Privacy Policy

• Local-first Without a community account, all of your data stays on your device. An account is entirely optional.
• No tracking No analytics, no advertising cookies, no behavioural tracking of any kind.
• GDPR compliant Fully compliant with EU data protection law (GDPR / DSGVO).
• No data sales We never sell, rent or share your personal data with third parties.
• Full data control Export everything, or delete your account and all server-side data, whenever you want.
• Open and transparent This page says exactly what is collected and why — with or without an account.

1. What data we collect

Without a community account (local only)

If you use Decksmith without registering, no data leaves your device. Everything is stored locally:

• Your Magic: The Gathering card collection
• Deck lists you create
• User preferences (currency, display settings)

With a community account (server-side)

Creating a community account is voluntary. When you do, the following data is stored on our server:

• Email address — required for registration and login
• Username — publicly visible to other community members
• Password — stored as a bcrypt hash; your plaintext password is never stored
• Avatar image — optional profile picture you upload
• Device identifier and device name — to support multi-device login
• Authentication token — stored securely in the iOS Keychain on your device
• Account metadata — creation date, last login date, email verification status
• Follower and following relationships — which community members you follow
• Shared decks — deck name, description, format and card list, if you choose to share them
• Card collection — visible to users you follow and who follow you

Data we never collect

• Real name or postal address
• Usage analytics or behavioural tracking data
• Payment information (the app is free)

2. How we use your data

All data is used exclusively to provide the app's functionality. We do not use your data for advertising and we do not sell it to third parties.

• Card collection and deck building — to display, organise and manage your cards and decks locally on your device
• Price tracking — to fetch current market prices from Scryfall
• Authentication — your email and password hash verify your identity when logging in to a community account
• Community features — your username, avatar, shared decks and card collection are made available to community members you follow or who follow you
• Multi-device support — device identifier and name manage active login sessions across your devices
• Preferences — currency and language settings sync to your account so they persist across devices

Legal basis: processing is based on Art. 6(1)(b) GDPR — necessary for the performance of the service you requested. Where community features involve optional sharing of your data with other users, the legal basis is Art. 6(1)(a) GDPR (your consent, given by voluntarily creating an account and choosing to share content).

3. Third-party services

Decksmith community server

Community account data (email, username, avatar, shared decks, follower relationships) is stored on our own server at app.decksmith.community. This server is operated by Waldemar Schneider and is located in the EU. No community data is shared with third-party cloud providers beyond the hosting infrastructure.

Scryfall API

Decksmith uses the Scryfall API to search for cards, download card images and data, and fetch current prices. When you search for cards, requests are sent directly to Scryfall. Please review Scryfall's privacy policy for details.

Apple App Store

Decksmith is distributed via Apple's App Store. Apple may collect crash reports and usage data as outlined in Apple's privacy policy.

4. Data storage and security

On your device

• Local database — card collection, decks and preferences are stored using Apple's SwiftData framework in the app's sandboxed storage
• Keychain — your authentication token is stored in the iOS Keychain, which is encrypted and inaccessible to other apps
• Backups — local app data is included in your device's iCloud or iTunes backups, which you control

On our server (community accounts only)

• Database — account data is stored in a MySQL database on our server at app.decksmith.community
• Passwords — hashed using bcrypt before storage; we cannot recover your plaintext password
• Transport security — all communication between the app and our server uses HTTPS/TLS encryption
• Avatar images — uploaded avatars are stored as files on our server and served via a public URL

5. Your rights under GDPR

Under the General Data Protection Regulation you have the following rights:

• Right to access — you can view your local data directly in the app. For community account data held on our server, contact us at info@decksmith.community to request a copy
• Right to rectification — you can update your username, avatar and currency preference directly in the app's account settings
• Right to erasure — local data is deleted when you uninstall the app. You can delete your community account and all associated server-side data from Settings inside the app, or by contacting us at info@decksmith.community
• Right to data portability — you can export your collection, decks and lists to a single file from Settings inside the app at any time
• Right to withdraw consent — you may withdraw consent to community features at any time by deleting your account. This does not affect the lawfulness of processing prior to withdrawal
• Right to lodge a complaint — you may complain to a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. The competent authority for Germany/Bavaria is Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany — poststelle@lda.bayern.de

To exercise any rights relating to server-side data, contact us at info@decksmith.community. We will respond within 30 days.

6. Children's privacy

The community features of Decksmith require account registration, which involves processing an email address. Under GDPR, users under 16 require parental or guardian consent to create an account. If you become aware that a child under 16 has registered without consent, please contact us at info@decksmith.community and we will delete the account promptly. Users who do not create a community account can use the app without any age restriction, as no personal data is collected.

7. Changes to this privacy policy

We may update this policy from time to time to reflect changes in our practices or for legal reasons. When we do:

• The "last updated" date at the top will be revised
• We will notify you through the app, via App Store update notes, or on this website
• Continued use of the app constitutes acceptance of the changes

8. Data controller

The person responsible for data processing within the meaning of Art. 4(7) GDPR is:

Waldemar Schneider
Hammstr. 19
80935 München
Germany
info@decksmith.community

9. Contact us

If you have questions about this privacy policy or Decksmith's privacy practices, email info@decksmith.community.