Privacy Policy

Deckodex is operated by the operator of Deckodex, who is the data controller for the personal data described here. You can reach us any time at contact@deckodex.com.

We collect only what we need to run the service:

• Account email - to create and secure your account. You sign in either with your Google account or with a one-time link we email you. Legal basis: performance of a contract.
• Public handle - only if you choose to set one, to power your public trade lists. Legal basis: your choice / contract.
• Your content - decks, collection, owned and wanted cards, notes, and logged game results, to provide the service to you. Legal basis: performance of a contract.
• Subscription data - if you subscribe to Pro: your subscription status, plan, period, and Polar identifiers. We never receive or store your card or payment details - Polar processes payment as Merchant of Record. Legal basis: performance of a contract.
• Product analytics - aggregate usage events and web-vitals performance data via PostHog, without cookies. This includes the text you type into card search, lower-cased and truncated to 64 characters, so we can see which cards and archetypes people look for and where the site fails to find them. No advertising, no cross-site tracking, no profiling of anonymous visitors. Legal basis: our legitimate interest in improving the service.
• Security and logs - standard server and security logs from our hosting and database providers. Legal basis: our legitimate interest in keeping the service safe.

We use only first-party cookies, in two groups. Strictly necessary - keeping you signed in, and remembering a deck you built before signing up so we can attach it to your account. Functional preferences - small settings you control, such as your preferred price source and which game Deckodex opens on. Each stores a single value and nothing else.

We also use the browser's own storage for the same first-party, non-tracking purposes: local storage remembers your chosen price-chart source, and session storage - cleared when you close the tab - remembers a dismissed banner and stops a page from reload-looping after a deploy.

Our analytics runs without cookies or local storage, and we use no advertising and no third-party tracking cookies. Because we store nothing that profiles you or follows you across sites, Deckodex does not need a cookie-consent banner.

We rely on a small set of providers (sub-processors) to run Deckodex:

• Hetzner - application server and database hosting.
• Cloudflare - DNS, content delivery, and card-image storage.
• PostHog - product analytics, hosted in the EU.
• Polar - payment processing as Merchant of Record (Pro subscriptions).
• Resend - transactional email, such as your one-time sign-in links, and the weekly meta report email if you subscribe.

Card prices (from TCGplayer and CardTrader) and tournament data come from public and third-party sources - we do not share your personal data with them.

If you subscribe to the weekly meta report, we store your email address, the date and time you subscribed, the page you subscribed from, and, when available, the IP address the request came from. We keep the time and IP as the record of your consent - we do not use them to profile you.

We only email you the weekly report. Every email carries a one-click unsubscribe link, and you can also turn it off any time under Email in your Deckodex settings. Unsubscribing removes you from all future sends.

We host data in the EU where possible. Where a provider processes data outside the EU, that transfer relies on appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

We keep your data while your account is active. Deleting your account removes your personal data and cancels any active Pro subscription. You can do this yourself from your account settings at any time.

You have the right to access, correct, export, and erase your personal data, to object to processing, and to withdraw consent. You can exercise most of these directly in the app - export your data or delete your account from Settings - or by emailing us at contact@deckodex.com. You may also lodge a complaint with your local data-protection authority.

Deckodex is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will remove it.

We may update this policy from time to time. Material changes are reflected by the “Last updated” date above, and continued use of Deckodex means you accept the current version.

Questions about your data or this policy? contact@deckodex.com