Privacy Policy

MTGF is a hobby project run from the Netherlands by Wessel van der Vlugt and Julian van der Pol in our spare time. Even so, we take your data seriously. This page tells you, in plain language, what personal data we collect through mtgf.net, why and on what legal basis we process it, how long we keep it, who can see it, and the rights you have under the General Data Protection Regulation ("GDPR") and the Dutch Uitvoeringswet AVG. It describes how the service works today; where a feature handles your data in a way you might not expect (activity tracking, share links, multiplayer playtests, AI assistants) we say so.

"We" in this policy means Wessel van der Vlugt and Julian van der Pol acting jointly as the data controllers for personal data collected through the service. Because MTGF is not operated by a legal entity, there is no formal office address or commercial register entry; you can reach the controllers at info@mtgf.net. MTGF is too small to require the appointment of a data protection officer under Art. 37 GDPR.

What we store depends on what you do. Browsing without an account stores very little about you (see "Visitors without an account" below).

• Account: your name, your email address and, depending on how you sign up, either a password (stored only as a salted scrypt hash) or your Google account ID, profile picture address and the sign-in tokens Google returns (we ask Google for your email address, profile and OpenID identity). We also keep whether your email is verified, your role (user, or owner for the maintainers; the owner role only lifts rate limits and gives no access to other people's data in the app) and when the account was created and updated.
• Sessions: each sign-in session has a random token, a creation and an expiry time, and the IP address (an IPv6 address is reduced to its /64 network prefix) and browser user agent seen when you signed in.
• Links and one-time codes: short-lived records for password-reset and account-deletion links and for the steps of Google and AI-assistant sign-in.
• Collection: the printings you own, how many copies and how many of them are foil, and when you added or changed them. Text you paste into an import is processed when you submit it and is not stored.
• Decks: names, descriptions, formats, cover images, cards with their boards and positions, and a version history: a snapshot of the deck's name, description, format and cards each time it changes. Share links you create are stored with their token, role (view or edit), label, expiry and whether they were revoked.
• Playtests: for every seat you play, the name of the deck you brought, the mode, status and times, and the full log of your game actions (draws, moves, life changes, tokens, counters and so on). For an AI-controlled seat we also keep the assistant's name from its connection details; other players only see a brand label such as "Claude" or "AI".
• Activity events: recorded for a signed-in account unless you switch activity recording off (section 10), and for a visitor without an account only after they turn on personalisation (see below). Each event has the card, the time and, where relevant, the place it came from:
  • views of a card and how long it stays on screen (from one second, paused while the browser tab is hidden and capped at two minutes);
  • opening a card from Discover, search results, your collection, shared decks and collections, similar cards, the deck editor, the scanner or the search bar's suggestions;
  • scrolling past a Discover card in under a second (counted as a dismissal), or dismissing one through an AI assistant;
  • searches on the search page, in the deck editor and in your collection that return results, recorded once per new query with the colour, type, rarity and format filters set at that moment and the first ten results (keyword and AI searches alike; a query typed in several steps can produce several records);
  • collection adds (with how: scan, search, card page, collection, import, manual or AI assistant), quantity changes and removals;
  • deck adds (with where: search, suggestions, similar cards, the search bar, card page, manual entry or AI assistant), quantity changes, moves between boards, removals, imports and copies of shared decks, each with the deck ID and the board;
  • the Discover impression log: which Discover cards were shown to you, in which position, from which candidate pool they came, and the score and the numbers the ranking used for each, plus the time.
  Reordering cards, changing printings and playtest actions are not recorded as activity events. An AI assistant working in your account creates the same events, and a card changed through an edit link is recorded under the deck owner's account.
• Discover model inputs: computed on each Discover request from your activity events and your current collection and decks, and not stored. The model and its learned ranking weights are shared across all users and contain no personal data.
• Images you upload: avatars and deck covers are converted to WebP, which drops embedded metadata such as EXIF, and stored in object storage. They are served to anyone who has the file's web address, with a one-year public cache header, so copies can stay in browsers and caches after a file is deleted. Avatar addresses contain your account ID.
• Card scanning: your camera video stays on your device. The scanner sends single still frames from the camera view, and a few cropped photos of the card you tap together with the tap position, to our server, which finds and identifies cards in memory and returns the result. They are not stored or logged.
• AI search: the text you type is spell-corrected and interpreted on our servers and sent to Voyage AI (section 7). Cached copies are described in section 9.
• Technical data: your IP address is used to rate-limit requests and is held only in the server's memory for the length of the limit window, about a minute (for most limits an IPv6 address is first reduced to its /64 network prefix, which identifies a network rather than a device); it is also stored in your session record, with IPv6 reduced the same way. Your browser's user agent is stored in your session record and in client error reports. When something breaks in your browser, a report with the error code and message, a truncated stack trace, the page address exactly as your browser shows it (which can contain a share-link token), your user agent and, if you are signed in, your account ID is written to our server logs. Unhandled server errors are logged with a request ID, the requested path (without query string and with token-like segments redacted) and a stack trace, and the web framework also prints the full request address, including any query string, when an error is unhandled.
• Connected AI assistants: for each assistant app that connects, its registered name, logo and redirect addresses and any other details it supplies when it registers, which are stored whether or not anyone signs in with it; and, for your account, the access and refresh tokens we issue to it, their expiry times and the scopes it requested, and a record that you allowed that assistant, with the scopes and when, so it can reconnect without asking again.
• Support correspondence: the content of emails you send us and any diagnostic information (request IDs, paths) you include.

