Privacy Policy
Last updated: August 30, 2026
This Privacy Policy applies to the Deck Builder app (hereinafter referred to as the “Application”) developed by Julian Bokelmann (hereinafter referred to as the “Service Provider”) as a completely ad-free service. This service is provided “AS IS”.
Where the Application runs. “Application” means the Deck Builder Android app and the Deck Builder web app at app.deckbuilderapp.app. Both use the same account, the same cloud storage and the same Deck Store; a deck synced from one is available in the other. Where a section applies to only one of them, it says so. The marketing website at deckbuilderapp.app is covered separately in the analytics sections below.
Decks stay on your device unless you choose otherwise. In the web app, your decks, cards, collections and their settings are stored inside your browser (IndexedDB) on the device you are using. They are not transmitted anywhere unless you sign in and use cloud sync, which is a Pro feature. Clearing your browser's site data deletes them, and the Service Provider cannot recover them.
1. Information We Collect
The Application may collect the following types of information:
- User Provided Information: Information you supply when you download or register the Application (registration is not mandatory).
- Account Information: When you sign in with Google, we collect your email address, display name, and profile photo URL from your Google account.
- Username: If you create a username, we store it along with your account to enable features like crediting the initial creator of a deck. Usernames are publicly visible to other users who view decks or cards you have created or edited.
- Account Identifiers: We link your device's unique identifier to your Google account to enable cross-device functionality and username resolution.
- Synced Content (Pro entitlement holders): If you enable cloud sync (available with an active Pro Subscription or Pro Lifetime Purchase), we store your decks, cards, collections, tags, and associated images on our servers. This includes deck names, descriptions, rules, card text, and any images you upload.
- Usage Metrics: For cloud sync users, we track quota usage including deck count, card count, and storage bytes used to enforce fair usage limits.
- Edit History: Synced decks and cards include changelog entries that record which user (by device identifier) made edits and when.
- User Reports: If you report another user for inappropriate content, we collect the reported user's identifier, the reason for your report, and optionally your contact information.
- Deck Store Submissions (Pro entitlement holders): When you publish a deck to the Deck Store, we store the deck metadata (title, description, tags, the AI-assisted flag, the remixes-allowed preference, the age-confirmation flag), the cards it contains (including any images you uploaded), your username, the submission timestamp and the review status. Each submission is reviewed by a human reviewer before release.
- Deck Store Download History: When you download a deck from the Deck Store, we record the deck identifier and your account identifier so the App can show the deck in your library and notify you when the creator publishes a new version.
- Automatically Collected Information: Device type, unique device ID, IP address, operating system, browser type, app usage, and crash data.
- Local Browser Storage (web app): The web app stores your decks, cards, collections, per-deck play settings, an in-progress play session, your theme choice and a randomly generated identifier for your browser in that browser's own storage (IndexedDB and localStorage). This data stays on your device and is not sent to the Service Provider unless you sign in and cloud sync (a Pro feature) is active. The browser identifier exists only to link this browser to your account, in the same way the Android app links your installation.
- Analytics in the web app (only with your consent): The web app asks on first visit whether it may use Google Analytics. Nothing is loaded and no request is sent to Google until you press Allow, and pressing Decline means analytics never runs on that browser. When allowed, we record which screens are opened and a short list of product moments (a deck created, a deck imported, a play session started, the Pro screen viewed, a purchase begun), plus what Google Analytics collects automatically. We do not send your deck names, card names, card text, or the identifiers of your decks and cards. You can change your mind by clearing this site's data in your browser.
- Error reports in the web app (only with your consent): When something in the web app fails, we send a short description of the failure through the same Google Analytics consent above, so that we can find and fix crashes we would otherwise never hear about. It travels only if you pressed Allow: if you declined, no error report is sent either. The description is the type of error, where in our own code it happened, and the error message with anything that could be your content removed first. Deck and card names, card text, your card images, and deck and card identifiers are stripped out before an error report is sent, and we cap how many reports one visit may send.
- Abuse Prevention (web app): To stop automated abuse of the servers, the web app uses Firebase App Check with Google reCAPTCHA v3. reCAPTCHA collects hardware and software information (such as device and application data, and browser interaction signals) and sends it to Google for analysis. This runs on the web app only; the Android app uses Google Play Integrity for the same purpose.
- Location Information: The Application does not collect precise real-time location. It may collect approximate location for geolocation services, analytics, and improvements.
