Privacy Policy

We collect the minimum needed to run your account: your email address, the decks and collection you create, and a record of your subscription. We don't sell your data and we don't run advertising. You can have everything deleted by asking.

• Account information — your email address, and a securely hashed password if you signed up with one.
• Phone number (optional) — only if you choose to add one. It is used for a single purpose: letting another player address a card trade to you by phone number instead of a vault code. It is never displayed to other users, never used to contact you, never used for marketing, and never shared. You can remove it at any time from your account page, and leaving it blank costs you nothing.
• Content you create — decks you generate or save, your card collection, and whether a deck is public or private.
• Subscription information — your plan, billing period, and how many builds you've used. Card numbers are handled entirely by Stripe and never reach our servers.
• Basic technical information — standard server logs such as IP address and browser type, used for security and troubleshooting.
• Anonymous usage statistics — we use Vercel Web Analytics to count page views and see which pages are popular. It does not use cookies, does not follow you across other websites, and does not build a profile of you.

To create and secure your account, generate and store your decks, process payments, send you service email such as sign-in confirmations and receipts, and to find and fix problems. That's the whole list.

Only the service providers needed to operate Grimoire:

• Supabase — database and account authentication
• Vercel — website hosting and anonymous usage statistics
• Stripe — payment processing
• Resend — sending account email
• Anthropic — the AI model that generates deck recommendations

Deck-building requests sent to our AI provider contain your commander choice, deck preferences, and relevant card data. They do not include your email address or payment details. We do not sell or rent your personal information to anyone.

Decks are private by default. If you choose to share a deck, that deck's contents become visible to anyone with the link and may be indexed by search engines. Your email address is never shown on a public deck page. You can make a deck private again at any time from your library, though search engines may take a while to drop the old page.

We use cookies that are necessary for the site to work — chiefly to keep you signed in. Stripe may set cookies during checkout for fraud prevention. We do not use advertising or cross-site tracking cookies.

For as long as your account exists. If you delete your account, your decks and collection are deleted with it. We may retain limited billing records where tax or accounting law requires it.

You can view and edit your information from your account page, and you can ask us to export or permanently delete your data by emailing support@grimoiredecks.com. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA; we honour those requests regardless of location.

Grimoire is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has created an account, email us and we'll remove it.

Data is transmitted over encrypted connections and stored with our hosting providers under their security controls. No online service can promise perfect security, but we take reasonable measures to protect your information.

If we make a significant change to this policy we'll update the date at the top and, for material changes, notify account holders by email.

Questions about privacy: support@grimoiredecks.com