Visitors without an account. No visitor ID exists and nothing about your activity is recorded until you turn on "Personalise Discover on this device", either in the prompt on the Discover page or under "Privacy choices" in the footer. After that, MTGF generates a random visitor ID, keeps it in your browser's local storage, and tags the activity events above, including search text, and the Discover cards shown to you with it. The ID is sent with each request for the Discover feed so that the feed can personalise its picks and avoid repeating cards shown to you in the last 7 days. If you sign in on that browser, the events recorded under the ID are moved to your account (or deleted, if you have switched activity recording off for the account) and the ID is removed from the browser. Turning personalisation off removes the ID from your browser; events already recorded under it expire after 90 days, and we cannot tell who a visitor ID belongs to. Without personalisation, Discover shows general picks.

We do not knowingly collect health data, political opinions, religious beliefs, sexual orientation, or other special categories of personal data under Art. 9 GDPR.

Nothing you create is public by default: there are no public profiles and other users cannot browse your decks or collection. Others see your data only through links and live tables you start:

• Share links: anyone who has a deck link can open it, signed in or not, and sees the deck, its cards and description and your display name (the data behind the page also contains your profile picture's address); a signed-in visitor can copy the deck into their own account, and anyone with the link can export the deck and print a proxy sheet of it. Anyone who has a collection link sees every card in your collection with quantities, foil counts, prices and the total estimated value, your list of decks, and what is in each deck, and can copy and export those decks. Anyone who has an edit link can add, remove, move and reorder the cards in that deck without an account (not rename, delete or reshare it) and appears to other editors as "Guest". Links you create in the browser expire after one day unless you choose 15 minutes, 1 hour, 1 week or never; links an AI assistant creates for you never expire unless it picks another expiry. Shared pages are marked noindex, blocked in robots.txt and left out of our sitemap, but anyone can pass a link on, and a link that has just expired or been revoked can keep working for up to a minute while shared pages are cached.
• Live deck editing: the owner of a deck appears to the other people editing it with their display name and profile picture; people editing through an edit link appear as "Guest 1", "Guest 2" and so on, without a picture, even when signed in. Cursor positions, selected cards and cards being dragged are shared live with everyone editing.
• Playtest tables: a 1v1 invite is a link that works for one day and only for signed-in users. Before taking a seat, the invited person sees each seated player's display name and picture and a summary of the deck they brought (name, description, format, cover, size and colours), with a link to it if that player already has an active view link for the deck or for their collection. At the table, the other player sees your display name, profile picture, deck name and the public part of your board: battlefield, graveyard, exile, command zone, your library in draw order, counters, life total and turn. Your hand is shared only as a card count and face-down cards stay hidden. MTGF does not enforce game rules, so the other player, or an AI assistant at the table, can also move cards on your board. A finished match stays in the other player's playtest history with your display name and a preview of your last board, until you delete the session or your account.
• Your account ID: the web address of your avatar, the deck data a link holder can fetch and the messages at a playtest table contain your internal account ID, so the people you share with or play against can see it. Your email address is never part of what they receive.
• AI assistants you connect: an assistant acts as you and can read everything in your account except your credentials, including your email address and a full data export (see the Terms). What it reads is handled by the assistant's provider under its own privacy policy.