2. How We Use Information
Collected information may be used to:
- Provide app functionality and personalized content
- Synchronize your decks, cards, and collections across your devices (Pro feature)
- Display your username on decks and cards you create or edit
- Enforce usage quotas and fair use limits for cloud sync
- Review and act on user reports to maintain community standards
- Offer relevant recommendations and services
- Analyze user behavior and improve performance
- Contact you with important updates, notices, or promotions
Analytics Disclosure: We use Firebase Analytics which collects device identifiers (such as Android Advertising ID) and usage data to help us understand how users interact with the Application. This data is used to improve app performance and user experience. You can opt out of personalized advertising by adjusting your device's ad settings.
Website Analytics: Our marketing website (deckbuilderapp.app) uses Cloudflare Web Analytics to count visits and understand which pages people read. It is cookieless: it stores nothing on your device, sets no identifier, and does not follow you between sites or between visits. It records the page being viewed, the referring source, and general device and browser type, and derives an approximate country from your IP address. The IP address is used for that and is not stored by us. There is no profile, no cross-site tracking, and none of it is used for advertising.
Because it stores nothing on your device and cannot identify you, it runs without a cookie banner. If you prefer not to be counted at all, any tracker-blocking browser extension or setting will block it, and the website works exactly the same with it blocked.
Google Analytics is no longer used on the marketing website. Until 30 August 2026 the site offered Google Analytics behind a consent banner. It has been removed entirely, along with the banner. Google Analytics is still used inside the Deck Builder web app at app.deckbuilderapp.app, where it remains strictly opt-in, as described above.
3. Third-Party Services
The Application uses third-party services that may collect and process data according to their own policies. The principal providers and their roles are listed below; please review their privacy policies:
- Google Play Services (app distribution, payment processing, refunds, subscription management): privacy policy
- Firebase Authentication (sign-in with a Google account): privacy policy
- Cloud Firestore (cloud database for synced decks, cards, collections, tags, edit history, quota usage, user reports): privacy policy
- Firebase Cloud Storage (cloud storage for synced images): privacy policy
- Firebase Cloud Functions (server-side logic for sync, moderation, and account operations): privacy policy
- Firebase Crashlytics (crash reporting): privacy policy
- Google Analytics for Firebase (usage analytics): privacy policy
- Google Analytics 4 (usage analytics in the app.deckbuilderapp.app web app only, and only with your consent; it is no longer used on the marketing website): privacy policy
- Cloudflare, Inc. (cookieless visitor analytics on the deckbuilderapp.app marketing website; it sets no identifier and builds no profile): privacy policy
- Stripe, Inc. (payment processing for Pro purchases made in the web app; card details are entered on Stripe's systems and are never seen or stored by the Service Provider): https://stripe.com/privacy
- Google reCAPTCHA (abuse prevention for the web app, via Firebase App Check): https://policies.google.com/privacy
- Firebase Hosting (serves the web app at app.deckbuilderapp.app; server logs include IP address and browser type): https://firebase.google.com/support/privacy
- RevenueCat, Inc. (handles Pro Subscription and Pro Lifetime purchases between Google Play, Stripe and the Provider): privacy policy
- Scryfall LLC (API for Magic: The Gathering card data and images; images are loaded directly from
*.scryfall.ioto your device and are not stored by us): about / terms
4. Data Sharing and Disclosure
We may disclose user information in the following circumstances:
- Public Information: Your username is publicly visible to other users who view decks or cards you have created or edited. No other personal information is shared publicly.
- As required by law (e.g., to comply with legal processes)
- When disclosure is necessary to protect rights, safety, or investigate fraud
- With trusted service providers operating on our behalf under strict confidentiality obligations
- With aggregated and anonymized data for analytics and service improvement
5. Your Rights (GDPR and Other Laws)
Depending on your location, you may have the following rights regarding your personal data:
- Right to Access: Request a copy of the personal data we hold about you
- Right to Rectification: Request correction of inaccurate data
- Right to Erasure: Request deletion of your personal data (see Section 7)
- Right to Portability: Request your data in a machine-readable format
- Right to Object: Object to processing of your data for certain purposes
- Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
To exercise these rights, contact us at privacy@deckbuilderapp.app. Please send your request from the email address associated with your account so we can verify your identity. Requests from other addresses may require additional identity verification before we can process them. You can also stop most information collection by uninstalling the Application or adjusting device permissions. In the web app, signing out and clearing this site's data in your browser removes the locally stored decks and the browser identifier from that device.
