Privacy Policy

Who we are

ElderDecks is operated by McKee Realty NYC Inc., based in New York, NY, United States. In this policy, "we," "us," and "our" refer to that company. We are responsible for the personal information we process to operate ElderDecks. Contact elderdeckssuport@gmail.com for privacy questions or requests. This policy covers elderdecks.com and its account, collection, deck, article, and playtesting services; third-party websites have their own policies.

Information we process

• Account information: email address, display name, password hash, account identifier, verification status, and account preferences. Passwords are hashed for storage, not stored as readable passwords.
• Your workspace: decks, card quantities and printings, categories, collection and storage-location records, wishlists, deck allocations, imports, and content you submit. Do not enter a home address or sensitive personal information in storage labels or deck descriptions.
• Community and play activity: public deck information, likes and view records, article submissions, multiplayer names, room membership, game activity, and shared board state. View counting uses a hashed account or browser identifier to reduce repeat counts.
• Technical information: IP address, browser/device information, requested URLs, timestamps, session identifiers, errors, and security-related logs may be processed by our servers and hosting providers when you use the service.
• Communications and optional assistance: messages you send support and, when AI features are available and used, your prompts, responses, relevant deck/collection context, and usage records.

We collect information you provide directly, information generated while using the service, and card/catalog data from external sources. External catalog data generally describe cards rather than users. Required account fields are needed to create and secure an account; you can browse public content without creating one.

How and why we use information

We use information to authenticate accounts, verify email addresses, save and retrieve your workspace, import and identify cards, display prices, operate multiplayer games, provide requested assistance, respond to support, troubleshoot faults, prevent abuse, and comply with legal obligations. We also display and measure advertising and attribute affiliate referrals where those services are enabled.

Where applicable privacy law requires a legal basis, we rely on performing our agreement with you for requested account features; legitimate interests in service security, reliability, support, and abuse prevention where those interests do not override your rights; legal obligations where required; and consent for activities that require it, including applicable nonessential cookies and personalized advertising. Accepting our Terms is not consent to advertising cookies.

Card recommendations, simulated opponents, and automatic categories are assistance features. They do not make decisions with legal or similarly significant effects about you.

Public content and sharing

Public decks, published articles, and associated display names may be viewed, indexed, copied, and shared by others. An unlisted link is not a password: anyone who receives it may be able to open the content. Private account content is not intentionally published merely because you save it, but authorized service processing and disclosures described below still apply.

Joining a multiplayer room shares your display name and the game information necessary for other participants to play, including visible cards, counters, life, and activity. Public lobby information may appear in the room directory. Sharing a room invitation or deck link can broaden its audience. Changing visibility or deleting content cannot recall copies others have already made.

Camera, microphone, and local storage

The card scanner requests camera permission when you use it. Its current image recognition processes camera frames and selected images in your browser; catalog matching requests and saved card records still go to our service. Optional scanner diagnostic photos are held in a bounded browser-session history and can be exported by you. They are not automatically uploaded to support. If you choose to send an export, its images and diagnostics become part of your support request.

Optional multiplayer voice requests microphone permission. Audio is sent using WebRTC to other participants, directly or through a relay depending on connectivity. Network connection information is exchanged to establish calls, and a direct connection can expose your public IP address to peers. ElderDecks does not provide server-side voice recording, but cannot prevent another participant from recording. You can mute, leave voice, or revoke microphone permission.

Browser storage keeps preferences, playtest sessions, tutorial progress, scanner state, and other local settings. Some preferences are also saved to your account. Clearing site storage removes local copies and may sign you out; it does not delete records already saved on our servers.

Cookies, Google ads, and affiliate links

We use cookies and similar storage for authentication and session security, and browser storage for the features described above. Our pages also include the Google AdSense script. Loading that script contacts Google even when no visible ad is served; information such as your IP address, browser details, and page context can be transmitted.

Where advertising is served, third-party vendors, including Google and its partners, may use cookies or similar identifiers to select and measure ads based on visits to this and other sites. Google advertising cookies can enable personalized advertising based on those visits. Other participating advertising vendors may also use their own cookies. Availability and personalization depend on the region, applicable requirements, and your settings.

You can manage Google personalized ads through My Ad Center, learn about Google's use of information from partner sites, and use participating industry opt-outs at YourAdChoices. These options do not necessarily stop all ads, all storage, or every provider's processing. Browser cookie controls and tracking protections provide additional choices.

