Who is responsible

The data controller is boplab. For anything about your data, write to the administrator of this service.

What we store and why

• Your account: username, display name, email address, a salted hash of your password and your preferences. Needed to provide the service (GDPR art. 6(1)(b)).
• What you put in: your lists, cards, decks, notes, friendships, cards given to friends and the history of changes. Needed to provide the service.
• Security records: sign-in sessions (for up to 90 days), failed sign-ins, sign-ups and password resets together with the IP address they came from (24 hours). Kept to protect accounts from abuse, our legitimate interest (art. 6(1)(f)).
• Scanner measurements: how long each scan took on your device, without the photo; only the latest 5,000 are kept. Used to keep the scanner working well (legitimate interest). A photo is kept only if an administrator saves it as a test sample.

We do not use analytics or advertising, we do not sell data and we send no marketing email. The only cookie is the one that keeps you signed in; a few display preferences are kept in your browser. Neither needs your consent.

Who else handles it

• Our hosting provider, which runs the server and its backups.
• Scaleway SAS (France), which delivers the emails we send you: confirmation and password-reset links only.

Card data and images come from Scryfall through our server: pages load nothing from Scryfall, and we send it nothing about you. Links to scryfall.com open only when you click them.

How long

As long as you keep your account. When you delete it, its data is erased at once; backups that still contain it are overwritten within 10 days. An account that was never confirmed is deleted after 7 days.

Your rights

You can see and correct your data in the app, download all of it from your profile (“Download my data”) and delete your account from the same page. You can also ask us for access, correction, erasure, restriction or portability, or object to processing based on legitimate interest, by writing to the administrator of this service. You have the right to complain to a data protection authority; in Italy that is the Garante per la protezione dei dati personali.

Age

You must be at least 16 to create an account.