The short version: MTG Codex sets no cookies and has no advertising or third-party tracking. It measures how fast pages load, catches errors, and counts visits (which pages, roughly where in the world, and which site sent you), without knowing who you are. Nothing is sold or shared for marketing. The data held is what the app needs to work, and you can delete all of it yourself at any time.
MTG Codex (“the Service”) is an independent project operated from the United States, and is not affiliated with, endorsed by, or sponsored by Wizards of the Coast or Hasbro. For anything in this policy, contact us on our Discord or through the feedback feature in the app.
Account. Your email address and a bcrypt hash of your password. We never store your password itself and cannot recover it. Optionally a display name and avatar, which are public if you make your profile public.
Your content. The collection, decks, tags, wishlist and tradelist you build, plus anything you write: messages, profile wall posts, and deck comments.
Card images you scan. Sent to Google for recognition and not retained by us afterwards. See section 4.
Operational records. When you last signed in, and a log of scanning and deck analysis usage, including which feature, when, and what it cost to run. These help us understand usage and what the service costs.
The Service sets no cookies. Signing in stores a session token in your browser's local storage, which is what keeps you signed in; clearing your browser data signs you out. There is no advertising network, no social media pixel, and no cross-site tracking. Nothing follows you off this site.
To find slow pages and errors, and to understand how people find the site, the site records anonymous visit data: which page, how long it takes to load, your browser and device type, your approximate location (country and region, worked out from your IP address, which isn't kept), the site that linked you here, and any errors. It goes to our proprietary infrastructure, not an analytics company, isn't tied to your account, and is kept for up to 13 months.
We use a small number of providers to run the Service. Each receives only what it needs.
Card names and prices come from Scryfall, a public source. Card images load straight from Scryfall's servers, so they see your IP address the way any website does when it serves you a file. Nothing else about you is sent to them.
Your profile is private by default. If you choose to make it public, you control individually whether your collection, decks, tradelist, wishlist, friends list, featured decks and wall are visible, from Settings. Your email address is never shown publicly. Deck comments and profile wall posts are visible to anyone who can see that deck or profile.
Account and collection data are kept until you delete them. Deleting your account removes your account, collection, decks, tags and content from our database.
You can view and correct your information at any time from Settings, and delete your account and all associated data yourself, without asking us, from the same place.
Depending on where you live, you may also have the right to a copy of your data, to object to or restrict processing, or to complain to a data protection authority. Contact us and we will help. We do not sell personal information, and we do not use it for automated decisions that have legal effects.
Passwords are hashed with bcrypt. Traffic is encrypted in transit. Access to the production database is restricted. No system is perfectly secure, so please use a unique password, and tell us if you think your account has been accessed by someone else.
The Service is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will remove it.
The Service is operated from the United States and your information is processed there. If you use it from elsewhere, you are transferring your information to the United States.
If this policy changes materially, we will update the effective date above and give notice in the app. See also our Terms of Service.