Privacy Policy

1. Who this policy covers

This policy applies to the ManaArchive website, the public Magic: The Gathering catalog, and the signed-in collection workspace (together, the “Service”). It describes what we collect, why, who we share it with, and what you can do about it.

The Service is operated by Kingpost Software LLC, formerly Storatix LLC (“ManaArchive”, “we”, “us”), which is responsible for your personal information as its controller. Our postal address is:

ManaArchive is an inventory and organization tool for personal collections. We are not a marketplace, we never take custody of your cards, and we never move money between users.

2. Information we collect

Information you give us

• Account details — your display name, email address, and a hash of your password. We never store your password itself. Accounts created through Google or Discord have no password until you set one.
• Social sign-in details — if you sign in with Google or Discord, we receive the provider account identifier, the email on that account, and whether the provider has verified it. We do not receive your provider password, contacts, or anything else from those accounts.
• Discord server roles — if you link your Discord account in the ManaArchive Discord server, our bot gives you a Verified role and a role matching your plan (PLUS or PRO). Those roles are visible to other members of that server, and they are removed when your account is deleted.
• Collection content — the cards you own, their finish, condition, language, quantity, and where each copy physically lives (binder, box, page, slot), plus your decks, storage containers, wants, notes, and uploaded CSV imports and their unresolved rows.
• Social content — friend codes, friend requests, trade requests and their contents, profile details, and anything you make public or unlisted.
• Support and contact messages — what you send us through the contact form or by email, including your name and email address so we can reply. If you attach a file, the file is delivered to our support mailbox; we keep only its name, type, and size.
• Marketplace credentials (PRO) — if you connect a CardTrader or ManaPool seller account, we store the API token you provide. Tokens are encrypted at rest with AES-256-GCM and are never returned to the browser after you save them.

Information we collect automatically

• Session records — when you log in we create a server-side session and store the IP address and browser user agent it was created from, so you can see and revoke active sessions and so we can investigate suspicious access.
• Operational logs — for each request to our API: the IP address, browser user agent, requested URL, response status, and timing, plus error records. Cookies, authorization headers, and access tokens are removed before anything is written. Logs are used to keep the Service running and to diagnose failures, and are held by our hosting provider on a short rolling window rather than archived.
• How you found us — when you create an account we record where the visit came from (the referring site or campaign tags in the link you followed), so we know which channels bring people to ManaArchive.
• Aggregate site analytics — Cloudflare Web Analytics counts page views and page-load performance on the website. It sets no cookies, does not track you across sites, and does not build a profile of you; we see only totals, such as how many visits a page received.
• Advertising measurement, only if you allow it — we advertise ManaArchive on Google and Microsoft Bing. If you choose “Accept” in the cookie notice on the website, the Google Ads tag and Microsoft Advertising’s UET tag load, set cookies, and send Google and Microsoft the pages you visit here, your IP address and browser details, the ad click that brought you (if any), and the fact that you created an account (not your name, email, or collection), so they can tell us which ads lead to sign-ups. If you decline, or have not chosen yet, neither tag loads and nothing is sent. The mobile app carries neither.
• Plan-limit records — when a request is refused because it would exceed your plan’s limit, we record which limit it was, your plan, the kind of action (not its content), and when, to learn which limits matter to people.
• Derived collection data — daily value snapshots and price history computed from your holdings and public card prices.

What we do not collect

We do not show advertising on the Service, we do not sell or rent your personal information, and we do not build advertising or behavioural profiles. Two things qualify that. The ad measurement tags described above run only if you allow them, and only to measure our own ads; we do not use them to build audiences or retarget you. Buy links to TCGplayer are affiliate links, so following one lets their affiliate network attribute a resulting purchase to us. That happens only when you click one, and only after you have left the Service — “Who we share information with” below sets out what it involves. Apart from those tags, the only analytics is the cookieless, aggregate page counting described above. We do not receive or store your full payment card number — card details go directly to Stripe.

