Privacy Policy

A short notice about how personal data is handled on MTG Tracker, a personal app to track your Magic: The Gathering collection and build decks.

Data controller

The data controller is the app operator. For any request write to miistik889@gmail.com.

What I collect

• Email and password: required to create the account and sign in. The password is stored hashed (bcrypt) — nobody, not even me, can read it in clear.
• Username and avatar (optional): shown in your personal area.
• Your collection and decks: everything you enter manually or import via bulk import.
• Uploaded images: profile avatar and deck covers (private storage for uploads, public read via direct URL).
• Technical cookies: see the Cookie Policy.

I do not collect profiling data, do not use third-party analytics, do not share data with advertisers, do not track you across other sites. Only aggregated anonymous statistics (see below).

Usage statistics and performance (Vercel)

To understand which pages are used and how fast the site is I use two integrated tools from Vercel (the platform hosting the site): Vercel Web Analytics and Vercel Speed Insights.

Both were chosen because:

• They don't use cookies or other persistent identifiers.
• They don't collect personal data: no name, email, stored IP address, no persistent fingerprinting.
• Web Analytics collects aggregated data: page URL, country (derived from IP but not stored), browser/OS type, referrer. To count unique daily visitors it uses a hash that changes every day (IP+user agent+secret salt) not attributable to a person.
• Speed Insights collects technical browser performance metrics (Core Web Vitals: LCP, FID, CLS, INP, TTFB) to understand how fast the site is on real devices. They are performance numbers, not identifiers.
• Data stays on Vercel infrastructure and is visible only to me, not shared with third parties.

Being anonymous analytics without cookies or profiling, no consent is required under art. 122 of the Italian Privacy Code. Official Vercel documentation: analytics · speed insights.

Why I collect (legal basis)

• Service execution (art. 6.1.b GDPR): without an account you cannot use the app.
• Security (art. 6.1.f GDPR): protecting accounts and content from unauthorized access.

Where the data is

• Database (Postgres) and Storage (files): hosted on Supabase, EU region (Frankfurt).
• Frontend: hosted on Vercel, with global CDN.
• External APIs: for card data I query Scryfall. Scryfall only receives the name or ID of the card you search, never your personal data.

How long I keep it

As long as you keep the account active. When you delete the account, your email, password, profile, collection, decks, uploaded images are permanently deleted (with cascade deletion). The card price history is shared market data not attributable to you, so it stays.

Your rights

You always have the right to:

• Access your data: everything I have is visible in your personal area after login.
• Edit it: username, avatar, collection, decks are editable directly from the app.
• Delete it: there is a Delete account button on the Profile page. Deletion is immediate and irreversible.
• Export it (portability): write to miistik889@gmail.com and I'll send you a JSON dump of your data within 30 days.
• Object or limit processing, file a complaint: you can contact the Italian Data Protection Authority.

Security

Passwords are stored as bcrypt hashes via Supabase Auth. Database access is protected by Row Level Security: each user sees only their own data. Connections happen over HTTPS.

Changes to this policy

If I change anything significant, I update the date at the top. If they are changes relevant to your rights, I'll notify you by email.

Trademarks

Magic: The Gathering and card names are registered trademarks of Wizards of the Coast LLC. MTG Tracker is an independent app, not affiliated with or sponsored by Wizards of the Coast.