6. Data Retention
We retain your data as follows:
- Account data (email, username): Retained until you delete your account
- Synced content (decks, cards, collections, tags, images): Retained until you delete them, disable sync and delete cloud data, or delete your account
- Quota usage data: Retained while cloud sync is active; reset when you delete cloud data
- Edit history: Retained as part of synced decks/cards until they are deleted
- User reports: Retained for moderation purposes and may be kept for legal compliance
- Published Deck Store data (decks, card images, metadata): Retained while the deck is published. After the creator withdraws a version or the entire deck (Terms of Service § 5.5(2)), a backup copy is kept for 90 days, then permanently deleted. Copies already downloaded to other Users' devices remain on those devices and cannot be recalled.
- Deck Store download history: Retained until you remove the deck from your library or delete your account.
- Analytics data (app and web app, consented): Retained for up to 24 months, then aggregated or anonymized
- Website analytics (marketing site): Cloudflare Web Analytics holds only aggregate counts with no identifier and no profile, so there is nothing tied to you to retain, retrieve or delete
- Crash reports: Retained for up to 90 days for debugging purposes
- Locally stored web app data (decks, cards, collections, settings, play session, theme, browser identifier): Held in your browser until you clear this site's data or your browser evicts it. The Service Provider has no access to it and no copy of it, and therefore cannot delete, export or restore it on your behalf.
We may retain certain data longer if required by law or for legitimate purposes such as fraud prevention, resolving disputes, or enforcing our terms.
7. Account Data and Deletion
If you sign in with Google, your account data (email, username, synced content) is stored in Firebase. You have control over your data and can delete it at any time.
Disabling Cloud Sync:
You can disable cloud sync at any time in Settings → Account. When you confirm disabling, all synced decks, cards, collections, tags, and images are permanently deleted from our servers. Local data on your device is not affected. If you wish to keep your cloud backup but stop syncing, do not disable sync; simply close the app or keep your device offline.
If your Pro Subscription expires, sync is automatically disabled but cloud data is preserved and becomes accessible again if you resubscribe. (The Pro Lifetime Purchase does not expire, so this scenario does not apply to lifetime holders.)
Removing your published decks from the Deck Store:
You can withdraw individual versions or your entire deck from the Deck Store at any time using the "Withdraw" function on the deck details screen, or by emailing privacy@deckbuilderapp.app with the subject "Deck Store Removal Request". A backup copy is retained for 90 days for moderation and rollback purposes, then permanently deleted from our servers. Copies already downloaded by other Users remain on those Users' devices and cannot be recalled (see Terms of Service § 5.5(2)).
How to delete your account:
Send an email to privacy@deckbuilderapp.app with the subject "Account Deletion Request". The request must be sent from the email address associated with the account to be deleted (this serves as identity verification via the authenticated sender). Requests sent from other addresses will be rejected or processed only after additional identity verification. We process deletion requests within 30 days. An in-app option (Settings → Account → Delete Account) is planned and will be added as a second path once implemented.
What happens when you delete your account:
- Your username is released and becomes available for others
- All synced decks, cards, collections, tags, and images are permanently deleted from our servers
- Your quota usage data is deleted
- Your Firebase Authentication record is deleted
- Data shared with third-party services (analytics, crash reporting) will be deleted according to their retention policies
Data we may retain after deletion:
- Anonymized analytics data that cannot be linked back to you
- User reports you submitted (for moderation records)
- Records required for legal compliance or fraud prevention
Note: Account deletion only removes data stored on our servers. Local data on your device (decks stored offline) is not affected and can be removed by uninstalling the app or clearing app data.
Account deletion requests are processed within 30 days. You will receive confirmation at your account email address once deletion is complete.
8. Children's Privacy
The Application is not directed to children under 13. We do not knowingly collect information from children under 13. If you believe your child has provided personal data, please contact us so we can remove it.
9. Security
We implement physical, electronic, and procedural safeguards to protect user data. However, no security system is completely secure, and we cannot guarantee absolute protection.
10. Changes to This Privacy Policy
This Privacy Policy may be updated from time to time. We will notify users by updating this page. Continued use of the Application after updates constitutes acceptance of the revised Privacy Policy.
11. Consent
By using the Application, you consent to the processing of your information as described in this Privacy Policy, including collection, storage, use, and disclosure of data.
12. Contact Us
If you have questions about this Privacy Policy or data practices, please contact:
Julian Bokelmann
Email: privacy@deckbuilderapp.app