Privacy

What is stored about you

Your account: your email address, a name if you choose to set one, and your password hashed with bcrypt. The password is never stored in the clear and nobody — including whoever runs the server — can read it.

Your collection: the cards you record, their condition and language, where you keep them, what you paid if you note it down, your decks, the images you upload for your proxies, and any notes you write.

Usage: a log of your inventory movements — additions, moves, removals — which is what makes it possible to undo a whole import. There is no analytics, no profiling, no browsing tracking.

What it is used for

Only to run the service: signing you in, showing you your collection, and working out what a deck is missing.

It is not used for advertising, not passed to third parties, and not sold. There are no marketing emails.

Who else sees anything

Card artwork is served by Scryfall straight to your browser from cards.scryfall.io. That means Scryfall receives your IP address when those images load, as with any image hosted elsewhere. It does not receive which cards you own or who you are.

Your proxy images are stored on this server's own storage, not on an external service.

Magic catalogue data comes from Scryfall, but the server downloads it, not your browser.

How long

For as long as you keep the account. If you ask for it to be deleted, everything hanging off it goes too: lots, decks, locations, imports and proxy images.

Your rights

You can access your data, correct it, export it and ask for it to be deleted. You do not need to ask for the export: you can download a CSV of everything from the collection page at any time.

For anything else, write to whoever runs this instance. If you believe your data is being mishandled, you can complain to your national data protection authority.