Privacy Policy

Last updated: February 9, 2026

Who We Are

Decklist is a trading card game (TCG) collection manager and deck building application. We help you search cards, build format-validated decks, and manage your collection. This privacy policy explains how we collect, use, and protect your personal data.

Data We Collect

When you use Decklist, we may collect the following information:

  • Account information: Email address, username (optional), and a securely hashed password. We never store passwords in plain text.
  • OAuth provider data: If you sign in with Google, we receive your name, email address, and profile photo from Google.
  • Collection data: Information about which cards you own and their quantities.
  • Deck data: Decks you create, including card selections, deck names, and format choices.
  • Session data: IP address and user agent string, used for session management and security.

Legal Basis for Processing

We process your personal data on the following legal bases:

  • Contract: Processing necessary to provide our service when you create an account (account data, collection data, deck data).
  • Legitimate interest: Session management and security monitoring to keep your account safe.
  • Consent: For advertising cookies used by Google AdSense to serve and measure display ads to non-premium users.

Cookies

We use the following cookies:

  • session_id: A signed, httpOnly cookie with SameSite=Lax. Used for authentication. Expires when your session expires (after 2 weeks of inactivity). This cookie is essential and cannot be disabled.
  • cookie_consent: A localStorage key (not technically a cookie) that stores your consent preference. Essential for remembering your choice.
  • Advertising cookies: For non-premium users, Google AdSense may set cookies to serve and measure display ads. These are subject to your consent via our cookie banner. If you decline, ads are shown but are non-personalized. Premium users are not shown ads and no advertising cookies are set.

Sentry, our error monitoring service, may set cookies for error tracking purposes.

For more details, see our Cookie Policy.

Third-Party Services

We use the following third-party services:

  • Google AdSense: For non-premium users, we display ads through Google AdSense. Google may collect data such as cookies, device identifiers, and browsing behavior to serve and measure ads. You can control advertising cookies via our cookie consent banner. For more information, see Google's Privacy Policy. Premium users are not shown ads and no ad-related data is collected for them.
  • TCGPlayer: Card prices link to TCGPlayer, where we may earn a commission on purchases. When you click an affiliate link, you leave Decklist and are subject to TCGPlayer's privacy policy.
  • Brevo: We use Brevo to send transactional emails such as password reset messages.
  • Sentry: We use Sentry for error monitoring to help us identify and fix issues with the service.
  • Google OAuth: If you choose to sign in with Google, your authentication is handled through Google's OAuth service.
  • DigitalOcean: Our application is hosted on DigitalOcean infrastructure.

Data Retention

  • Account data: Kept until you request deletion of your account.
  • Sessions: Expire after 2 weeks of inactivity and are automatically cleaned up.
  • Error logs: Retained per Sentry's data retention policy.

Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

  • Right to access: You can request a copy of the personal data we hold about you.
  • Right to rectification: You can request that we correct any inaccurate personal data.
  • Right to erasure: You can request that we delete your personal data and account.
  • Right to restrict processing: You can request that we limit how we use your data.
  • Right to data portability: You can request your data in a machine-readable format.
  • Right to object: You can object to the processing of your personal data.

To exercise any of these rights, please contact us through our Contact page.

Data Deletion

You can request complete deletion of your account and all associated data by contacting us at the email address listed on our Contact page. Upon receiving a valid deletion request, we will permanently delete your account, sessions, collection data, and deck data.

Children

Decklist is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us so we can take appropriate action.

Changes to This Policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of Decklist after changes constitutes acceptance of the updated policy.

Contact

For privacy-related inquiries or to exercise your data rights, please visit our Contact page.