Privacy
What CardGrove stores, why, and what you can do about it. In short: the minimum the tool needs, and nothing that gets sold or shared.
What is stored about you
Your account: your email address, a name if you choose to set one, and your password hashed with bcrypt. The password is never stored in the clear and nobody — including whoever runs the server — can read it.
Your collection: the cards you record, their condition and language, where you keep them, what you paid if you note it down, your decks, the images you upload for your proxies, and any notes you write.
Usage: a log of your inventory movements — additions, moves, removals — which is what makes it possible to undo a whole import. There is no analytics, no profiling, no browsing tracking.
What it is used for
Only to run the service: signing you in, showing you your collection, and working out what a deck is missing.
It is not used for advertising, not passed to third parties, and not sold. There are no marketing emails.
Who else sees anything
Card artwork is served by Scryfall straight to your browser from cards.scryfall.io. That means Scryfall receives your IP address when those images load, as with any image hosted elsewhere. It does not receive which cards you own or who you are.
Your proxy images are stored on this server's own storage, not on an external service.
Magic catalogue data comes from Scryfall, but the server downloads it, not your browser.
How long
For as long as you keep the account. If you ask for it to be deleted, everything hanging off it goes too: lots, decks, locations, imports and proxy images.
Your rights
You can access your data, correct it, export it and delete it. Neither the export nor the deletion has to be asked of anyone: you can download a CSV of everything from the collection page whenever you want, and from Settings you can delete your account with everything in it, images included.
For anything else, write to info@cardgrove.app. If you believe your data is being mishandled, you can complain to your national data protection authority.
Contact
info@cardgrove.app. That is the address for exercising any of the rights above, for asking what is stored about you, or for flagging anything that looks wrong.
There is no company behind this: CardGrove is a personal project run by one person, so a reply may take a few days.
Last reviewed: 26/08/2026