Privacy policy.

Account info. When you sign up we store your email address, an optional display name and username, and, if you signed up with a password, a one-way hash of that password.

Session metadata. To keep your account secure, each active session records an IP address and user-agent string. This is used to expire stale sessions and surface suspicious activity. Nothing more.

Your content. Decks, categories, and the cards inside them. If you set a deck to "public" its contents are visible to anyone with the link; private decks are visible only to you.

Product analytics. We use Vercel Analytics and Vercel Speed Insights to measure page views and performance. These tools do not use third-party cookies and do not track you across sites. They record the URL you visited, rough device/browser info, and timing data, but not your identity.

No advertising identifiers. No cross-site trackers. No payment info (Maindeck is free). No precise geolocation. No biometric data. We do not sell, rent, or trade personal information.

To run the product: authenticate you, save the decks you build, deliver verification and account emails, and keep the site fast and reliable. That's the whole list. We do not build advertising profiles and we do not share your content with anyone outside the service providers listed below.

We rely on a small number of vendors to operate Maindeck. Each one only sees the data it needs to do its job:

• Vercel for hosting, edge caching, analytics, and performance measurement.
• Resend for sending transactional email (sign-up verification, password resets).
• Railway for hosting the PostgreSQL database that stores your account and deck data.
• Scryfall for public card data and images. Requests for card info are made from our servers; your account identity is never shared with Scryfall.

Your account and deck data is stored in AWS us-east-1 (Virginia) via Railway. The Maindeck web app itself is served from Vercel's global edge network, with compute functions defaulting to US regions. Transactional email is delivered through Resend from US infrastructure.

If you access Maindeck from outside the United States, your data will be stored in the US to operate the service.

We set a small number of first-party cookies that are strictly necessary for the site to work: a session cookie so you stay signed in, and a theme preference cookie so light/dark mode persists. No third-party advertising cookies are used.

You can request account deletion or a copy of your data at any time by emailing support@maindeck.xyz from the address tied to your account. We verify requests against the email on file to prevent account takeovers.

• Deletion. Your profile, sessions, decks, and all associated content are removed from our primary database within 30 days of confirming the request, and rotated out of encrypted backups within 90 days total.
• Export.We'll send you a JSON archive of your account and decks, typically within 7 days.
• Correction. Most profile fields (email, username, display name) can be updated directly from your account settings.

Account and deck data is retained for as long as your account is active. Session records are retained until they expire (typically 30 days) or you sign out. Analytics data is retained per Vercel's default retention windows.

Maindeck is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe we have collected information from a child under 13, please contact us and we will delete it.

We'll update the "last updated" date at the top of this page whenever this policy changes. For material changes we'll also notify you in-app or by email before they take effect.

Questions about this policy or how your data is handled? Email support@maindeck.xyz.