Privacy & Impressum

Impressum / legal notice

Project purpose and editorial direction (Blattlinie): a non-commercial hobby platform providing information and tools for discovering Magic: The Gathering cards, managing collections and wishlists, building and sharing decks, and connecting players. The project currently generates no revenue.

Magic Masters is an independent hobby project and is not affiliated with Wizards of the Coast. Card data is provided by Scryfall.

1. Privacy Policy — who is responsible?

Tobias Hintermann, the operator identified in the Impressum above, is the controller of the personal data described in this policy. Contact: support@magic-masters.com.

Please use this address for privacy questions and requests to exercise your rights.

2. What we process and why

• Account and security: your username, email address, password hash, account and verification timestamps, internal identifiers, and verification, password-reset, and email-change records. These let you register, log in, recover access, and secure your account. Passwords are stored as salted hashes, not readable passwords.
• Your library: deck and wishlist names, selected printings, quantities and finishes, commanders, sideboards, custom mana values, visibility choices, favorites, collection entries, section-order preferences, and related timestamps. We use these to provide the features you request.
• Community features: following relationships, public profile information, and public-library updates let players find each other and follow public activity.
• Searches and imports: search terms are sent to our server; deck-list text is temporarily held during import review. Confirming an import saves the selected card entries. Search terms and filters can also appear in your browser history and requested URLs. Avoid putting private information in these fields.
• Technical operation: connecting to the service discloses your IP address and HTTP request information to the hosting infrastructure. The application uses short-lived rate-limit state and operational logs, including request paths and error or email-delivery diagnostics, to operate and protect the service.
• Support: messages to support@magic-masters.com are handled through Brevo Conversations. We process your email address, message, and any information you choose to send in order to respond. Do not send passwords or authentication links.

Providing a username, email address, and password is necessary to create an account; without them we cannot provide account features. You can browse public pages without registering. Creating lists, following users, and making content public are optional.

3. Legal bases

For account creation, authentication, library management, requested sharing, and account-related emails, we process data to provide the service you request or take steps at your request (Article 6(1)(b) GDPR). Security, abuse prevention, troubleshooting, and general support rely on legitimate interests in providing a secure and reliable service (Article 6(1)(f) GDPR). Retaining shared public contributions serves the interest in keeping community resources available, subject to your rights described below. Where a specific legal duty requires processing, Article 6(1)(c) GDPR applies.

Reading this policy or creating an account is not consent to advertising or optional tracking. No marketing subscription or tracking consent is collected by the registration form.

4. What other people can see

Your username, public profile, and following/follower lists are public. Your email address and password hash are not shown on your public profile. Account settings and your personal favorites list are not public profile sections.

Public decks, wishlists, and collections can be viewed by anyone and may appear in discovery, profiles, and following updates. Public deck contents also contribute to card suggestions based on cards used together. Unlisted resources can be opened by anyone who has the link; they are not private. Private resources are restricted to their owner within the application. Check the visibility control before saving or sharing.

Other people may copy or export public decks. Their independent copies, downloads, screenshots, or search-engine caches are not removed when you change or delete your original. Do not put information you want to keep private into public names or content.

5. Hosting, email, and external card images

• Hetzner Online GmbH: the application server and database are hosted in Germany. Hosting involves processing stored application data and technical connection information. See Hetzner’s privacy information.
• Brevo: account verification, password recovery, password-change alerts, and email-change confirmation are sent through Brevo. It receives the recipient email address and the message, including the action link where applicable, and processes delivery information. Support enquiries are handled through Brevo Conversations. The application sends plain-text transactional emails, not newsletters. Email open and click tracking are disabled in our Brevo configuration. Delivery records and message-preview settings are described in Retention and deletion. See Brevo’s privacy information.
• Scryfall and image delivery: card metadata is imported into our catalogue. Where artwork is not hosted locally, your browser requests card images directly from the external image host, usually cards.scryfall.io, which receives your IP address and browser/request information. Referrer information may also be sent according to browser policy. We do not attach your account email or password to these image requests. Optional rulings retrieval is performed by our server. See Scryfall’s privacy information.

External email and image providers can involve processing outside the European Economic Area. German hosting does not mean every provider processes data only in Germany. Brevo’s data-processing terms are available in its Data Processing Agreement within its Terms of Service. You can contact us for information about the safeguards applicable to your data.

