not used for minors.

Apple

Recipient: Apple Inc. and affiliates. Data: Sign in with Apple credentials, App Store transaction information, and device-integrity information. Purpose: authentication, purchase, restoration of Paid Credits to the same Apple account, refund adjustment, and fraud prevention. Apple's policies also apply.

Cloudflare R2

Recipient: Cloudflare, Inc. Data: Deep card images and Friend card images expressly enabled for online use, object identifiers, and network information. Purpose: storage and delivery for online battle and related online use. Local-only Friend images are not sent. Processing ends when the relevant card or account is deleted, subject to backups.

This website

This website uses no analytics service, advertising SDK, tracking cookie, or contact form. Vercel may process IP address, request time, and request details for hosting and security.