Privacy Policy

• Your collection is private. Decks are private unless you publish them.
• We never see your card number — Stripe handles payments.
• AI features send the relevant parts of your decks, collection, and messages to our AI provider so it can answer.
• We do not sell your personal information, and we do not run third-party advertising.

Account information. Your email address, and a password stored only as a one-way hash (we cannot read it). Optionally a display name, profile picture, public handle, and bio. If you sign in with Google, we receive the account identifier and basic profile details that sign-in returns.

Your Magic data. The cards you add, their quantity, condition, and finish; what you paid and how you acquired a card; your decks, deck contents, tags, and notes; your wish list and any budget you set; buy/sell entries and sealed-product purchases you record; likes, bookmarks, and follows.

AI conversations. Your messages to the deck coach and the assistant, the responses, the deck they relate to, any thumbs up/down you leave, and metering records of how much AI usage an action consumed.

Card scans. When you scan a card, the photo is sent to our AI provider to identify the card. The photo is used for that identification and is not stored in your collection — only the identified card is.

Playtest and community activity. Games you play in the playtest, feedback you post and vote on, and match results you record.

Product analytics. We record in-app events — which screens and features are used, from which surface, and coarse device information such as device type, operating system, and screen size — tied to your account when you are signed in, and otherwise to an anonymous, rotating session identifier. We use hosted web analytics for aggregate page-view statistics.

Billing records. Your plan, your Stripe customer and subscription identifiers, your usage allowance balance, and a log of billing events. Card details live with Stripe, not with us.

TBD — This list is drawn from the application’s data model. It does not separately describe server logs kept by our hosting and database providers (which typically include IP addresses). Whether to enumerate those, and how, is a decision for review.

• To run your account and keep it secure.
• To provide the product: showing your collection, valuing it, generating deck advice, and running the features you ask for.
• To process payments and apply your usage allowance.
• To improve Grimoire — understanding which features are used and where people get stuck, and improving the quality of AI recommendations using aggregated signal from how decks are actually built.
• To send you service messages relating to your account and to alert the operator to sign-ups and billing events.
• To prevent abuse and to comply with the law.

Grimoire’s AI features are powered by Anthropic’s Claude models, reached through the Vercel AI Gateway. To answer a question, we send the model the material it needs: your message, and the relevant context — for example the deck you are working on, cards from your collection, and card data. For the scanner, we send the photo you took.

We do not use your personal collection or conversations to train third-party AI models. Aggregated, non-identifying signal — such as how often a card appears alongside a commander across all users — is used to improve recommendations.

TBD — The AI provider’s own retention of prompts sent through the gateway is governed by that provider’s terms, not by this codebase. The owner should confirm the applicable data-processing terms and state them here rather than have us characterise them.

We do not sell your personal information. We share it with the service providers that make Grimoire work:

• Neon — hosts the database your data is stored in.
• Vercel — hosts and serves the application, stores uploaded profile pictures, and provides aggregate web analytics.
• Stripe — processes payments and subscriptions, and holds your payment details.
• Anthropic, via the Vercel AI Gateway — processes AI requests as described above.
• Resend— delivers internal operational alerts to the operator when someone signs up, subscribes, or cancels. These alerts include the account’s email address and name.
• Google — only if you choose to sign in with it.

We may also disclose information where the law requires it, or to protect the service and its users. If Grimoire is ever transferred to another owner, your data would move with it, subject to this policy.

Separately, we fetch card, price, and tournament data from Scryfall, MTGJSON, and TopDeck.gg. Those requests are made by our servers and do not carry your personal information.

We do not use advertising cookies and we do not allow third parties to track you across other websites from Grimoire. The cookies we do set are these:

• Sign-in session. When you sign in, we set a session cookie holding a signed token that identifies your account on each request. Without it you cannot stay signed in. Signing out clears it.
• Referral attribution (ref). If you arrive through a referral link — a link carrying a ?ref= code — we store that code in a cookie for 30 days, so that the person who referred you is recognised as your referrer if you sign up later in that window. It holds only the referral code. Deleting the cookie in your browser stops the attribution.

We also use Vercel’s hosted web analytics for aggregate page-view statistics, and record our own in-app usage events (section 2), which are tied to your account when you are signed in and otherwise to an anonymous, rotating session identifier.

You can clear or block cookies in your browser settings. Blocking the session cookie will prevent you from signing in.

Publishing is always your choice, and it is reversible:

• Public decks — a deck you mark public is visible to anyone, including signed-out visitors, and can be liked and bookmarked. Set it back to private to withdraw it.
• Your public profile — your handle, name, avatar, and bio appear on your profile page and in people search while your profile is public. Turning your profile private removes it from both.
• Feedback posts you submit are visible to other users.

Your collection is never published, and neither is what you paid for your cards.

• See and edit your account details, handle, bio, and avatar in settings.
• Make your profile private, or change any deck’s visibility, at any time.
• Export your collection and your decks to CSV from within the app.
• Delete individual cards, decks, and AI conversations.
• Manage or cancel your subscription through the billing portal.
• Delete your account yourself, from settings inside the app — described in detail just below.

Deleting your account. Settings has a delete-account control. Deletion is irreversible, so we ask you to confirm it is you: if your account has a password you re-enter it; if you only sign in through a provider such as Google — where there is no password for us to check — you retype your own email address. If a paid subscription is on record, we cancel it with Stripe before deleting the account; if that cancellation fails we still delete the account and tell you, so you can cancel it yourself.

What deletion actually erases. Your account record and everything that hangs off it is deleted in the database: binders, collection entries and their allocations, shelves, decks and their contents, insights, tags, version history, primers and recommendations, wish list, transactions, sealed purchases, AI threads and messages and feedback, recommendation and ranking events, playtest sparring events, product-analytics events, likes, bookmarks, follows, feedback posts and votes, referrals, sign-in records and sessions, password-reset tokens, and any pending email verification token tied to your address.

What survives, de-identified. We do not claim total erasure, because it would not be true. Four kinds of record are kept with the link to you removed rather than deleted: AI usage metering, billing events, the usage-allowance ledger, and match results you hosted. These are financial and aggregate-usage records we retain for accounting and for measuring the product overall; after deletion they no longer identify you.

Records held by our processors follow their own systems: Stripe retains its payment and subscription records under its own terms, and deleting your Grimoire account does not by itself erase them.

TBD — No statutory-rights section (for example GDPR or CCPA rights, a legal basis table, a data-protection contact, or international-transfer mechanisms) is included, because whether those regimes apply depends on where Grimoire operates and who its users are — neither of which the repository establishes. This needs legal review before publication.

In general we keep your data for as long as your account exists, because your collection and decks are the product.

TBD — No retention or deletion schedule is implemented anywhere in the codebase — nothing expires or is purged on a timer. Stating a specific period here would be a claim the system does not honour. The owner must decide the policy, and ideally implement it, before this section can say anything concrete.

Access is per-account: routes are authentication-gated and every query is scoped to the signed-in user. Passwords are stored as bcrypt hashes, password-reset tokens are stored hashed and are single-use, and traffic is served over HTTPS. No system is perfectly secure, so please use a strong, unique password.

TBD — Grimoire sets no minimum age, and this is the same open question as in the Terms. An age floor must be chosen before publication, since children’s-privacy obligations and app-store age ratings both depend on it.

We will update this page when our practices change, and update the date below. Material changes will be communicated before they take effect.

Questions, or a request about your data: social@grimoirestudy.com.

TBD — This is the general contact address used elsewhere in the product. If a dedicated privacy contact or a postal address is required, the owner must supply it.