Privacy policy — Ultrascoins

1. Who processes your data

The data controller is the Ultrascoins project team. We are not affiliated with EA Sports or Electronic Arts and do not act with their approval.

This policy covers three parts of the project: the browser extension, the price service (shared price database and SBC solver) and the project panel.

For data questions and deletion requests contact us on Discord (section 11).

2. What we collect and why

We collect data about the market and about how the bot works. This does not cover your EA account — we never send that (section 3).

• Card prices you see on the market are sent anonymised: card number, price, time and platform.
• Your search parameters and the number of results are sent to build a shared price database.
• Purchase, listing and relist decisions and sale results (including unsold) are sent with the after-tax result.
• The installation identifier is a random number in your browser; the service turns it into an HMAC that cannot be linked to your EA account.

On top of that comes what the tool needs to work:

• SBC solver and portfolio planner: the task constraints (league, nation, club, rating, budget) and the candidate list from your club and the market — without item identifiers (itemId, assetId) and without the session identifier (sid). The service computes the squad from them and rejects a request that contains those fields.
• Notifications: the notification text and run counters go to our bot, which delivers them as a direct message (DM) to your Discord account.
• Panel login: Discord OAuth2 with the identify scope gives us your id, username and avatar; we use them to check your role. We never see your password and never ask for it.
• Panel event log: the event type (purchase, listing, sale, STOP), account alias, time and result — without tokens or passwords.
• Extension settings (intervals, filters, presets, view) are stored locally in chrome.storage.local.

Why: a fresh shared price database (including cards external sites do not cover), profitability of cards, SBC and packs, rejecting outlier readings, rating source reliability and the bot's after-tax result.

Legal basis (GDPR): performance of the contract and terms (Art. 6(1)(b)), our legitimate interest in a shared price database and in measuring the tool's effectiveness (Art. 6(1)(f)), and your consent where the law requires it (Art. 6(1)(a)).

3. What we never collect

• We do not collect EA account data: coin balance, club name, item identifiers or account history.
• The EA session cookie and the x-ut-sid token stay in your browser and never reach our servers.

• We do not collect EA or Discord passwords, e-mail addresses, payment data or Keychain data.
• We do not collect item identifiers (itemId, assetId), the session identifier (sid) or account history.
• We use no ads, no third-party analytics and no tracking cookies.

4. Pseudonymisation (GDPR)

The installation identifier is random and lives only in your browser. The service turns it into an HMAC — a keyed hash — and uses it in that form only, for rate limits and source reliability. This is pseudonymisation under Art. 4(5) GDPR: the HMAC cannot be turned back into your EA account, and we never link it to account data.

Market data is stored as per-card aggregates (price levels, offer count, time), and the event log shows accounts as aliases, not logins.

5. Condition of use and consent

• Sharing this anonymised data is a condition of using the tool.

In the beta, background observations (prices, pack openings, listing results) are switched on by the “Share Anonymous Data” toggle in the extension settings. The community release requires data sharing under the terms; that change will be described here and in the first-start popup.

The first-start popup shows the risk to your EA account and requires acceptance — without it the bot does not start. The same popup returns when the terms change.

6. Who we share data with

Only what the tool needs to work:

We do not sell data and do not share it with anyone else. The price service and solver run on the project's own infrastructure.

7. How long we keep data

• Installation id HMAC: up to 90 days after the last report.
• Prices, sale results and pack openings: a short window in the service memory (up to 7 days), then only per-card aggregates without the installation id.
• Bot decisions and the event log: up to 12 months.
• Extension session: a 24 h token and a 30-day refresh token (at most 90 days from login). Panel session: 30 days from the last activity.
• Local settings and the Discord profile in the extension: until you remove them — by logging out, clearing the extension data or uninstalling it.

8. Your rights

You have the right to access, rectify, erase, restrict and port your data, and to object to processing based on legitimate interest (Art. 15–21 GDPR). You may also complain to the Polish data protection authority (UODO).

Send your request through our Discord — we answer within 30 days. Pausing background observations or uninstalling the extension stops further collection; per-card aggregates no longer identify you.

Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

9. Security

• Your EA session stays in your browser; tokens for our service are held only by the extension background worker (MV3), never by the EA page.
• Refresh tokens are stored in the database only as a keyed HMAC, never in plain text.
• The extension code is open source — you can check exactly what it sends.

10. Changes to this policy

Changes are published on this page with a new date. When the terms change, the first-start popup asks for acceptance again; continued use means you accept the new version.

11. Contact

Questions about your data, access to it and deletion requests: our Discord. We answer within 30 days.

Message us on Discord →