Privacy Policy
Last updated: October 2026
This Privacy Policy explains what Mana For Cards ("we", "us", "our"), operated from Cyprus, collects when you use the Service, why, and the rights you have over your own data. It should be read alongside our Terms of Service.
1. What We Collect
| Data | Why |
|---|---|
| Email address, hashed password | To create and secure your account. We never store your password in plain text - it's hashed using PBKDF2 before it ever touches the database. |
| Your collection, decks, and drafts | The actual product - card names, quantities, and the decks/drafts you build from them. |
| Basic usage events (e.g. signup, login, scan completed) | To understand what's actually used, fix what's broken, and improve the product. Never sold, never shared with advertisers. |
| Payment details | Handled entirely by Stripe - we never see or store your full card number. We keep only what Stripe tells us back (subscription status, plan, renewal date). |
| How many requests your account makes each day (kept for 90 days), and which site or link you signed up from | Used to spot and stop abuse and to see which channels bring people in. Not used for anything else. For the signup source we keep only the link's tag or the referring site's name (for example "reddit.com"), never the full address. |
| IP address (temporarily) | Used for rate-limiting and bot protection (Cloudflare Turnstile) to keep the Service secure. Not used to track you across sessions. |
| Card photos, when you use Scan & Add | Processed in memory to identify the card and then discarded - never saved to disk or stored anywhere, on your device or ours. |
2. Third-Party Services
Running the Service means some of your data passes through a small number of specific, necessary providers:
- Stripe - payment processing (if you subscribe to Pro).
- Scryfall - public Magic: The Gathering card data (names, images, rules text). We send card names to look up; we don't send your personal information here.
- AI providers accessed via OpenRouter - only for Pro accounts using AI-assisted scanning as a fallback when a card can't be read automatically. A photo sent this way is used only to identify the card and is not retained by us afterward.
- Cloudflare Turnstile - bot protection on signup.
- Google Analytics - to understand traffic on this marketing site.
- Our email provider - to send you account-related emails (welcome, password reset, security notifications, billing) and a small number of optional emails about using the Service, such as a one-time note when you save your first deck. Every email has an unsubscribe link, and you can also turn optional emails off in More → Settings. Security and billing emails are still sent while your account is open. We don't sell or share your email address, and we don't use third-party marketing lists.
Some of these providers may process data outside the EU/EEA. Where that happens, it's on the basis of their own standard contractual safeguards (each provider listed here publishes its own data-processing terms).
3. Cookies
The app uses a single, essential session cookie to keep you logged in - not for tracking or advertising. It's HttpOnly (inaccessible to page scripts) and marked Secure in production. It needs no consent because the app can't work without it.
This marketing site uses Google Analytics to see which pages are useful, only if you accept in the cookie banner. Until you do, Google Analytics isn't loaded and no analytics cookies are set. If you accept, Google sets its _ga cookies (kept for up to 2 years) and receives your page views, approximate location and device type; see Google's privacy policy. We don't use advertising cookies. Your choice is stored in your browser for 6 months, and you can change it any time with "Cookie settings" at the bottom of every page; withdrawing consent turns analytics off and deletes the _ga cookies.
4. How Long We Keep Your Data
Your account data is kept for as long as your account exists. If you delete your account, your collection, decks, drafts, and personal information are permanently deleted - confirmed directly, not just assumed: deleting an account genuinely removes the underlying data, and we send a real confirmation email once it's done.
5. Your Rights
If you're in the EU/EEA or UK, data protection law gives you the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Delete your data - you can do this yourself anytime from your account settings, or ask us to.
- Export your data in a portable format.
- Object to or restrict certain processing.
To exercise any of these, contact hello@manaforcards.com or use our contact form. We'll respond within a reasonable time, consistent with applicable law.
6. Data Security
Passwords are hashed (never stored in plain text), sessions use secure, HttpOnly cookies, and the Service is served over HTTPS. No system is perfectly secure, but we take reasonable, real technical measures to protect your data rather than treating security as an afterthought.
7. Children's Privacy
The Service is not directed at children under 16. If you believe a child has provided us personal data without appropriate consent, contact us and we'll remove it.
8. Changes to This Policy
We may update this policy as the Service evolves. Material changes will be communicated to active users (for example, by email or an in-app notice) before they take effect.
9. Contact
Questions about this policy or your data: hello@manaforcards.com, or use our contact form.