3. How we use your information

We use the information above to:

• Provide the Service — store your collection, resolve imports, render your decks, binders, and dashboards.
• Authenticate you, keep sessions valid, and protect accounts against abuse and credential stuffing.
• Track card values over time using public pricing data from Scryfall.
• Deliver the features you turn on — trade requests, friend connections, public share links, and marketplace listing sync.
• Send transactional email: password resets, billing notices, and replies to messages you send us.
• Enforce plan limits, process subscriptions, and detect violations of the Terms of Use.
• Debug, secure, and improve the Service, and comply with legal obligations.

We do not use your collection contents to train machine-learning models, and we do not share your holdings with other users except through sharing features you control.

4. Legal bases for processing

If you are in the European Economic Area or the United Kingdom, we process your personal data on these bases:

• Performance of a contract — running your account, storing your collection, and processing subscription payments.
• Legitimate interests — keeping the Service secure, preventing abuse, diagnosing faults, keeping backups, and understanding in aggregate how people find and use the Service, balanced against your privacy rights.
• Performance of a contract also covers optional integrations you choose to connect, such as social sign-in, Discord, or a marketplace seller account — we process that data because you asked us to provide that feature. You can stop it at any time by disconnecting the integration in Settings.
• Consent — the advertising measurement tags, which load only after you choose “Accept” and stop the moment you withdraw it.
• Legal obligation — retaining records we are required to keep, such as billing records.

5. Cookies and local storage

ManaArchive sets two strictly necessary cookies of its own:

• A session cookie, set when you log in, which identifies your server-side session. It expires after 30 days of inactivity by default, and deleting it logs you out.
• A sign-in state cookie, set only while you are signing in with Google or Discord. It ties the provider’s redirect back to the sign-in you started, to block forged sign-in attempts, and expires after 10 minutes or as soon as the sign-in finishes.

Both are HTTP-only, marked Secure in production, and use SameSite=Lax.

Advertising measurement cookies are set only if you choose “Accept” in the cookie notice on the website: the Google Ads tag (cookies beginning _gcl_) and Microsoft Advertising’s UET tag (_uetsid, _uetvid and _uetmsclkid). Google and Microsoft use them to connect an ad click to a later sign-up. Until you choose, and if you decline, none of them is set. Your choice is remembered in your browser’s local storage.

We also use your browser’s local and session storage for interface preferences — card size, grid or table view, dismissed banners, and a hint that you were previously signed in. That data stays in your browser, is never sent to us as a profile, and is cleared when you clear site data.

Do Not Track and Global Privacy Control. If your browser sends Global Privacy Control, we treat it as declining advertising measurement: the tags never load and the notice is not shown. Do Not Track has no agreed meaning, so we do not act on it, but the tags still load only if you allow them. Following an affiliate buy link takes you to TCGplayer, where your browser sends those signals to them and their own policy governs what happens next; not following the link is how you decline it here.

6. Who we share information with

We share personal data only with the service providers below, only to the extent each needs it to do its job, and only under contracts that limit their use of it. We do not sell personal information.

Encrypted database backups are also kept on hardware we operate ourselves. They are encrypted before they are written anywhere and can only be read with a key we keep offline.

We also read public data from Scryfall (card metadata and prices) and Archidekt (aggregate commander statistics). Those are outbound reads of public catalogs — we do not send them your identity or your collection.

We may disclose information if required by law, to respond to a valid legal process, or to protect the rights, safety, and property of ManaArchive, our users, or the public. If ManaArchive is involved in a merger, acquisition, or sale of assets, your information may transfer as part of that transaction; we will give notice before your data becomes subject to a different privacy policy.

7. Information you choose to make public

Several features publish data on purpose, and you control each one:

• Decks, binders, and boxes have their own visibility — private, unlisted, or public. Public items are readable by anyone with the link and may be indexed by search engines. Unlisted items are readable by anyone with the link but are not advertised.
• Friends and trade requests share the specific items and profile details needed for the trade with the other person involved.
• Marketplace listings you publish appear on that external marketplace under your own seller account and are governed by that platform’s terms and privacy policy.

Changing an item back to private removes it from public view going forward, but we cannot recall copies, caches, or screenshots other people already made.

