Privacy Policy

• You can browse cards, build a team and share it without an account.
• We use Google Analytics, but only after you allow it. Decline and nothing is requested from Google.
• There is no advertising and no ad tracking, whether you allow analytics or not.
• We do not sell or share your data, and we send no marketing email.
• Pairings you share are public to anyone with the link.

If you never sign in: we store the team pairing you choose to save — its name, deck names, commanders, card names and quantities, and the time it was created or changed. It is not linked to you. Your browser holds a secret edit token that lets you change it later.

If you sign in with Google: we receive and store your name, email address, profile picture URL and a Google account identifier. We ask Google only for email, profile and openid — never your Gmail, contacts, Drive or anything else. Pairings you save while signed in are linked to your account.

In your browser: the deck builder keeps your in-progress decks, a cache of card data and a reference to your share link in localStorage. That stays on your device and is never sent to us except when you press share.

If you allow analytics: Google Analytics records the pages you view, what brought you to the site, roughly where you are at country level, and what kind of device you use. It reaches us as aggregate reports. We never send Google your name, your email or your decklists.

Server logs: our host records standard request logs including IP address, user agent and requested path. We do not use them to build a profile of you.

We set cookies to keep you signed in. There is a short-lived cookie during the Google sign-in handshake, and a session cookie afterwards. Both are strictly necessary — without them login cannot work.

Google Analytics sets its own cookies to recognise a returning browser. Those are not necessary, so we ask first. The tag is not loaded until you allow it, which means declining the question, or ignoring it, sends no request to Google at all.

There are no advertising or profiling cookies. Every advertising signal Google offers is switched off permanently and is not ours to turn on — we run no ads, so consent for them is never asked and never granted.

The answer is stored in this browser, so it is per device and per browser. Changing it here takes effect immediately.

• Neon (a Databricks company) hosts our database and authentication. Your account and pairings live in a Postgres database in Frankfurt, Germany (EU).
• Vercel hosts and serves the site, and processes request logs.
• Google — for two separate things, each of which you choose. Sign in with Google and Google tells us who you are. Allow analytics and Google Analytics receives your IP address, the pages you open and a cookie that recognises your browser on later visits. Google may process that outside the EU.
• Scryfall provides card data and images. Card images load directly from Scryfall in your browser, so your IP address is visible to Scryfall whenever you view a page showing card art. This is true whether or not you have an account.
• Card marketplaces — TCGplayer, Card Kingdom and Cardmarket. We never send them your data. Buy links are affiliate links carrying only a partner code, and we may earn a commission if you purchase. Once you follow one, that marketplace's own privacy policy applies.

A saved pairing gets an unlisted address like /t/abc123. The address is hard to guess, but it is not private: anyone you send it to can open it, it can be forwarded, and it is built to be indexed by search engines so that pairings are discoverable. Do not put anything in a deck or team name that you would not want published.

Pairings are kept until they are deleted. Account data is kept while your account exists. Ask us to delete either and we will.

Under the GDPR you may request a copy of your data, have it corrected or erased, object to how it is used, or ask for it in a portable format. Ask us on our Discord server and we will act on it.

If you are unhappy with how we handle a request, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

This site is not directed at children under 16. If you believe a child has given us personal data, tell us on our Discord server and we will remove it.

If this policy changes materially we will update the date at the top. Questions go to our Discord server.

See also our Terms of Service.