• Running your account and the features you use (Art. 6(1)(b) GDPR, performance of a contract): creating and authenticating your account, storing your collection, decks, share links and playtests, card search, AI search, deck suggestions, card scanning, connecting AI assistants, and sending transactional emails: email verification, email change, password reset, a notice after a password change, account deletion confirmation, a notice after deletion, and a notice to the address of an existing account when someone tries to sign up with it. We send no marketing email.
• Personalising Discover for signed-in accounts and keeping the service safe and working (Art. 6(1)(f), legitimate interests): the activity events and the Discover impression log that tailor the feed while you are signed in, IP-based rate limits, IP address and user agent in sessions to protect accounts, and error logs to diagnose bugs. Our interest is a useful and stable product. We have balanced this against your rights: events and impressions are deleted after 90 days, they are not shared with third parties or used for advertising (an AI assistant you connect can read them, section 4), and you can export or erase them. You can switch activity recording off at any time in Settings → Preferences → Privacy, which stops the recording and deletes what was recorded, and you can object in other ways (section 10).
• Personalising Discover while signed out (your consent, Art. 6(1)(a) GDPR and Art. 11.7a of the Dutch Telecommunications Act): the visitor ID in your browser's local storage, and the activity events and impressions recorded under it, exist only after you turn on "Personalise Discover on this device". You can withdraw consent at any time under "Privacy choices" in the footer, which removes the ID from your browser; events already recorded under it expire after 90 days.
• Legal obligation (Art. 6(1)(c)): responding to lawful requests from authorities and retaining data where the law requires.

The permission screen shown before an AI assistant connects is how you ask us to connect it, which falls under performance of a contract above.

The Discover feed is ranked by a model trained on public decklists. It turns your collection, your decks and your recent activity into a taste vector, retrieves cards close to that vector and cards similar to ones you looked at recently, and ranks them with weights learned from how all users respond to Discover. The ranking includes deliberate exploration, so some picks are popular or random rather than matched to you. Cards you own and cards shown to you in the last 7 days are skipped. When recording is off, Discover shows general picks. This is personalisation, not automated decision-making that has legal or similarly significant effects on you within the meaning of Art. 22 GDPR, and you can ignore or dismiss any card. AI search reads and ranks with models that run on our own servers (only the numeric form of your query comes from Voyage AI, section 7), and similar cards and deck suggestions run entirely on our own servers. These models keep no profile of you, but the searches you run and the similar cards you open are recorded as activity events (section 3) and also feed Discover.

These recipients act for us as processors under Art. 28 GDPR:

• Hosting and infrastructure: the server provider that hosts our application, our PostgreSQL and ClickHouse databases and our object storage.
• Email: an SMTP provider receives your email address, your name and the content of each email in section 5, including its one-time link.
• AI search: Voyage AI receives the text of your AI search, spell-corrected by us unless you ask for the exact text, from our server. Nothing else is sent: no account ID, IP address, deck or collection data. Not every AI search needs it. What Voyage AI does with the text is governed by its own terms.

These parties handle data for their own purposes, not on our behalf:

• Google: if you sign in with Google, Google runs the sign-in and tells us your name, email address and profile picture. Google profile pictures are loaded straight from Google's image servers by browsers, including those of people who are shown your picture because you share or play with them, so Google sees their IP address and browser details.
• Scryfall: card images are loaded by your browser straight from Scryfall's image servers, on the landing page and wherever cards are shown, so Scryfall sees your IP address and browser details. We send Scryfall nothing about you. Card data itself is loaded into our database from Scryfall's bulk data, which involves no personal data.
• Stores: links to Cardmarket and Card Kingdom on card pages only lead there if you click them.

Your browser contacts no other third parties while you use MTGF: fonts and icons are served from mtgf.net, and there are no third-party scripts, analytics or advertising. We do not sell personal data, and we do not share it for third-party advertising. We update this page when the list changes.

Where a recipient is based outside the European Economic Area (Google for sign-in, Voyage AI for AI search), transfers rely on the European Commission's Standard Contractual Clauses (2021/914) and, where applicable, on an adequacy decision. We perform a transfer impact assessment at the level appropriate to a hobby project and prefer EU-hosted alternatives where possible. You can ask for a copy of the transfer safeguards by emailing info@mtgf.net.

