Privacy

You can use the whole simulator — opening packs, building binders, decks, and banlists — without an account. If you choose to create one, we collect only what the account itself needs:

• Your email address — the only thing that identifies your account. We use it to sign you in (we send a one-time link — there are no passwords) and to send you essential account emails.
• Your account record — a small database row marking that your account exists, whether your email is confirmed, and when it was created and last updated.
• Sign-in session data — while you are signed in we keep a session so you don't have to log in on every page. This includes a session identifier and technical details your browser sends with the request (your IP address and browser user-agent), used only to keep the session secure and to let you sign out.
• Sign-in link tokens — when you request a sign-in link we store a short-lived, single-use token. It is kept hashed, never in plain form, and only proves that you control the email address.
• Anti-abuse counters — to stop the sign-in system being abused to send mail to people, we store a one-way hash of your email address (SHA-256 — never the address itself) alongside a request counter.
• Email delivery data — our email provider processes your address and the delivery status in order to actually send your sign-in and account emails.

Our lawful bases (GDPR Art. 6) are simple: most of this is necessary to provide the account service you asked for (Art. 6(1)(b)), and the security and anti-abuse pieces rest on our legitimate interest in keeping the service safe (Art. 6(1)(f)).

What we deliberately don't collect: no name, no username, no date of birth, no address, no phone number, no payment details, and no passwords at all — sign-in is passwordless. We run no advertising, no cross-site tracking, and build no profiles about you.

If you are not signed in, we set no cookies at all.

When you sign in, we set a single strictly-necessary session cookie (__Secure-better-auth.session_token) so you stay logged in. It is HttpOnly, Secure, and SameSite=Lax. We use no tracking or advertising cookies. Because the session cookie is essential to a feature you asked for, no consent banner is required for it.

We don't sell your data and we don't share it for advertising. We rely on two service providers (“processors”) to run the site:

• Cloudflare — hosts the site, runs the account backend and its database (located in the EU), stores card images (img.bxxwlvnd.org), provides the cookieless analytics above, and provides the anti-abuse challenge (“Turnstile”) shown on the sign-in form, which receives your IP address to check that you are a real person. See Cloudflare's privacy policy.
• Brevo — an EU email provider that delivers your sign-in links and account notifications. See Brevo's privacy policy.

We keep your account and its email address for as long as your account exists. Everything else is short-lived by design:

• Sign-in links expire soon after they are sent and can be used only once.
• A signed-in session ends automatically after a period, and immediately when you sign out.
• If you request an account but never confirm your email, that unconfirmed account is removed automatically after a short time.
• The anti-abuse email hashes are discarded automatically after a short window.

When you delete your account we erase it immediately; any residual copies held in routine database backups age out shortly afterwards.

Under the GDPR you have the right to access your data, to correct it, to erase it, to port it, and to restrict or object to how we use it. Because we hold so little, most of these are quick to honour.

The fastest way to erase everything is the Delete account button on your account page — it deletes your account and all associated data straight away. For anything else, email [email protected] and we will respond within one month.

If you think we have handled your data improperly, you have the right to complain to your data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens.