Privacy Policy

Deckodex is operated by the operator of Deckodex, who is the data controller for the personal data described here. You can reach us any time at contact@deckodex.com.

We collect only what we need to run the service:

• Account email — via Supabase Auth, to create and secure your account. Legal basis: performance of a contract.
• Public handle — only if you choose to set one, to power your public trade lists. Legal basis: your choice / contract.
• Your content — decks, collection, owned and wanted cards, notes, and logged game results, to provide the service to you. Legal basis: performance of a contract.
• Subscription data — if you subscribe to Pro: your subscription status, plan, period, and Polar identifiers. We never receive or store your card or payment details — Polar processes payment as Merchant of Record. Legal basis: performance of a contract.
• Product analytics — aggregate usage events and web-vitals performance data via PostHog, without cookies. No advertising, no cross-site tracking, no profiling of anonymous visitors. Legal basis: our legitimate interest in improving the service.
• Security and logs — standard server and security logs from our hosting and database providers. Legal basis: our legitimate interest in keeping the service safe.

We use only strictly-necessary cookies to keep you signed in (Supabase session cookies). Our analytics runs without cookies or local storage, and we use no advertising or third-party tracking cookies. Because nothing non-essential is stored on your device, Deckodex does not need a cookie-consent banner.

We rely on a small set of providers (sub-processors) to run Deckodex:

• Supabase — authentication, database, and image storage.
• Vercel — application hosting and content delivery.
• PostHog — product analytics, hosted in the EU.
• Polar — payment processing as Merchant of Record (Pro subscriptions).

Card prices (from TCGplayer and CardTrader) and tournament data come from public and third-party sources — we do not share your personal data with them.

We host data in the EU where possible. Where a provider processes data outside the EU, that transfer relies on appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

We keep your data while your account is active. Deleting your account removes your personal data and cancels any active Pro subscription. You can do this yourself from your account settings at any time.

You have the right to access, correct, export, and erase your personal data, to object to processing, and to withdraw consent. You can exercise most of these directly in the app — export your data or delete your account from Settings — or by emailing us at contact@deckodex.com. You may also lodge a complaint with your local data-protection authority.

Deckodex is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will remove it.

We may update this policy from time to time. Material changes are reflected by the “Last updated” date above, and continued use of Deckodex means you accept the current version.

Questions about your data or this policy? contact@deckodex.com