What We Collect
When you create an account: your name and email address. When you place an order: your shipping name and address. If you sign in with a wallet: your public Ethereum wallet address. We do not collect payment card details — those are handled directly by Stripe.
Information We Collect Automatically
When you visit the site, our servers automatically record standard log information sent by your browser, such as your IP address, browser type and version, the pages you view, and the date and time of your visit. We use this strictly to operate and protect the site — for example, to keep you signed in, prevent fraud and abuse, apply rate limits, and diagnose technical problems. We do not build advertising profiles from it.
How We Use It
We use your information to fulfill orders, send order confirmations and shipping updates, and respond to support requests. We do not use your information for advertising or sell it to third parties.
Tools Data
Our free tools keep what you put into them, so they work the next time you come back.
Your collection. When you are signed in, the cards you add are saved to your account: each card's name, printing, finish, condition, language and quantity, the folder you put it in, the date you added it, and what you paid for it, if you choose to type that in. We also keep the cards you ask us to watch. Your collection is private to you: we use it to show you its value and to work out which cards a deck is missing, and we do not show it to anyone else.
Your decks. A deck you save is kept on your account with its name, format, cards, primer and any versions you save. A deck is private until you choose otherwise. If you make it unlisted, anyone with its link can see it; if you make it public, anyone can, it is listed in Browse Decks, and it may be featured on our home page. Anyone who can see a deck can like it or copy it into their own account. A public or unlisted deck page shows the deck itself; it does not show your name, your email address or your wallet address. We record which decks you like, so you can unlike them.
Life counter rooms. A room keeps the display names players type in, the life totals and counters, and a random token for each phone that joins, so the phones stay in step. No account is needed. Rooms are deleted once they have sat idle for 48 hours.
You can delete a deck, or remove cards from your collection, at any time yourself. To have everything deleted, email us at the address below.
Third-Party Services
Stripe — payment processing. Your card details go directly to Stripe and are never stored by us. Stripe is PCI-DSS compliant.
Shippo — shipping labels and tracking. Your shipping name and address are shared to generate a label and track delivery.
Resend — transactional email. Your email address is passed to Resend solely to deliver order-related emails.
Printful — print-on-demand production. If you order merchandise, your shipping name and address are passed to Printful so they can produce and ship that item to you.
Sentry — error monitoring. When something breaks, technical diagnostic data is sent to Sentry, which can include your IP address and the page you were on. It is used only to find and fix faults.
Backblaze B2 — encrypted offsite backup. Our database backups, which contain order records, are encrypted before they leave our server and stored with Backblaze.
Free Market Protocol — decentralized identity and record layer. If you create an Auth-Key account, your wallet address is recorded on the protocol. When an order is recorded, what is written on-chain is limited to wallet addresses, the amount and currency, an order reference, and a cryptographic hash of the order — a one-way fingerprint. Your name, email address, and shipping address are never written on-chain, and a guest order records no buyer identity at all. On-chain records are inherently public and permanent by design.
Data Security
Card payments are handled entirely by Stripe and never touch our servers. If you sign in with email, we generate a custodial wallet for you whose private key is encrypted at rest with AES-256. We restrict access to personal data to what is needed to operate the store. No system is perfectly secure, but we take reasonable measures to protect your information.
Data Retention
We keep order and payment records for seven years to meet tax and accounting obligations. Account details are kept while your account is open, and web/security logs for about 90 days. You may request deletion of your account data at any time by emailing us; we will delete what we are not legally required to keep. On-chain records cannot be deleted by their nature — see the Free Market Protocol note above for the narrow set of data that reaches them.
Cookies
We use a session cookie to keep you signed in and to maintain your shopping cart. We do not use tracking or advertising cookies.
Children's Privacy
This site is intended for adults. We do not knowingly collect personal information from children under 13. If you are between 13 and 18, you may use the site only with the involvement of a parent or guardian. If we learn that we have collected information from a child under 13, we will delete it. Parents who believe their child has provided us information may contact us at the address below.
Your Privacy Rights
Member rewards. Our rewards programme is tied to your account and your purchase history, so taking part means we associate orders with you in order to work out what you have earned. Rewards have no cash value and you are free not to take part; declining does not change the price you pay or the service you receive.
You may request a copy of the personal data we hold about you, or ask us to correct or delete it, by contacting us at the address below. We'll respond within 30 days.
California residents (CCPA/CPRA) — you have the right to know what personal information we collect, to request a copy of it, to request its deletion, to correct it, and to not be discriminated against for exercising these rights. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We honour a Global Privacy Control signal where your browser sends one. To make a request, email us and we will verify and respond as required by law.
Changes to This Policy
We may update this policy from time to time. The current version will always be posted at this URL with the date above. Continued use of the site after changes constitutes acceptance.
Contact
[email protected]
We typically respond within one business day.