Privacy policy

MTGTrade is a free, non-commercial hobby project run by Simon Shinkins (Leeds Ecommerce), Platform, New Station St, Leeds LS1 4JB. It isn't connected with ManaBox, Moxfield, Cardmarket or Wizards of the Coast. For data protection law we are the controller of the personal data described here.

Questions, requests or complaints: email [email protected] or write to the address above. There's no separate data protection officer; your message comes straight to the person who runs the app.

We only collect what the app needs to work:

• Account: your email address, a securely hashed password (we never see the password itself), and whether you've confirmed your email. If you sign in with Google: your Google account ID, name, email address and profile picture.
• Profile: the display name, first and last name, short bio and picture you choose to add.
• Collection: the binders and cards you import or add (card, set, condition, language, quantity, what you paid if you enter it), and your visibility and trade settings.
• Wants: the cards you're looking for, with quantities, price limits and priorities.
• Shops and people: which shops you belong to, your requests to join shops (including the message you send), friends, blocks, playgroups, cards you reveal to people and binder access requests.
• Trades: offers, the cards and any cash amounts in them, trade chat messages, confirmations and ratings (including any private note about a problem).
• Notifications and settings: your notifications, privacy switches, email preferences, chosen price figure and, if you turn on push notifications, the push subscription your browser gives us for that device.
• Things you send us: feedback, reports about other members, requests to add a shop (including the contact details you give) and import files.
• Technical data: our hosting provider keeps short-lived server logs of requests (such as IP address, browser and time) to keep the service running and secure. We don't use analytics, advertising or tracking of any kind.

We don't ask for, and you shouldn't add, sensitive information such as health, religion or political views.

• To provide the app you signed up for (your account, collection, wants, matching, trades, shops, notifications and the emails needed to run your account such as confirming your address or resetting your password). Lawful basis: performing our agreement with you (the terms of service).
• To show your data to other members in the way your settings allow (see section 4). Lawful basis: performing our agreement with you, using the choices you make.
• The daily email digest and urgent want alerts. Lawful basis: legitimate interests in telling you about activity on your own account. You can turn either off at any time in Me › Notifications. We never send marketing.
• Push notifications are only sent if you turn them on for a device. Lawful basis: consent, which you can withdraw by turning them off or in your browser.
• Keeping the app safe (handling reports, enforcing the terms, preventing abuse, securing the service). Lawful basis: legitimate interests in running a safe community for players.
• Feedback and shop requests are used to improve the app and to set up shops. Lawful basis: legitimate interests.

We don't make decisions about you by automated means that have legal or similarly significant effects, and we don't profile you.

Other members. You control what other members see. Each binder can be visible to everyone in your shops, friends, on request or only you, and the privacy switches in Me › Privacy can hide everything. Other members only ever see what your settings allow, and only if you share a shop with them. Your email address is never shown to other members. When you trade with someone, they see the trade, its cards and the chat.

Shop admins see the name, bio, account age and message of people asking to join their shop (never their collection), and the reports members make in their shop.

The public can see the shop directory: shop names, towns, descriptions, websites and a rough member count. Members' names are never shown there.

Service providers who process data for us, only to run the app:

• Gadget (Gadget Software Inc., Canada) hosts the app and its database, stores files and sends our emails.
• Google, only if you choose to sign in with Google.
• Push services run by your browser's maker (such as Google, Apple or Mozilla) deliver push notifications if you turn them on.

We fetch card details and prices from Scryfall and Cardmarket, but we don't send them any personal data. We never sell your data or share it with advertisers. We'd only disclose it to others if the law required us to.

Our providers may store or process data outside the UK, for example in Canada or the United States. Where they do, the transfer is covered by UK adequacy regulations (Canada, and US organisations certified under the UK Extension to the EU-US Data Privacy Framework) or by the UK's approved contract terms (the International Data Transfer Agreement or Addendum). Contact us for more details.

• Your account, collection, wants and settings: until you delete them or your account.
• Completed trades stay visible to the other person after you delete your account, with your name replaced by "Former member"; your chat messages in them are kept without your name. Everything else linked to your account is deleted.
• Data downloads you ask for: 7 days.
• Feedback, reports and shop requests: as long as needed to deal with them, then deleted when no longer needed.
• Server logs: kept by our hosting provider for a short period for security and troubleshooting.

You can delete cards, binders, your whole collection or your account at any time in the app (Me › Privacy).

Under UK data protection law you have the right to:

• access your data: use Me › Privacy › Download my data for a copy of everything, or email us;
• correct it: most of it you can edit in the app;
• delete it: delete your account in Me › Privacy, or ask us;
• restrict or object to how we use it, including anything based on legitimate interests;
• data portability: the download includes your collection as a ManaBox CSV and everything else as JSON;
• withdraw consent for push notifications at any time.

Email [email protected] to use any of these. We'll reply within one month and won't charge you. If you're unhappy with how we've handled your data, please tell us first; you can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

We only store what the app needs on your device, so there's no cookie banner:

• a sign-in cookie that keeps you signed in (strictly necessary);
• your light or dark theme choice (local storage);
• your binder filters for the current tab (session storage, cleared when you close it);
• a copy of agreed trades you open, so they still work with poor signal, and actions waiting to be sent (cleared when you sign out);
• a service worker that handles notifications and that offline trade page.

There are no analytics, advertising or third-party tracking cookies.

You must be at least 13 to use MTGTrade. If you think someone younger has an account, email [email protected] and we'll delete it.

Data is sent over encrypted connections, passwords are hashed, files are private, and other members' data is only ever served through checks that apply your privacy settings, backed by automated tests. No system is perfectly secure; if we ever have a data breach that puts you at risk, we'll tell you and, where required, the ICO.

We'll update this page when the app changes how it uses personal data, and change the date at the top. For significant changes we'll also let you know in the app. You can see what's changed in the app itself on the changelog.