Privacy policy

Translation for convenience — the German version is the binding one.

1. Controller

[first and last name], [street and number], [postcode city], Germany
Email: [email address] — more in the legal notice.

2. In short

• We only process what the app needs: your account and the collection data you enter yourself.
• No ads, no tracking, no analytics tools, no selling or passing on data for advertising.
• You can download all your data and delete your account with all its data at any time (Settings → Account → “Your data”).

3. Hosting and server logs

The website runs on a server of [Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany]. Each request processes technically necessary data: IP address, time, requested address, browser identifier. They serve operation and security (fending off attacks) and are deleted after [7] days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).

4. Account and login

For an account we store your email address and your password (only as an encrypted hash), and optionally a display name and a profile picture. Legal basis: Art. 6(1)(b) GDPR (providing the app you use). An account isn't possible without an email address and password.

Database and login are run for us by [Supabase Inc., USA] as a processor; the data is stored in a data centre in the EU ([Frankfurt]). A data processing agreement is in place; where access from the USA is possible, it is covered by [EU standard contractual clauses / EU-US Data Privacy Framework].

5. Your collection

We store what you create or import in the app: cards and products with quantity, condition, language, location and notes, purchase prices, your own prices and their history, binders, decks, watchlist, settings, and the value history worked out from them. Uploaded files (e.g. CSV exports) are read in your browser; only the recognised rows are sent to us — rows that can't be matched stay under “Needs review” until you dismiss them. Legal basis: Art. 6(1)(b) GDPR.

Price data (the Cardmarket price guide, TCGplayer prices via MTGJSON) is public market data without personal reference.

6. Card images from Scryfall

Card images are loaded directly from the servers of Scryfall, LLC (USA). For technical reasons Scryfall receives your IP address and browser identifier, and data may be transferred to the USA. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in showing the cards). More: Scryfall's privacy policy.

7. Emails

We send emails to confirm your account and to reset your password, and — only if you switch them on — price alerts to the address you enter. Sent via [email service, address] as a processor. Legal basis: Art. 6(1)(b) GDPR; you can switch price alerts off in the settings at any time.

8. Cookies and storage in the browser

We set only one cookie: the login cookie that keeps you logged in. Your browser also keeps a few display settings (e.g. list or picture view, the open tab, filters) that stay on your device. Both are strictly necessary for the use you ask for (§ 25(2) no. 2 TDDDG), so no consent is needed. There are no tracking or advertising cookies.

9. Browser extension (optional)

The optional extension only reads the Cardmarket product page you open yourself through a link in the app, and sends a price to your account only when you click. It uses a personal key that we store only as a hash; you can delete it in the settings at any time.

10. How long data is kept

We keep your account and collection data until you delete it or your account. Deleting your account deletes all data at once; it remains in backups for up to [7] days, then it is gone for good. Server logs: [7] days.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Access, portability and erasure you can exercise directly in the app (Settings → Account); otherwise an email to us is enough. You can also complain to a data protection supervisory authority, e.g. [competent state data protection authority].

12. No automated decisions

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

13. Changes

We update this policy when the app or the law changes; the current version is always here.

As of: [date]