Privacy Policy
Effective date 2026-10-12
The builder, optimizer, Deck Doctor, and collection all work with no account, and visitors who never sign in get no persistent server-side profile from them. Signing in (via Clerk) is needed for the dashboard, saving decks, match history and Arena matches, desktop sync, the AI consultant, or a paid plan; your collection also syncs to the account when you are signed in, on top of staying in your browser. Signing in creates a server-side row for your email, plan, Stripe customer and subscription IDs, AI usage counts, saved decks, your collection, match history, and desktop sync tokens — see "Collection data", "Deck builds", "AI consultant" and "Payments" below for exactly what each covers. There are no tracking cookies and no third-party analytics scripts on this site (page views and anonymous usage events such as "a deck was built" are counted by a self-hosted, cookieless Umami instance that stores no IP addresses or personal identifiers; events never contain your email, name, account ID, deck lists or anything you type), and no data is sold or shared with advertisers.
Collection data
If you import a ManaBox or Arena collection CSV on the Collection page, it is parsed and stored in your browser's localStorage; this works with no account. When you build a deck from it, the list of owned card names is sent with that one request so the engine can restrict the pool. If you are signed in, your collection is also saved to your account so it follows you between browsers; clearing your browser data only removes the local copy, and deleting your account (or contacting us) removes the server copy. Signed out, clearing your browser data removes the collection completely.
Deck builds
Commander name, cards you list as owned, and build preferences are sent to the build service to generate a deck. The build (commander, format, and the preferences used) is logged against your account id if you are signed in; when signed out, it is linked only to a one-way hashed key derived from your network address, not to an account or any other personal identity. If a deck is saved to the public catalogue it appears without any identifying information about who requested it.
Best deck
Best deck needs a free account. The collection list, buy budget, your plan tier, and a commander name if you gave one are sent to the build service for that run; a running or finished job is kept in the build service's memory for up to 60 minutes, then discarded — it does not persist beyond that window, even if you never reload the page. The site itself stores one row per run — your account id, the job id, its status, and when it started — with no separate retention limit, to enforce your plan's daily limit and to credit back a run that failed.
AI consultant
The consultant chat is available only when signed in. When you use it, your message, the deck list and its statistics are sent to Anthropic (Claude), or to OpenAI as a fallback once your plan's Claude allowance is used, once the site-wide monthly Claude budget is reached, or if the Claude call fails, under each provider's API terms. The site stores the model name and token counts for each request against your account, not the text of the conversation. Deck building itself does not use Anthropic, OpenAI, or any other language model.
Payments
Pro and Commander plan payments are handled by Stripe; card details are entered directly on Stripe's checkout and never touch our servers. Starting checkout sends your account email to Stripe so it can create or match your customer record. The site stores only your Stripe customer ID, subscription ID, and plan name — not card details or billing history.
Server logs and rate limiting
Like most web services, requests are logged briefly at the server level, and the IP address of an incoming request is used to apply rate limits on the build and feedback endpoints so the site stays usable for everyone. These logs are not used for tracking or advertising and are not retained for analytics purposes.
Feedback and contact
Messages sent through the feedback widget or contact form are stored in the site database, hosted on Neon Postgres, and forwarded to the developer. An email address is only stored if you provide one, and is only used to reply to you — it is never added to a mailing list or shared with a third party.
Your rights
Signed-out collection data never leaves your browser, so there is nothing to request or delete on the server for it. If you are signed in, you can delete your account data — including the server-side copy of your collection, saved decks, and usage counts — by contacting us through the contact form. The same applies to an email address left on a feedback or contact submission: you can request deletion at any time, and the request will be honored.
Children's privacy
This site is not directed at children and does not knowingly collect information from anyone under the age required to consent to data processing in their jurisdiction.
Future changes
Limited, non-intrusive advertising may be added later to support hosting costs. This policy will be updated first if that changes how data is collected, and the effective date at the top of this page will move forward when it does.