Privacy Policy

Effective date: April 21, 2026 · Last updated: April 21, 2026

This policy explains what data BuildMyDeck collects, why, and how you can control it.

What we collect

Data	Why we collect it	Retention
Username + password hash	Account authentication	Until you delete your account
Card inventory (CSV)	Powers the deck-building engine	Until you delete or replace it
Build history (deck lists, quality scores)	Dashboard history and refinement	Until you delete individual builds
Session cookies	Keep you logged in	Browser session / 30 days
Server logs (IP, timestamp, endpoint)	Debugging and abuse prevention	30 days, then deleted
Payment confirmation (from Stripe)	Crediting token purchases	Duration of account

What we don't collect

Card payment details — handled entirely by Stripe, never transmitted to us
Real name, address, or demographic information
Tracking pixels, advertising identifiers, or cross-site tracking
Any data from minors knowingly — if you believe a minor has registered, contact us

How we use your data

Your data is used exclusively to operate the Service: authenticating your account, running deck builds using your inventory, and showing your build history. We do not sell your data, use it for advertising, or share it with third parties except as described below.

Third-party processors

Stripe — processes payments. See stripe.com/privacy.
Commander Spellbook API — used to detect known combos in your deck. No personal data is sent — only card names from completed builds.
Scryfall API — used to fetch card oracle data. No personal data is sent.

Your rights

Access — you can export your inventory and build history from the dashboard at any time
Correction — update your password via account settings
Deletion — submit a deletion request via our data deletion page and we will delete your account and all associated data within 30 days

Cookies

We use a single session cookie to keep you logged in. No advertising or analytics cookies are used. The cookie is HttpOnly, SameSite=Lax, and Secure in production.

Security

Passwords are hashed with bcrypt. Inventory files are stored in isolated per-user folders. Access tokens are rotated on every login. We use HTTPS in production.

Contact

Privacy questions: privacy@buildmydeck.app