The short version: MTG Codex runs no analytics, sets no cookies, and includes no advertising or third-party tracking of any kind. Nothing is sold or shared for marketing. The data held is what the app needs to work, and you can delete all of it yourself at any time.
MTG Codex (“the Service”) is an independent project operated from the United States, and is not affiliated with, endorsed by, or sponsored by Wizards of the Coast or Hasbro. For anything in this policy, contact us on our Discord or through the feedback feature in the app.
Account. Your email address and a bcrypt hash of your password. We never store your password itself and cannot recover it. Optionally a display name and avatar, which are public if you make your profile public.
Your content. The collection, decks, binders, wishlist and tradelist you build, plus anything you write: messages, profile wall posts, and deck comments.
Card images you scan. Sent to Google for recognition and not retained by us afterwards. See section 4.
Operational records. When you last signed in, and a log of AI feature usage including which feature, when, and what it cost to run. These exist to enforce free-tier limits and to understand what the service costs.
The Service sets no cookies. Signing in stores a session token in your browser's local storage, which is what keeps you signed in; clearing your browser data signs you out. There is no analytics package, no advertising network, no social media pixel, and no cross-site tracking. Nothing follows you off this site.
We use a small number of providers to run the Service. Each receives only what it needs.
Card names, prices and images come from Scryfall, a public source. Nothing about you is sent to Scryfall.
Your profile is private by default. If you choose to make it public, you control individually whether your collection, decks, tradelist, wishlist, friends list, featured decks and wall are visible, from Settings. Your email address is never shown publicly. Deck comments and profile wall posts are visible to anyone who can see that deck or profile.
Account and collection data are kept until you delete them. Deleting your account removes your account, collection, decks, binders and content from our database.
You can view and correct your information at any time from Settings, and delete your account and all associated data yourself, without asking us, from the same place.
Depending on where you live, you may also have the right to a copy of your data, to object to or restrict processing, or to complain to a data protection authority. Contact us and we will help. We do not sell personal information, and we do not use it for automated decisions that have legal effects.
Passwords are hashed with bcrypt. Traffic is encrypted in transit. Access to the production database is restricted. No system is perfectly secure, so please use a unique password, and tell us if you think your account has been accessed by someone else.
The Service is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will remove it.
The Service is operated from the United States and your information is processed there. If you use it from elsewhere, you are transferring your information to the United States.
If this policy changes materially, we will update the effective date above and give notice in the app. See also our Terms of Service.