Privacy Policy

SWU Cards is run by SWU Cards LLC, a company in Washington State, USA. [CONFIRM] Exact legal entity name and registered address.

Questions about this policy or your data: sean@swucards.com.

• Account email, handled by Supabase Auth (and a password hash if you use a password; we never see your password).
• Collection data you enter: cards you hold, locations, conditions, serial numbers, face and rotation, and the history of changes.
• Decklists you save: each deck's name, format, cards and notes. If you import a deck, we also keep the exact text you pasted or uploaded, and any event details it carries (event name, date, rank, record), so unmatched lines can be fixed later. Decks are visible only to you.
• Placeholders you create for cards you are tracking.
• Hosting logs: Vercel keeps standard request logs (IP address, time, page, browser type) for security and operation. [CONFIRM] Vercel log retention period on our plan.

• No advertising and no ad networks.
• We never sell or rent your data.
• No tracking or analytics cookies. The only cookie-like storage is your sign-in session. [CONFIRM] No analytics tools are added without updating this page.

• Google and Discord (only if you choose Continue with Google or Discord): they share your name, email and avatar with us to create your account. We store them in your account. We never post to your account or read anything else from it.
• Supabase: database and sign-in. Holds your email and collection data.
• Google sign-in (when you choose "Continue with Google"): Google shares your name, email and profile picture with us. We use them to find or create your account.
• Discord sign-in (when you choose "Continue with Discord"): Discord shares your username, email and avatar with us. We use them to find or create your account.
• Cloudflare Turnstile (sign-up only, when switched on): a human check on the sign-up page. Cloudflare sees your IP address and browser details to run it.
• Resend (administrator notices): an email delivery service. When someone signs up, the administrator gets an email with the new account's email address and sign-in provider, plus a daily summary of who signed in. Nothing else about your account is sent. Resend also delivers the one welcome email we send to your own address when you sign up.
• Feedback (when you send it): your message and screenshots are stored in Supabase in a private store (signed, short-lived links only). If the administrator turns a report into a GitHub issue, only the message text and technical details go there, never your email or your screenshots.
• Vercel: hosting for the website and its request logs.
• GitHub: stores our code only. It holds no user data.
• Voice search (when you use it, including dictating a feedback message with the microphone button): your browser's own speech service (for example Google or Apple) may receive the audio. We never record or store audio. Only the words you keep in the box are used; for feedback, they are stored like the rest of your message.
• Camera scan (planned, not live): photos would be processed and then discarded, never stored. A server fallback would use Anthropic's API. This will be confirmed here the day it ships.

We add each new processor to this list the day it ships.

• View and correct: everything you entered is visible and editable in the app.
• Export: a download feature is coming. Until it exists, email us and we will send your data. [CONFIRM] Format and turnaround.
• Delete: ask us to delete your account and all your data, and we will. [CONFIRM] A self-serve delete button is not built yet.

To ask, email sean@swucards.com from your account address. [CONFIRM] Response time of 30 days.

Your collection is protected by row-level security in the database: only your signed-in account can read or change it. Connections use HTTPS. No system is perfectly secure, and we will tell affected users promptly if a breach affects them. [CONFIRM] Breach-notice wording.

We keep your data until you delete your account or ask us to. After deletion we remove it from the live database. [CONFIRM] Backup retention and how long deleted data may persist in backups. Hosting logs are kept by Vercel for its standard period.

SWU Cards is not for children under 13, and we do not knowingly collect their data. If you think a child has signed up, email us and we will delete the account. [CONFIRM] Minimum age (13 vs 16).

We update this policy whenever a feature changes how we handle data. The date at the top and the list below show what changed. For significant changes we will tell account holders by email.

• 2026-11-07: added My decks. You can import a decklist (pasted or uploaded as text) and save it. We store the deck's cards, name and format, plus the exact text you imported and any event details it contains. Only your signed-in account can read your decks. Copying a deck to your clipboard happens in your browser and sends nothing to us.
• 2026-11-04: when you create an account we send you one welcome email, through Resend, to the email address you signed up with. It is a plain notice (thanks, a few tips, a link to the app) with no marketing and no tracking, and we record that it was sent so you never get it twice.
• 2026-11-04: added a Feedback button. If you send feedback we store your message, any screenshots you attach (up to 3, in a private store only you and the administrator can open), the page you were on, your browser and screen size, the app version, whether you said it is OK to contact you, and your account. We use it only to improve the app, and the administrator is emailed that new feedback arrived. Screenshots are never public.
• 2026-11-04: the feedback form's "What happened?" box now has a microphone button. It works exactly like voice search: your browser's own speech service may receive the audio; we never record or store audio.
• 2026-11-04: the site's administrator is notified when someone signs up, and receives one daily summary of who signed in. These notices contain your email address and sign-in provider only (no password, no collection data). They are sent by email through Resend, an email delivery service, and a record of each sign-up is kept in an admin-only list.
• 2026-11-04: public sign-ups are open: anyone aged 13 or older can create an account with an email and password, a magic link, Google or Discord, after confirming their email. At sign-up we store your email (and a password hash if you use a password), the sign-in provider, and when you confirmed you are 13 or older. A new account starts empty with one Sorting Table location and no cards. If a human check (Cloudflare Turnstile) is switched on for sign-up, Cloudflare receives your IP address and browser details to run it; we store nothing from it.
• 2026-11-03: added Google sign-in (shares name, email and profile picture) and Discord sign-in (shares username, email and avatar) to the processors list.
• 2026-11-01: first draft published.
• 2026-11-01: added voice search to the processors list: your browser's own speech service may receive audio while you use the microphone button; we never record or store audio.
• 2026-11-04: added Continue with Google and Continue with Discord sign-in. If you use them, the provider shares your name, email and avatar with us; both are added to the processors list.