Privacy Policy

Last updated: August 31, 2026

Who We Are

Decklist is a trading card game (TCG) collection manager and deck building application. We help you search cards, build format-validated decks, and manage your collection. This privacy policy explains how we collect, use, and protect your personal data.

Data We Collect

When you use Decklist, we may collect the following information:

  • Account information: Email address, username (optional), and a securely hashed password. We never store passwords in plain text.
  • OAuth provider data: If you sign in with Google, we receive your name, email address, and profile photo from Google.
  • Collection data: Information about which cards you own and their quantities.
  • Deck data: Decks you create, including card selections, deck names, format choices, and the last time you opened each deck's builder. The builder-open timestamp supports aggregate seven-day return measurement and is never sent to Umami.
  • Session data: IP address and user agent string, used for session management and security.
  • Optional aggregate analytics: If you choose “Accept all,” a sanitized page category, browser and device category, approximate country, and privacy-filtered product events. We remove query strings, route/content identifiers, page titles, referrers, and dedicated user identities before delivery, and we do not use analytics cookies.

Legal Basis for Processing

We process your personal data on the following legal bases:

  • Contract: Processing necessary to provide our service when you create an account (account data, collection data, deck data).
  • Legitimate interest: Session management, security, and error monitoring used to operate and protect the service.
  • Consent: For optional cookieless product analytics and advertising cookies used by Google AdSense to serve and measure display ads to non-premium users.

Cookies

We use the following cookies:

  • session_id: A signed, httpOnly cookie with SameSite=Lax. Used for authentication. Expires when your session expires (after 2 weeks of inactivity). This cookie is essential and cannot be disabled.
  • cookie_consent: A localStorage key (not technically a cookie) that stores your optional analytics and advertising consent preference. Essential for remembering your choice.
  • Advertising cookies: For non-premium users, Google AdSense may set cookies to serve and measure display ads. These are subject to your consent via our cookie banner. If you decline, ads are shown but are non-personalized. Premium users are not shown ads and no advertising cookies are set.

Our self-hosted Umami analytics and GlitchTip error monitoring do not set tracking cookies. Umami loads only after you choose “Accept all”; GlitchTip remains active as an operational security and reliability service.

For more details, see our Cookie Policy.

Third-Party Services

We use the following third-party services:

  • Google AdSense: For non-premium users, we display ads through Google AdSense. Google may collect data such as cookies, device identifiers, and browsing behavior to serve and measure ads. You can control advertising cookies via our cookie consent banner. For more information, see Google's Privacy Policy. Premium users are not shown ads and no ad-related data is collected for them.
  • TCGplayer: Card price links take you to TCGplayer. Decklist is not a TCGplayer affiliate and does not earn commissions from these links. When you follow a product link, you leave Decklist and are subject to TCGplayer's privacy policy.
  • Brevo: We use Brevo to send transactional emails such as password reset messages.
  • GlitchTip: We self-host GlitchTip on DigitalOcean for error monitoring, application logs, and sampled performance traces. Request parameters and default personally identifiable information are disabled.
  • Umami: With your consent, we self-host Umami on DigitalOcean for cookieless aggregate analytics. Before delivery, Decklist replaces the URL and title with a generic controller/action category, removes referrers and identity payloads, and restricts custom event data so email addresses, usernames, card or deck names, search text, imported lists, and content identifiers are not sent. Choose “Essential only” to keep Umami disabled.
  • Google OAuth: If you choose to sign in with Google, your authentication is handled through Google's OAuth service.
  • DigitalOcean: Our application is hosted on DigitalOcean infrastructure.

Data Retention

  • Account data: Kept until you request deletion of your account.
  • Sessions: Expire after 2 weeks of inactivity and are automatically cleaned up.
  • Error and application logs: Normally retained for up to 30 days in our self-hosted GlitchTip instance.
  • Performance traces: Normally retained for up to 14 days in GlitchTip.
  • Aggregate analytics: Retained while useful for understanding long-term service usage; it is not linked to a Decklist account.

Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

  • Right to access: You can request a copy of the personal data we hold about you.
  • Right to rectification: You can request that we correct any inaccurate personal data.
  • Right to erasure: You can request that we delete your personal data and account.
  • Right to restrict processing: You can request that we limit how we use your data.
  • Right to data portability: You can request your data in a machine-readable format.
  • Right to object: You can object to the processing of your personal data.

To exercise any of these rights, please contact us through our Contact page.

Data Deletion

You can request complete deletion of your account and all associated data by contacting us at the email address listed on our Contact page. Upon receiving a valid deletion request, we will permanently delete your account, sessions, collection data, and deck data.

Children

Decklist is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us so we can take appropriate action.

Changes to This Policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued use of Decklist after changes constitutes acceptance of the updated policy.

Contact

For privacy-related inquiries or to exercise your data rights, please visit our Contact page.