• Account and profile: kept while your account exists; deleted when you delete your account (section 10).
• Sessions: a session stops working 7 days after it was last renewed (it renews at most once a day while you use the site). Its record, including the IP address and user agent, is deleted when you sign out, when you change or reset your password (which signs out your other devices), when you delete your account, and by a daily cleanup once the session has expired.
• Email links: valid for 1 hour (email verification, email change, password reset) or 24 hours (account deletion). Password-reset, account-deletion and sign-in-step records are deleted when used, and expired ones are cleared the next time any of those steps is processed; verification and email-change links are signed and not stored at all.
• Collection, decks, share links and playtests: kept until you delete your account. When you delete a deck, remove a collection entry or revoke a link, it disappears from your account and stops working, but its record is only marked as deleted or revoked and stays in our database until you delete your account; revoking a link clears its label and expiry. Deleting a playtest session erases its action log at once and reduces the session record to a deleted marker. A deck's uploaded cover image is the exception: it is deleted from storage with the deck.
• Deck version history: kept until you delete your account, including names and descriptions in older versions. There is no automatic pruning and no setting for it.
• Activity events and the Discover impression log: deleted automatically 90 days after they are recorded, when you delete your account, or when you switch activity recording off in Settings, whichever comes first. The database removes expired rows during background maintenance, so removal can lag slightly. Events and impressions recorded under a visitor ID follow the same 90 days.
• Uploaded images: an avatar is deleted when you upload a new one, and a cover when it is replaced or its deck is deleted; if storage cannot be reached at that moment, the old file stays until you delete your account. All remaining files are deleted when you delete your account.
• Connected AI assistants: an access token stops working one hour after it was issued, and each token record is deleted by a daily cleanup about a week after it was issued (assistants renew their tokens, which creates new records), and all of them, with the records of which assistants you allowed, are deleted when you delete your account. Changing your password or signing out does not remove them. An assistant app's registration (name, logo, redirect addresses) holds no data about you and is not deleted automatically, except that one registered from your signed-in session is deleted with your account. We can also revoke an assistant earlier at your request.
• Caches: to stay fast, our servers keep short-lived copies of results: the interpreted form of an AI search, including your corrected search text, and the numeric form of it for up to 7 days; AI search results and rankings for up to 24 hours; deck suggestions for up to an hour; card search results for up to an hour; card-viewing-time reference statistics (for all users together) for an hour; lists of your own decks and collection for a few minutes; Discover's shared ranking weights for a minute; shared deck and collection pages for a minute. By default these live only in the server's memory and disappear on restart; if the operator configures a shared cache, they are stored in Redis or in our PostgreSQL database instead and expire on the same schedule.
• Server logs: the application writes the error logs described in section 3 and keeps no access log of its own. It sets no retention period for them. The web server in front of the application may keep standard access logs (IP address, time, requested address, status code and user agent); their retention is configured on the server, outside the application, and we use them only for security and troubleshooting. Logs can mention your account ID, for example when you delete your account; Discover feed requests no longer carry an ID in their address.
• Support emails: kept for up to 24 months so we can follow up on related issues.
• Backups: server-level backups, if any are taken, sit outside the application; deleted data can remain in them until they are overwritten.

Under the GDPR you have the right to:

