Privacy policy

Manage your data (self-serve, no email needed)

Members can log in to download a copy of their data, correct details in Settings, withdraw digest consent, or delete their account — without emailing anyone. The contact form remains available if you prefer human help.

What we collect and why

• Account details (email address, display preferences, country/currency settings) — to operate your account and localize prices.
• Collection data (owned cards, sealed products, decks, import files, acquisition costs you enter) — this is the service itself; it is stored so your collection persists between visits.
• Product telemetry (which pages and features are used, performance timings) — to keep the site fast and decide what to improve. Telemetry identifies members only by internal hashed IDs, never by email in stored records.

We do not sell personal information. There is currently no payment processing on this site.

Cookies and third-party services

• Strictly necessary cookies: session and authentication cookies that keep you logged in, plus a CSRF token that protects forms. The site does not work without these.
• Analytics (Google Analytics 4, via Google Tag Manager): measures anonymized visits and page usage so we understand which features members use. IP addresses are anonymized by Google before storage. The tracker loads only when configured; it is absent on non-production environments.
• Advertising (Google AdSense): free-tier accounts see ads served by Google. Google and its partners use cookies to serve and measure ads, including personalized advertising based on your visits to this and other sites. You can manage personalization in your Google Ad Settings, opt out of participating networks at aboutads.info, or block third-party cookies in your browser (parts of the free tier may show unfilled ad slots as a result).

There is currently no cookie consent banner. Strictly necessary cookies apply on login by necessity. Analytics and advertising trackers load only in production when configured; you can block third-party cookies, use the Google opt-outs above, or go premium to remove ads. Digest emails are opt-in in Settings (default off); newsletter signup is a separate explicit opt-in on the landing page.

Data sources (no user data sent)

Card catalog data comes from MTGJSON and Scryfall, fetched server-side. No member information is shared with these sources. Card images are served from our own storage.

Retention and deletion

Collection data is kept for the life of your account. Operational backups rotate: production database dumps 7 days locally plus 7 daily pulled copies, testbed 14 days, primary pipeline dumps 2 days, off-box mirror 14 snapshots, plus a daily host snapshot. Production backups are access-controlled; off-box mirror copies additionally carry GPG ciphertext (operator-held key) while primaries stay plaintext for operations. You can download, correct, or delete your data at any time from the self-serve links above, or via the contact page; deletion removes your account, collection, and preferences from production systems (surviving only in backups until they rotate).

Your rights (Québec Law 25)

If you reside in Québec, you have the right to be informed about, access, correct, and request deletion of your personal information, and to withdraw consent to communications. Use the self-serve tools above for immediate effect, or direct requests via the contact page; we respond within 30 days.

Changes to this policy

Material changes will be noted on the changelog. Continued use of the site after changes take effect constitutes acceptance.