Privacy Policy

What data we collect, how we use it, and your rights.

1. Overview

ScryCheck is a free Commander deck analysis tool. We believe in minimal data collection. This policy describes what information we collect, why, and how it is used. We do not sell your data.

2. Information we collect

Account information

If you create an account, we collect your email address and, if you sign in via Google or Discord, your name and profile picture as provided by that OAuth provider. We store your chosen username, display name, and any optional social links (Moxfield, Archidekt handles) that you add to your profile. This information is used to authenticate you, display your public profile, and send account-related emails.

Deck lists and analysis results

When you submit a deck for analysis, the deck list and computed results (power level, vector scores, combo data, etc.) are stored in our database. Anonymous submissions may appear publicly in the deck directory. If you are signed in, deck analyses are linked to your account and appear on your public profile unless you mark them private.

Session cookies

When you sign in, we set an encrypted session cookie to keep you authenticated. This cookie contains your user ID, username, and role. It does not contain your password (we use passwordless magic links). You can sign out at any time to clear it.

Local storage (“My Decks”)

If you use the “My Decks” feature while signed out, a lightweight record of recently analyzed decks is stored in your browser's localStorage. This data never leaves your device and is not transmitted to our servers.

Contact form submissions

If you submit a message via the contact form, we collect your name, email address, and message content in order to respond to your inquiry. This information is transmitted via Resend and retained only as long as necessary to address your request.

Analytics

We use Google Analytics to understand aggregate usage patterns (pages visited, session duration, general geography). Google Analytics may set cookies on your device. No personally identifiable information is transmitted to us through analytics. You can opt out using the Google Analytics opt-out browser add-on.

3. How we use your information

  • To authenticate you and maintain your session
  • To send account-related transactional emails (magic-link sign-in, welcome email)
  • To display your public profile page at /u/username
  • To provide and display deck analysis results
  • To populate the public deck directory with aggregate community data
  • To respond to contact form inquiries
  • To improve the Service by understanding how it is used (via aggregate analytics)

We do not use your information for advertising, profiling, or sale to third parties.

4. Third-party services

Scryfall

Card data and pricing are fetched from the Scryfall API. Requests to Scryfall are server-side; your IP address is not shared with Scryfall.

Google & Discord (OAuth sign-in)

If you choose to sign in with Google or Discord, those providers share your name, email address, and profile picture with us during authentication. We store this data in your account. We do not receive your Google or Discord password. See Google's Privacy Policy and Discord's Privacy Policy for details on how they handle your data before it reaches us.

Resend

Resend is our email delivery provider. We use it to send magic-link sign-in emails, welcome emails, and contact form replies. Your email address is processed by Resend solely to deliver these messages.

Google Analytics

Aggregate usage data is collected by Google Analytics. See Google's Privacy Policy for details on how they handle this data.

Neon (PostgreSQL)

Deck analyses are stored in a PostgreSQL database hosted by Neon. Data is stored in the United States.

5. Cookies

ScryCheck sets one first-party cookie when you are signed in: an encrypted session token (authjs.session-token) that keeps you authenticated between page loads. It is HTTP-only (not accessible to JavaScript), scoped to scrycheck.com, and expires with your session or when you sign out.

Your theme preference (light/dark) is stored in localStorage, not cookies. Google Analytics may set its own cookies independently.

6. Data retention

Account data (email, username, display name, profile links) is retained for as long as your account exists. Deck analyses linked to your account are retained until you delete them or delete your account. Contact form messages are retained only as long as needed to address your inquiry. Local storage data is retained until cleared by you in your browser settings.

Deck analyses in the public directory that were submitted anonymously (not linked to any account) are retained indefinitely.

7. Your rights

You can update your username, display name, and social links at any time in Profile settings. You can control which decks are public or private from your deck library.

You may request deletion of your account and all associated personal data by contacting us via our contact page. We will process deletion requests within a reasonable time. Note that deck analyses you submitted that are also shared with the public directory may remain visible if they were submitted anonymously or are associated with other users.

You may clear your local “My Decks” browser history at any time from the deck directory page.

8. Contact

Questions about this policy? Please reach out via our contact page.