Access by the operator or service providers is for operating the service and handling support or legal obligations. The application does not include advertising networks or third-party website analytics scripts.

6. Cookies and browser storage

• magic_masters_session: an essential login cookie containing an opaque session identifier, with a configured browser lifetime of seven days. Server-side sessions are held in memory; restarting the application can require you to log in again. Logging out clears the current login cookie.
• magic_masters_registration: an essential, short-lived registration-flow cookie scoped to registration pages, with a 15-minute browser lifetime. It connects the browser to temporary registration feedback rather than storing your password.
• Session storage: the registration resend interface stores a cooldown deadline in the current browser tab so refreshing or navigating back does not bypass the displayed waiting time. It is not an advertising identifier and normally ends with the tab’s session.

The application uses these mechanisms for the requested sign-in and registration functions, not cross-site advertising. Blocking them can prevent these functions from working. Ordinary browser caching and history may retain visited URLs and images. Browser controls can clear cookies, session storage, history, and cached content.

7. Retention and deletion

Account and library records remain while the account or resource exists; there is currently no automatic inactive-account deletion schedule. You can delete decks and wishlists, change visibility, and request account deletion in account settings.

Account deletion does not delete all public content. It deletes the original account, private/unlisted resources, favorites, following relationships, and associated account tokens. Public decks, public wishlists, and a public collection remain under “Removed user,” without the original account name or email. Content itself could still identify you—for example, a name you put in a deck title. This is not a guarantee of complete anonymisation.

If you want public resources removed, delete them or make them private before deleting your account, or contact support@magic-masters.com about your erasure rights. Retained public contributions currently have no automatic expiry. Independent copies made by other users are separate resources.

Verification links are valid for 8 hours in this deployment; password-reset links for five minutes; email-change links for 30 minutes. Expiry stops a link from working but does not automatically delete its database record. Token and request history can remain until replaced or removed with the account.

Registration-flow state and unconfirmed import reviews have a 15-minute validity window and are kept in application memory. Expired entries are cleaned up during subsequent use, or disappear on a restart; replacement or confirmation can remove them earlier. Rate-limit state is temporary and uses short request windows.

Operational logs: logs managed by the server’s system journal (journald) are subject to a seven-day retention policy. Journal files are rotated and removed automatically; storage limits can remove older logs sooner. This is file-based cleanup, not a guarantee that each individual entry is erased at an exact time. This schedule covers journal-managed logs, not backup copies or the separate email-provider records described below.

Transactional email records: Brevo’s transactional-log retention is configured to one month, including the support sender. Its scheduled deletion can take up to 24 hours after the configured period. Email previews for new messages are not stored; this does not prevent Brevo from processing the message to deliver it or from retaining delivery records. Changing the preview setting does not itself delete previews stored before the change. Email open and click tracking are disabled.

Recovery backups: automated database backups are created daily through our self-hosted Coolify installation and retained for seven days. Hetzner server backups use seven rolling backup slots: new backups replace the oldest ones. Seven slots is a backup-count limit, not an exact seven-day deletion guarantee. A server backup can contain an older database backup or log file that has already been deleted from the live server; that copy remains until the containing server backup is replaced. Deleting an account or live record therefore does not immediately remove it from existing recovery backups.

Support conversations: we use messages in Brevo Conversations to answer your enquiry and handle related follow-up. Conversations and copies in a connected mailbox are separate from transactional delivery logs; the one-month log setting does not automatically delete those messages. Contact support@magic-masters.com for questions or erasure requests.

8. Your rights

Subject to the conditions in the GDPR, you can request access to your personal data, correction, erasure, restriction of processing, and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. If processing is based on consent, you may withdraw that consent without affecting the lawfulness of earlier processing.

Write to support@magic-masters.com. We may need proportionate information to verify a request, but will not ask for your password. Requests should normally be answered within one month; where the GDPR permits an extension, you must be informed of the reasons.

You may complain to a competent supervisory authority, including the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at. You do not have to contact us first.

9. Automated decisions and changes

The application does not make automated decisions with legal or similarly significant effects about you. Card search ordering, deck statistics, and rule checks concern cards and deck lists, not decisions about your eligibility or rights.

This policy will be updated when processing changes. The date above identifies this version. Material new uses of data may require additional information or separate consent; they are not authorised merely by updating this page.