Impressum & privacy
Impressum
Angaben gemäß § 5 DDG
Contact: [email protected]
A private, non-commercial fan project by locomoco. Card names, images and game mechanics belong to Wizards of the Coast.
Privacy / Datenschutz
Without an account, everything you enter (owned cards, decks you play, printings, settings) is stored only in your own browser (local storage). It never reaches this server.
With an account, the server stores your username, your card counts, printings,
the decks you marked as played with your lists, the date you last signed in, and a login cookie
(dioc_session, technically necessary, valid 30 days; the server keeps only a hash of it). With a password it also stores a salted hash of it
(never the password itself) and your email address. The email is only used for the
confirmation link and password-reset links you ask for; those mails go out through the
operator's mailbox at Hetzner ([email protected]). Feedback you send through the box on the What's new page is
stored with the contact you add (optional) and, when you are logged in, your username; only the operator reads it
and deletes it once it is dealt with. No newsletters, no ads, no third-party trackers. This site keeps no access
logs. Account data is backed up nightly; backups are kept for up to 30 days.
Visitor counts. To see which pages are used, the site counts page views per page and day, and a few actions (such as importing a collection or making a share image), each only as "with" or "without an account". To count how many different people visit on a day, the server combines your IP address and browser name with a random key that exists only in memory for that day and is then thrown away; only the daily total is stored, never your IP address or anything that recognises you on another day. No cookies and nothing in your browser's storage are used for this (Art. 6(1)(f) GDPR, our interest in knowing which parts of the site are used).
Signing in with a passkey uses Pocket ID at auth.dennha.de, run by the same
operator on the same server. Pocket ID stores your username, name, email address and your
passkey's public key (never a secret). For security it records sign-ins (time, IP address,
browser) and deletes those records after 90 days; its server logs, which also contain IP
addresses, are rotated automatically. A short cookie (dioc_oidc, 10 minutes)
protects the sign-in step. This site itself only keeps the link to your Pocket ID account,
not your email address.
Signing in with Discord sends you to discord.com to approve the sign-in. This site only asks for your Discord user id and username (the "identify" permission: no email, no servers, no messages) and keeps just the id, to recognise you next time. Discord processes the sign-in under its own privacy policy.
Third parties your browser talks to when you use the site: Cloudflare (delivers the site) and Scryfall (card images, prices, card search and printings). They see your IP address as part of the request, under their own privacy policies. Fonts and mana symbols come from this site itself.
Your rights: you can ask for a copy of your data, have it corrected, or have your account and everything in it deleted: you can delete it yourself on the Account page, or write to [email protected]. A deleted account disappears from the nightly backups within 30 days. You can also download all of it yourself with “Download my data” on the Account page.