Privacy Policy

Last updated: July 2026

DeckPlanet ("DeckPlanet," "we," "us," or "our") built this Privacy Policy to explain, in plain terms, what information we collect when you use our website and services (the "Service"), why we collect it, and what you can do about it.

1. Information We Collect

We collect the following categories of information:

  • Account information. When you create an account, we collect your email address, username, and password. Your password is hashed by our backend content management system (Directus) and is never stored in plain text.
  • Profile information. If you choose to add them, your first name, last name, location, avatar image, and email notification preferences.
  • Avatar and media uploads. Images you upload, such as a profile avatar, are stored with our cloud storage provider, Linode Object Storage. Uploaded files currently use a public read setting, which means the direct URL to an uploaded file is accessible to anyone who has the link, even if your profile itself is private.
  • Patreon account link (optional). If you choose to connect a Patreon account, we store your Patreon user ID so we can verify your membership or premium status. We never receive your Patreon password or payment details.
  • Deck and collection data. Decks, card collections, want lists, and other content you create while using the Service.
  • Usage data. Aggregate, non identifying analytics about how the Service is used. See "Cookies and Analytics" below for details.

2. How We Use Your Information

We use the information above to:

  • Create and maintain your account and authenticate you, through NextAuth, backed by Directus.
  • Provide the Service's core features, such as deck building, collection tracking, and card search.
  • Send transactional emails, such as summaries of comments on your decks, through our email delivery provider, Resend.
  • Verify your Patreon membership status for premium features, if you have linked a Patreon account.
  • Understand how the Service is used, in aggregate, so we can improve it.

3. Legal Basis for Processing

Where the EU or UK GDPR applies, we process your personal data on the following legal bases: performance of a contract, to provide the Service you signed up for, such as your account and deck data; consent, for optional features such as analytics cookies (discussed below) and linking a Patreon account; and legitimate interests, such as keeping the Service secure and reliable.

4. Third-Party Service Providers

We rely on a small number of third-party providers to operate the Service. Each one processes a limited set of data on our behalf:

  • Directus. Our content management system and database. It stores account and application data.
  • Linode Object Storage. An S3-compatible storage provider, hosted in the us-southeast-1 region, that stores uploaded media such as avatars.
  • Patreon. Used for optional OAuth account linking and membership verification.
  • Resend. Sends transactional emails to your registered email address.
  • Google Analytics. Used for aggregate usage analytics only. See "Cookies and Analytics" below.
  • Meilisearch. Powers search over trading card and deck data. It does not index or store any personal data about you.

We do not sell your personal information, and we do not share it with third parties for their own advertising purposes.

5. Cookies and Analytics

We use Google Analytics (gtag.js) strictly for aggregate usage metrics, for example, monthly active users and click-through rates on features. This analytics configuration does not use Google Signals, remarketing, or advertising features, and we do not use it to sell or share your data with third parties for advertising purposes.

Google Analytics only loads after you give consent through our cookie consent banner.

6. International Data Transfers

Draft placeholder, needs legal confirmation: Our infrastructure providers (Linode, Google, Patreon, and Resend) operate primarily in the United States. Where we transfer personal data of users located in the EEA, UK, or Switzerland to the United States, we intend to rely on an appropriate legal transfer mechanism, such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. The specific mechanism relied on for each provider still needs to be confirmed and finalized by legal counsel before this policy is final.

7. Data Retention

We keep your account and content data for as long as your account stays active. If you delete your account, we will delete or anonymize your personal information within a reasonable period, except where we are required to retain certain data for legal, security, or fraud-prevention purposes.

8. Your Rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. You can exercise most of these rights directly from your account settings, where you can request account deletion and export your data. If there is a request you cannot complete yourself, please contact us using the details below.

9. Children's Privacy

DeckPlanet is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. During sign-up, users must confirm that they meet our minimum age requirement. If you believe a child has given us personal information, please contact us so we can look into it and take appropriate action.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above, and for material changes, we will provide additional notice where appropriate.

11. Contact Us

If you have questions about this Privacy Policy, or you would like to exercise your privacy rights, please contact us at deckplanet@gmail.com.