1. Who we are
DeckMaster is operated by DeckMaster ("we"). Privacy contact and Data Protection Officer (LGPD "encarregado"): DeckMaster support team ([email protected]). All privacy requests go to that address.
2. What we collect, why, and on what basis
| Data | Why | Legal basis (GDPR / LGPD) |
|---|---|---|
| Email, handle, display name, birth month, country (from the edge, at sign-up), language and currency | Create and secure your account, show the right language and prices, apply age rules | Contract; legal obligation (age rules) |
| One-time sign-in codes, passkeys (public key only), sessions, hashed IP and browser string | Sign in, keep the account safe, stop abuse | Contract; legitimate interests (security) |
| Your collection, wants, decks, shares, friends, trades, price alerts | Provide the service | Contract |
| Card photos you scan (kept 24 hours), scan results | Recognise cards | Contract |
| Guardian email, consent records and evidence | Prove a parent or guardian approved a minor's account | Legal obligation; consent (guardian) |
| Subscription and payment records (Stripe customer id, invoices; never card numbers) | Billing, tax | Contract; legal obligation |
| Support messages and reports | Answer you, keep users safe | Legitimate interests |
| Server logs with IP addresses | Run and secure the site | Legitimate interests |
| Aggregate counts without identity | Understand load | Legitimate interests |
We use no advertising, no profiling for ads, no analytics trackers and no third-party cookies. We do not sell or share personal information (CCPA/CPRA definitions) and we do not use automated decisions with legal effects.
3. Who receives it (processors)
Cloudflare (network edge), Backblaze (file storage and encrypted backups), Resend (email), Anthropic (card photo recognition: image only, metadata removed, no account identity), Stripe (payments), our hosting provider. Details and transfer mechanisms: Processor list. TCGdex is a public card-data source we read from; we send it no personal data. We disclose data to authorities only when the law requires.
4. International transfers
Several processors are in the United States or operate globally. Where personal data leaves your region we rely on the transfer mechanisms our processors offer (EU-US Data Privacy Framework certification and/or Standard Contractual Clauses; for Brazilian data, ANPD standard clauses). Ask [email protected] for details.
5. How long we keep it
See the Retention table. In short: sign-in codes 24 hours, scan photos 24 hours, security events 30 days, server logs 30 days, account data until you delete the account (then a 7-day grace period), tax records 5 years. Backups: deleted data can remain in encrypted backups for up to about 6 months; we do not restore it into the live service (we re-apply deletions after any restore).
6. Your rights
Access and export (Account > Export), correction, deletion (Account > Delete), restriction and objection, withdrawing consent, portability, complaint to your authority (EU: your national authority; Brazil: ANPD; California: Attorney General). Deadlines we meet: GDPR one month, LGPD 15 days, CCPA/CPRA 45 days. Write to [email protected]. California: we do not sell or share personal information, so there is no opt-out to exercise; we honour Global Privacy Control anyway. Parents and guardians have additional rights, see the Children's notice.
7. Security
Encryption in transit, hashed tokens, private storage, access limited to the operator, audit log of administrative access. No system is perfectly secure. If a breach affects you we notify you and the authorities within legal deadlines.
8. Cookies
Only strictly necessary cookies and local storage (session, language, theme). See the Cookie notice. No banner is needed for these.
9. Card data, names and images
Card names, images and prices come from TCGdex (catalog) and public price feeds. Pokemon and card images belong to their owners; DeckMaster is not affiliated with Nintendo, The Pokemon Company, Creatures or GAME FREAK. Takedown contact: [email protected].
10. Changes
We version this policy and tell you about material changes before they apply. Previous versions are available on request at [email protected].