Privacy Policy

Last updated: October 29, 2026

DeckPlanet ("DeckPlanet," "we," "us," or "our") built this Privacy Policy to explain, in plain terms, what information we collect when you use our website and services (the "Service"), why we collect it, and what you can do about it.

1. Information We Collect

We collect the following categories of information:

  • Account information. When you create an account, we collect your email address, username, and password. Your password is hashed by our backend content management system (Directus) and is never stored in plain text.
  • Profile information. If you choose to add them, your first name, last name, location, avatar image, and email notification preferences.
  • Avatar and media uploads. Images you upload, such as a profile avatar, are stored with our cloud storage provider, Linode Object Storage. Uploaded files currently use a public read setting, which means the direct URL to an uploaded file is accessible to anyone who has the link, even if your profile itself is private.
  • Linked accounts (optional). If you choose to connect a Discord, Patreon, or Metafy account, we store that provider's user ID for your account, and, where the provider shares them, your username and avatar image URL. We use these to let you sign in with that account and to deliver membership benefits. We do not store the OAuth access or refresh tokens issued when you connect, and we never receive your password for those services.
  • Membership records. If you support DeckPlanet through Patreon or Metafy and link that account, we store your membership tier, membership status, and relevant dates (such as when the membership started, renews, or ended), so we can turn Premium and community perks on and off. We never receive or store your payment details; billing is handled entirely by Patreon or Metafy.
  • Deck and collection data. Decks, card collections, want lists, and other content you create while using the Service.
  • Price alert preferences. If you set a price alert on a card, we store the card, your threshold price, and whether you want to be notified when the price goes above or below it, so we can check it against current prices and notify you when it triggers.
  • Notifications and social activity. To power your in-app notification inbox, we store notifications generated by the Service, for example when a price alert you set is triggered, someone comments on or likes one of your decks, or a user follows you. We also store the social actions you take, such as which decks you've liked and which creators you follow, since these are visible to other users, either as counts (deck likes) or as a visible following and follower relationship between accounts.
  • Usage data. Aggregate, non identifying analytics about how the Service is used. See "Cookies and Analytics" below for details.

2. How We Use Your Information

We use the information above to:

  • Create and maintain your account and authenticate you, through NextAuth, backed by Directus.
  • Provide the Service's core features, such as deck building, collection tracking, and card search.
  • Send transactional emails, such as summaries of comments on your decks, through our email delivery provider, Resend.
  • Generate and deliver in-app notifications, for example when a price alert you set is triggered, someone comments on or likes your deck, or a new user follows you.
  • Let you sign in with a linked Discord or Metafy account, and verify your Patreon or Metafy membership so we can deliver Premium and community perks, if you have linked those accounts.
  • Run our Discord bot, PlanetBot. PlanetBot receives your Discord user ID, DeckPlanet username, and supporter tier, and uses them only to assign membership roles in the DeckPlanet Discord server and to answer the commands you send it.
  • Understand how the Service is used, in aggregate, so we can improve it.

3. Legal Basis for Processing

Where the EU or UK GDPR applies, we process your personal data on the following legal bases: performance of a contract, to provide the Service you signed up for, such as your account and deck data, and delivering the membership benefits you signed up for; consent, for optional features such as analytics cookies (discussed below) and linking a Discord, Patreon, or Metafy account; and legitimate interests, such as keeping the Service secure and reliable.

4. Third-Party Service Providers

We rely on a small number of third-party providers to operate the Service. Each one processes a limited set of data on our behalf:

  • Directus. Our content management system and database. It stores account and application data.
  • Linode Object Storage. An S3-compatible storage provider, hosted in the us-southeast-1 region, that stores uploaded media such as avatars.
  • Patreon. Used for optional OAuth account linking and membership verification. Patreon sells and bills Patreon memberships under its own privacy policy.
  • Metafy. Used for optional sign-in, account linking and membership verification. Metafy sells and bills Metafy memberships under its own privacy policy.
  • Discord. Used for optional sign-in and account linking, and to assign membership roles in the DeckPlanet Discord server through PlanetBot.
  • Resend. Sends transactional emails to your registered email address.
  • Google Analytics. Used for aggregate usage analytics only. See "Cookies and Analytics" below.
  • Meilisearch. Powers search over trading card and deck data. It does not index or store any personal data about you.
  • Redis. Our caching infrastructure. It temporarily stores derived data such as your unread notification count, keyed to your account, to make the notification inbox fast to load.

We do not sell your personal information, and we do not share it with third parties for their own advertising purposes.

Affiliate links

DeckPlanet participates in the eBay Partner Network and in the TCGPlayer and CardNexus affiliate programs. Some links to those marketplaces, including card listings and "Buy" or "Search" buttons, contain a tracking ID that identifies DeckPlanet. If you make a qualifying purchase after following one, we may earn a commission at no extra cost to you.

Once you leave DeckPlanet, the marketplace may set its own cookies and collect data under its own privacy policy. Listing details on card pages are fetched by our servers, but listing thumbnail images load directly from eBay, so eBay receives your IP address when they are shown. We do not tell eBay which page you are viewing.

5. Cookies and Analytics

We use Google Analytics (gtag.js) strictly for aggregate usage metrics, for example, monthly active users and click-through rates on features. This analytics configuration does not use Google Signals, remarketing, or advertising features, and we do not use it to sell or share your data with third parties for advertising purposes.

Google Analytics only loads after you give consent through our cookie consent banner.

6. International Data Transfers

Draft placeholder, needs legal confirmation: Our infrastructure providers (Linode, Google, Patreon, Metafy, Discord, and Resend) operate primarily in the United States. Where we transfer personal data of users located in the EEA, UK, or Switzerland to the United States, we intend to rely on an appropriate legal transfer mechanism, such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. The specific mechanism relied on for each provider still needs to be confirmed and finalized by legal counsel before this policy is final.

7. Data Retention

We keep your account and content data for as long as your account stays active. If you delete your account, we will delete or anonymize your personal information within a reasonable period, except where we are required to retain certain data for legal, security, or fraud-prevention purposes.

Linked-account data (provider user ID, username, and avatar URL) is removed when you unlink that account or delete your DeckPlanet account. When you unlink a Metafy account, the membership it provided is ended on DeckPlanet, along with the Premium and Discord perks that came from it. To disconnect a Patreon account, contact us using the details below; the same applies to it.

8. Your Rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. You can exercise most of these rights directly from your account settings, where you can request account deletion, unlink connected accounts, and download an export of your data (including your supporter membership records). If there is a request you cannot complete yourself, please contact us using the details below.

9. Children's Privacy

DeckPlanet is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. During sign-up, users must confirm that they meet our minimum age requirement. If you believe a child has given us personal information, please contact us so we can look into it and take appropriate action.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above, and for material changes, we will provide additional notice where appropriate.

11. Contact Us

If you have questions about this Privacy Policy, or you would like to exercise your privacy rights, please contact us at deckplanet@gmail.com.