• Access (Art. 15) and portability (Art. 20):Settings has a one-click export as a JSON file. It contains your account record, linked sign-in providers, your 500 most recent sessions (with IP address and user agent), decks, deck cards, the history of each deck (name, summary, type and time of each version, not the card lists), collection, share links with their tokens (keep the file private), playtest sessions and action logs, activity events and the Discover impression log (the cards shown to you in the last 90 days, with their position and the pool they came from). It leaves out decks, collection entries and playtest sessions you have already deleted, with their cards and logs, but still includes the history of deleted decks and revoked share links. It also leaves out your password hash and tokens, uploaded image files, anything recorded under a visitor ID, and logs. If a section is too large (for example more than 100,000 activity events or impressions), the export is refused with an error and you can email us for a manual export.
• Rectification (Art. 16): change your avatar in Settings, and your email address (confirmed through a link sent to the new address) and your password, both with your current password; an account that only signs in with Google can first set a password through a link we email it. To change your display name, email us.
• Erasure (Art. 17): Settings has a delete-account button. We email you a confirmation link, valid for 24 hours, that you must open while signed in. Opening it deletes your collection, decks and their versions, share links, playtest sessions and logs, activity events and Discover impression log tied to your account, uploaded avatar and cover files, and your account record, sessions, linked sign-in providers and connected-assistant grants. We then email you a confirmation. If removing your files or data fails, the deletion stops with an error and the link stays valid, so you can open it again; part of your data may already be gone at that point, and opening the link again continues the deletion. Not removed by deleting your account: data recorded under a visitor ID (it expires after 90 days and we cannot tie it to you), cached copies (they expire as described in section 9), unused password-reset link records (they expire after an hour), logs, backups, emails already delivered, and decks other people copied from your share links.
• Restriction (Art. 18): ask us to restrict processing while a dispute is resolved.
• Objection (Art. 21): object to processing based on legitimate interests, including the Discover personalisation and the activity events. In Settings → Preferences → Privacy you can switch off "Activity-based personalisation": this stops all activity recording, deletes the activity events and the Discover impression log already recorded for your account, and makes Discover show general picks instead of personalised ones. You can also email us to object.
• Lodge a complaint: with your local data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens.

Requests can be made from Settings or by emailing info@mtgf.net. We respond within one month as required by Art. 12(3) GDPR and extend that period by up to two months only where strictly necessary, telling you why. To protect your data we may need to verify your identity first, typically by asking you to send the request from the email address registered on the account.

MTGF sets no advertising, analytics or cross-site tracking cookies, loads no third-party scripts, and does not fingerprint your browser. This is everything it stores on your device:

• Sign-in session cookie (better-auth.session_token, with a __Secure- prefix on mtgf.net): keeps you signed in. HttpOnly, SameSite=Lax; lasts up to 7 days and is renewed while you use the site. Set only after you sign in.
• CSRF cookie (__Host-csrf): protects actions that change data. HttpOnly, SameSite=Strict; deleted when you close the browser. Set on your first page load of each browser session.
• Preference cookies (mtgf-currency, mtgf-deck-printings): remember your currency and deck card art choices. They last one year and contain no identifier.
• Temporary sign-in cookies (better-auth.state, with the same __Secure- prefix as the session cookie, 5 minutes, during Google sign-in; oidc_login_prompt and oidc_consent_prompt, 10 minutes each, while you connect an AI assistant).
• Local storage: nuxt-color-mode (your theme), scan-torch-on (whether the scanner turns the torch on), mtgf_tracking (your Discover personalisation choice on this device, on or off) and mtgf_anon_id (the visitor ID from section 3; it exists only after you turn on personalisation, and is removed when you turn it off or sign in).
• Session storage: nuxt:reload, a marker the app writes for ten seconds when it reloads itself after an error, so that it does not reload in a loop.

Storage for sign-in, security and your preferences, including the key that remembers your personalisation choice, is functional, so it does not require consent under Art. 11.7a of the Dutch Telecommunications Act. The visitor ID is set only with your consent, is not used for advertising and is shared with no one.

MTGF is for people aged 16 and over, and the service is not aimed at children. We do not ask your age and have no way to collect a parent's consent. If we learn that we hold an account of someone under 16, we will delete it. Parents or guardians who believe their child has created an account can email us at info@mtgf.net.

We apply appropriate technical and organisational measures as required by Art. 32 GDPR, including: passwords stored only as salted scrypt hashes; traffic served over HTTPS with an HSTS header; HttpOnly, SameSite session cookies; CSRF tokens on state-changing requests, with origin checks on sign-in and live connections and bearer tokens for AI assistants; a strict Content-Security-Policy without third-party scripts; per-action rate limiting; random 128-bit share and invite tokens; re-encoding of every uploaded image; and weekly automated dependency update pull requests. No system is perfectly secure; if we discover a personal data breach affecting you we will notify the Autoriteit Persoonsgegevens within 72 hours where required by Art. 33 GDPR and inform affected users without undue delay where there is a high risk to their rights under Art. 34.

We may update this policy as the service evolves. Material changes will be reflected in the "Last updated" date above and, where practical, announced by email to the address on your account. Continuing to use the service after a change means you have read the updated policy.

Privacy questions, GDPR requests, and breach reports: info@mtgf.net.