Where a consent or privacy-choice message is provided, use its controls to accept, reject, or revisit your choices. We must obtain consent where required; continued browsing or agreement to the Terms is not a substitute. Contact elderdeckssuport@gmail.com with an opt-out request or if a necessary privacy control is unavailable. Browser "Do Not Track" is not a universal opt-out mechanism; legally recognized signals, such as Global Privacy Control where applicable, are distinct and must be addressed by the relevant advertising configuration.

When you follow a retailer or affiliate link, the destination and tracking provider may receive referral information, card/product identifiers, browser and network information, and may set cookies under their own policies. We may receive attribution or commission reports. We do not send your account password to retailers. A purchase is made with the retailer, not ElderDecks.

Providers and other disclosures

• Hosting and storage: Vercel hosts the application; the configured PostgreSQL/Supabase infrastructure stores application records. These providers process information needed to run and protect the service.
• Email: Resend processes recipient addresses and email content for account verification and service messages.
• AI, when used: configured OpenAI services receive your submitted prompts and bounded relevant context needed for the requested feature. Do not submit confidential or sensitive information that is unnecessary for that request. Provider processing and retention are governed by the applicable service terms and configuration.
• Card data and images: sources include MTGJSON, Scryfall, EDHREC, and retailer feeds. A browser loading an external card image or visiting a provider link can disclose network and request information to that provider.
• Ads, referrals, and communications: Google and applicable advertising/affiliate partners process the information described above. Voice connectivity can use STUN/TURN services, including a configured relay provider.

We may disclose information when reasonably necessary to meet legal requirements, respond to valid legal process, protect people or rights, investigate abuse, or arrange a business transfer subject to appropriate protections. We do not sell account passwords or private collection lists. Advertising-related disclosures can nevertheless qualify as a "sale," "sharing," or targeted advertising under some laws, even when no money is exchanged for the information.

Retention and deletion

Saved account, deck, collection, and associated records generally remain until removed through the service or a deletion request is fulfilled, subject to necessary legal, security, fraud-prevention, dispute, and backup retention. We consider the purpose, account relationship, security needs, and legal obligations when determining retention; there is not a single fixed deletion period for all data.

Verification links expire after 24 hours. Multiplayer rooms currently expire for access after 24 hours; closing a room removes its active room record, while expired records are cleaned up during room creation. Expiration does not promise that every log or backup copy is erased at that instant. Local preferences and saved playtests can remain until you clear them. Hosting, advertising, email, and other providers may retain their own records under their policies.

Deletion may not remove information we must lawfully keep, de-identified information, or copies independently retained by other users. We will explain relevant limitations when responding to a request.

Your choices and privacy rights

You can change supported profile settings, manage saved content and visibility, export supported deck/collection formats, and control browser permissions. To request access, correction, a copy, account deletion, restriction, objection, or withdrawal of consent, email elderdeckssuport@gmail.com with the subject "Privacy request." Identify your account and request, but do not send your password. We may need proportionate verification before providing or deleting account data.

Depending on where you live and whether a law applies to our business, you may also have rights to opt out of sale/sharing or targeted advertising, limit certain sensitive-data uses, use an authorized agent, appeal a denied request, and receive equal service without unlawful discrimination. State the relevant request or appeal in your email. We will respond within the period required by applicable law and explain a denial and available next steps.

EEA, UK, and other eligible users may complain to their local data protection authority. Withdrawing consent does not affect processing already lawfully carried out. Certain records are necessary to provide an account; deleting them may mean we cannot continue providing that account.

Security and international processing

We use access controls, password hashing, and other measures intended to protect information. No website, transmission, storage system, or multiplayer connection is completely secure. Protect your login details and contact us promptly about suspected account misuse.

We operate from the United States. Our providers may process information in the United States and other countries with different privacy laws. Where applicable law requires transfer safeguards, the relevant processing arrangements must provide them, such as approved contractual safeguards or another legally recognized mechanism. Contact us for information about safeguards relevant to your data.

Children

ElderDecks is not directed to children under 13, and those users must not create accounts or submit personal information. A higher minimum age may apply under local law. If you believe a child has provided personal information without the legally required permission, contact elderdeckssuport@gmail.com so we can investigate and address it, including deletion where required.

Changes and contact

We may update this policy as the service or our practices change. The date above identifies the current version. For material changes we will provide notice appropriate to the change and applicable law, and obtain additional consent when required.

Privacy contact: McKee Realty NYC Inc., New York, NY, United States. Email: elderdeckssuport@gmail.com. Service rules are in our Terms of Service.