Privacy statement

Last Modified: 13th July 2026.

This policy applies to the Deckbox website and to the Deckbox iOS and Android applications.

We do not sell or rent personal information, and we do not use personal information for cross-app advertising or tracking. We may share personal information with service providers only as needed to operate Deckbox, as described below. We may update this policy. We will notify you about significant changes in the way we treat personal information by sending a notice to the primary email address specified in your account or by placing a prominent notice on our site.

Data controller and privacy contact

The controller responsible for processing personal data under the General Data Protection Regulation (GDPR) and other applicable data protection laws is: 

S.C. Leaping Frog Studios S.R.L
str I.L.Caragiale 1/19
430121 Baia Mare
Romania
Phone: +43 680 2326804
admin@deckbox.org

Account and personal data deletion

You can request deletion of your Deckbox account and associated personal data from the account settings page. If you cannot access your account, email admin@deckbox.org from the email address associated with your account and include your Deckbox username if known. We may ask you to verify account ownership before completing the request and will email you when the deletion has been completed.

Account deletion removes or anonymizes personal account data that is no longer needed to provide Deckbox. We may retain limited records when required for security, fraud prevention, dispute resolution, legal compliance, accounting, or backup integrity. Local data stored by the mobile applications can also be removed by logging out or uninstalling the application.

General information on data processing

We process personal data only where needed to provide Deckbox and its website and mobile application features, or for the other purposes described in this policy.

Data we process

We process account and profile data such as username, email address, password hash and other authentication information, activation status, notification settings, premium membership status, country, region, city, profile name, and linked Apple or Google sign-in identities when you choose to use them.

We process the content and activity you create in Deckbox, including inventories, tradelists, wishlists, decks, tags, comments, messages, support cases, disputes, uploaded card photos, scanner corrections, trade records, and order or transaction records.

For trades, we process the full name and postal address that you choose to provide for that trade. For paid services, payment processing is handled by payment providers; Deckbox does not store full payment card numbers.

We also process technical and diagnostic data such as IP address, browser or app user agent, cookies, request logs, mobile app runtime, device model, error reports, stack traces, and related troubleshooting data.

How we use data

We use personal data to provide Deckbox, authenticate and secure accounts, maintain inventories and trades, deliver notifications and support, process payments and premium access, prevent abuse and fraud, troubleshoot errors, improve reliability, comply with legal obligations, and improve scanner accuracy when you opt in to scanner frame uploads.

For users in the European Economic Area, our legal bases are performance of our contract with you when we provide account and Deckbox features; your consent for optional processing such as scanner frame uploads; our legitimate interests in securing Deckbox, preventing abuse and fraud, providing support, and improving service reliability; and compliance with legal obligations such as accounting and responding to valid legal requests. You can withdraw consent at any time using the relevant setting, without affecting processing that took place before withdrawal.

Mobile applications

Deckbox's iOS and Android applications process account, session, device, and diagnostic information as needed to authenticate you, secure your account, troubleshoot issues, and provide mobile functionality. They also store authentication information, preferences, and cached Deckbox and scanner data on your device to keep you signed in and make the applications faster and more reliable.

Camera and scanner uploads

The card scanner uses camera access to identify Magic: The Gathering cards. Camera frames are processed on your device by default.

If you opt in to scanner frame uploads, the application may upload selected card images or crops, scanner diagnostics, and correction metadata to Deckbox. We use these uploads only to debug scan results and improve scanner accuracy. You can withdraw your consent at any time in the application's settings without disabling on-device scanning.

Confidentiality

Your inventory, tradelist, wishlist and decks are publicly viewable on the internet by default. However, you can choose to protect them with a password, or make them completely private (feature available for premium accounts).

Your Deckbox Profile is publicly available on the internet. Information included in the profile and viewable by other people is: name, country and city, last login time. Your e-mail address, as well as your postal address are private and not displayed or disclosed by us with the exception of "emailing other users" and "trading" explained below.

Emailing other users

When using the email functionality on Deckbox the name and e-mail address that you provided to us will be available to the other party.

Trading

When trading with other users, your full name as well as the postal address that you supply and confirm on per trade basis are available only to you and to the other party. Also, the chat and chat history from each trade are private and viewable only by you and the other party.

Comments

Comments made on private decks are private to the owner of the deck and not publicly available. Comments made on public decks, as well as events are public.

Intellectual Property

Our Terms and Conditions recognizes your right to retain full intellectual property protection for the digital content you create, including decks.

Sharing and service providers

We share personal data with other users only where this is part of Deckbox functionality or your chosen privacy settings, such as public profiles, public collections, messages, comments, trades, and postal addresses confirmed for a trade.

We use service providers to operate Deckbox, including hosting and infrastructure providers, file and object storage providers, email delivery providers, payment processors, and Apple and Google authentication services when you choose those sign-in methods. They may process personal data only as needed to provide their services to Deckbox. We require them to protect personal data to the same or an equivalent standard as this policy and applicable law. We may also disclose personal data if required by law, court order, or valid legal process.

Some providers may process personal data outside the European Economic Area. Where required, we rely on an adequacy decision, standard contractual clauses, or another lawful transfer safeguard. You can contact us for more information about safeguards applicable to your data.

Data retention

We keep account data and the trade, subscription, payment, and activity history available through your account while your account remains active. Routine server logs are normally deleted within 90 days, and rolling backups are retained for up to 90 days before being overwritten.

After account deletion, we delete or anonymize personal data unless it must be retained for an unresolved transaction or dispute, fraud or abuse prevention, the establishment or defense of legal claims, or compliance with accounting or other legal obligations. Support records are generally retained for up to two years after closure, trade and dispute records for up to three years after account deletion or final resolution, and payment and accounting records for the period required by applicable law, generally five years under Romanian accounting law.

Optional scanner frame uploads and related diagnostics are retained for up to two years and are then deleted or anonymized.

Security

We use technical and organizational measures designed to protect personal data, including HTTPS for data in transit, authentication controls, restricted administrative access, and secure storage practices appropriate to the type of data. No online service can guarantee perfect security, but we work to protect Deckbox accounts and data from unauthorized access, loss, misuse, or alteration.

Your choices and rights

You can update account information, privacy settings, notification preferences, and account deletion settings from your account settings page. Depending on your location, you may have rights to access, correct, export, delete, restrict, or object to the processing of personal data, as well as the right to data portability and to withdraw consent. You can contact us at admin@deckbox.org to exercise these rights.

If you are in the European Economic Area, you also have the right to lodge a complaint with the data protection authority where you live or work. Deckbox's lead supervisory authority is Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP).

Cookies

Deckbox uses cookies. Cookies are small text files stored in your browser. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a unique string of characters that make it possible to identify the browser if the user accesses the website again. Certain elements on our website require us to be able to identify the browser of the user accessing the website even if the user comes back to the site after leaving.