8. How long we keep data

• Account and collection data — kept while your account is active.
• Deleted accounts — deletion is scheduled rather than immediate. Your account enters a grace period (7 days by default) during which you can cancel, then your data is permanently purged by an automated job.
• Deletion records — after a purge we keep a minimal log entry with SHA-256 hashes of the account id and email address, plus timestamps, so we can prove a deletion happened and keep the account deleted if a backup is ever restored. It holds no name, address, or collection data. Because someone who already knows an email address could hash it and find the entry, we treat it as pseudonymised personal data.
• Backups — encrypted copies of the database are kept for recovery: nightly copies for 14 days, weekly copies for 4 weeks, and monthly copies for 6 months, plus our database provider’s own short-term backups. A deleted account ages out of every backup within 6 months. Backups are never used to bring back a deleted account, and a restored database has deletions re-applied before it goes back into service.
• Support messages — kept for 2 years from when you sent them, then deleted automatically. When an account is purged, messages sent from its email address are deleted at the same time.
• Plan-limit records — kept for 180 days, then deleted automatically, or sooner when your account is purged.
• Operational logs — kept by our hosting provider on a short rolling window and not archived by us.
• Sessions — expire on their own and expired rows are removed by a scheduled job. Password reset tokens are single-use and expire within an hour.
• Billing records — retained as long as tax and accounting rules require, independent of account deletion.

9. Your rights and choices

You can exercise these from Settings, without contacting us:

• Access and portability — download an export of your account as an archive of JSON and CSV files, covering your profile, collection, placements, storage, decks, imports, trades, friends, marketplace data, and cost-basis records. Some records are not in the self-service export, either because they are credentials or because they are not tied to your account row: your session history (IP addresses and devices), linked sign-in providers, support messages, plan-limit records, any administrator actions on your account, and the original text of each row of a CSV file you imported (the card details read from it are exported). Email us and we will send you those too.
• Correction — edit your profile, preferences, and any collection record at any time.
• Deletion — request account deletion, which schedules the permanent purge described above.
• Withdraw consent — turn off advertising measurement with the “Change ad measurement choice” button under “Cookies and local storage”, unlink a social sign-in provider, or disconnect a marketplace connection. Every account must keep at least one way to sign in, so you will be asked to set a password before unlinking your last provider.

Depending on where you live, you may also have the right to object to or restrict processing, to lodge a complaint with your local data protection authority, and — under US state privacy laws — to know what we collect and to opt out of sale or sharing. We do not sell personal information. If you allow advertising measurement, some of those laws may treat what the tags send Google and Microsoft as “sharing”; you opt out by choosing “Reject” in the cookie notice, with the control under “Cookies and local storage”, or by sending Global Privacy Control. We will not discriminate against you for exercising any of these rights. Email support@manaarchive.com if you need help with a request; we respond within the time your local law allows, and within 30 days where no shorter deadline applies.

10. Security

We protect your data with password hashing, HTTP-only session cookies over TLS, server-side session records you can revoke, rate limiting on authentication endpoints, CSRF protection on state-changing requests, encryption at rest for marketplace tokens, and query-level scoping so one account cannot read another’s rows.

No system is perfectly secure. Use a strong, unique password, keep your email account secure, and tell us at support@manaarchive.com if you believe your account has been accessed without permission. If a breach affects your personal data, we will notify you and any required regulator as the law requires.

11. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you are in the EEA or the UK, you must be at least 16 or have permission from a parent or guardian. If you believe a child has given us personal information, contact us and we will delete it.

12. International transfers

ManaArchive is operated from the United States and our providers store and process data in the United States and other countries. If you use the Service from outside the US, your information is transferred to and processed in the US, where privacy laws may differ from those where you live. Where required, we rely on appropriate safeguards such as the European Commission’s standard contractual clauses.

13. Changes to this policy

We may update this policy as the Service changes. The effective date at the top always reflects the current version. If a change materially affects how we use your personal data, we will give notice in the app or by email before it takes effect. Continuing to use the Service after a change means you accept the updated policy.

14. Contact us

Questions about this policy, or a request about the data we hold on you? Email support@manaarchive.com, use the contact page, or write to us at: