Privacy

Signed out, DeckBrewer keeps none of your decks on a server. A deck you paste is sent to the server to look up the cards and is not kept, and a share link carries the list itself, which the server reads to show the page when the link is opened. A deck link you paste is fetched once by the server from the site it is on (Moxfield, Archidekt, TappedOut, MTGGoldfish or Scryfall) and not kept.

An account stores your email address, your handle, a hash of your password, and every deck you save with its version history. The email is a login name, and nothing is ever sent to it. The password is never stored in the clear.

Signing in sets a cookie that holds a random token. The server keeps a hash of that token, so a copy of the database cannot be used to sign in as you, and the cookie is not readable by scripts on the page.

There is no email verification and no password reset in this version. Losing your password means losing the account.

A deck is private until you publish it. Publishing puts it at a public address that search engines can find. To unpublish it, untick Public on the My decks page.

We keep basic anonymized analytics so we can keep the service running and free from errors, and see which parts of it people use so we can improve it. The only third parties we rely on are those that provide infrastructure, such as your internet provider and Cloudflare, or assets and login services, such as Scryfall, which serves the card images your browser shows. We set no cookie for this and store nothing that identifies you.

Card data comes from Scryfall, combo data from Commander Spellbook and precon lists from MTGJSON. The footer names all three.

To ask about your data, or to have a public deck page taken down, email [email protected].