Privacy Policy
1. Who we are
Deckiverse (the "app", "we", "us") is operated by [LEGAL NAME OF OWNER OR COMPANY], [MAILING ADDRESS]. We are the controller of the personal information described here. Contact us at [email protected].
This policy covers the Deckiverse mobile apps and the website deckiverse.app.
2. Information we collect
Information you give us
- Account information: your email address and password. Passwords are stored by our authentication provider in hashed form; we never see them. A username, if you choose one.
- Quiz answers and results: your answers to the playstyle quiz, your scores, your archetype, and the commanders suggested to you.
- Your collection ("binder"): if you import a collection file (for example a CSV export from TCGplayer), the file itself and the card details in it: card names, sets, collector numbers, quantities, finish, condition and language.
- Saved decks: decks you save, their names and settings.
- Messages: anything you send us by email.
Information created when you use the app
- Subscription status: whether you have Premium, which plan, when it renews or expires, which store you bought it through, and a subscription customer ID. Payments are processed entirely by Apple or Google; we never receive your card or bank details.
- Store link activity: when you tap a "Buy" button, we record which store (TCGplayer or Card Kingdom), the commander, the number of cards and the estimated total, so we can reconcile affiliate commissions.
- Technical information: your IP address, device and operating system type, app version, and request logs, collected by our hosting providers to deliver the service, keep it secure and fix problems.
What we don't collect
We don't collect your precise location, contacts, photos (other than a file you choose to import), microphone or camera data, or your device's advertising identifier. The app contains no advertising or third-party analytics SDKs.
3. How we use your information
| Purpose | Information used | Legal basis (EU/UK) |
|---|---|---|
| Create and secure your account; sign you in | Account information, technical information | Performing our contract with you |
| Score the quiz, suggest commanders, build decks, show what you own | Quiz answers and results, binder, saved decks | Performing our contract with you |
| Provide Premium features you've paid for | Subscription status | Performing our contract with you |
| Send account emails (confirm your email, reset your password) | Email address | Performing our contract with you |
| Reconcile affiliate commissions from store purchases | Store link activity | Our legitimate interest in being paid commissions we've earned |
| Keep the service secure, prevent abuse, fix bugs | Technical information | Our legitimate interest in a safe, working service |
| Comply with law and respond to lawful requests | Any, as required | Legal obligation |
We don't send marketing emails. We don't use your information for automated decisions that have legal or similarly significant effects on you. Deck suggestions are generated automatically from card data and your quiz answers, for your entertainment and convenience only.
4. Who we share it with
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it only with service providers that help us run Deckiverse, under contracts that limit their use of it, and in the other cases below.
| Provider | What they do for us | What they receive |
|---|---|---|
| Supabase | Database, sign-in, file storage and server functions | Everything stored in your account, technical information |
| Resend | Delivers account emails | Your email address and the email content |
| Cloudflare | Hosts this website; forwards email sent to our addresses | Technical information from website visits; emails you send us |
| RevenueCat | Manages Premium subscriptions | Subscription customer ID, purchase and subscription status |
| Apple and Google | App stores; process all payments | Governed by their own privacy policies |
Services your device contacts directly
- Scryfall: card images load directly from Scryfall's servers. Your device's IP address and standard request information are visible to Scryfall when it loads an image. We don't send Scryfall any account information.
- TCGplayer and Card Kingdom: when you tap a "Buy" button, the store's website opens with the list of cards you're missing. No account information is included. Anything you do on those sites is governed by their own privacy policies.
Other disclosures
We may disclose information if required by law, to protect the rights, safety or property of our users or others, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information.
5. International transfers
Our providers may process information in the United States and other countries. Where required, we rely on safeguards such as the European Commission's Standard Contractual Clauses to protect information transferred from the EU, UK or Switzerland.
6. How long we keep it
- Account, quiz results, binder, saved decks and uploaded files: for as long as you have an account. When you delete your account, they are deleted from our live systems immediately (and in any case within 30 days). Copies in automated backups are overwritten as backups age out, within 90 days.
- Store link activity: up to 24 months. When you delete your account, these records are disconnected from you and kept only in anonymous form.
- Technical and security logs: no more than 30 days. Our own logs are deleted automatically after 30 days, and our providers keep theirs for 30 days or less.
- Emails you send us: as long as needed to help you, then deleted.
7. Your rights and choices
Depending on where you live, you may have the right to: access the personal information we hold about you; correct it; delete it; receive a copy in a portable format; object to or restrict certain uses; and withdraw consent where we rely on it. You can delete your account at any time (see Delete your account).
To make a request, email [email protected] from the address on your account. We'll verify your request and respond within the time required by law (generally 30 days, or 45 days under US state laws). We won't discriminate against you for exercising your rights.
EU/UK users can also complain to their local data protection authority.
California and other US state residents: in the past 12 months we have collected the categories described in section 2 (identifiers, commercial information such as subscription status, internet activity information and your inferred playstyle archetype) for the purposes in section 3, and disclosed them only to the service providers in section 4. We do not sell or share personal information, and we do not use or disclose sensitive personal information.
8. Children
Deckiverse is not directed to children under 13 (or the minimum age required in your country), and we don't knowingly collect their personal information. If you believe a child has given us personal information, contact us and we'll delete it.
9. Security
We use encryption in transit, access controls that keep each user's data private to them, and reputable providers. No system is perfectly secure, so please use a strong, unique password.
10. Changes to this policy
If we make material changes, we'll update the date above and tell you in the app or by email before they take effect.
11. Contact
[LEGAL NAME OF OWNER OR COMPANY], [MAILING ADDRESS] · [email protected]