Privacy Policy

Only what the product needs to work. There is no tracking pixel, no advertising profile, and no data broker.

• Account — your email address and a hashed password, or the identifier from an OAuth provider if you sign in that way. Handled by Supabase Auth; we never see your plaintext password.
• Your library — the cards, decks, lists, wishlists and proxy queues you create, including quantities, conditions, and any purchase prices you choose to record.
• Preferences — display name, pricing source, collection defaults and alert settings.
• Usage counters — AI credit balances and per-day quota counts, so paid and free limits can be enforced.
• Notifications — price-alert records and the notifications generated from them.
• eBay tokens — only if you connect an eBay account. Access and refresh tokens are stored encrypted at rest and are used solely for the features you invoke.
• Newsletter — if you subscribe, your email address is stored with our email provider. Subscribing is separate from having an account.

• Payment card details. There is no checkout at present; if and when paid plans launch, card data will be handled entirely by the payment processor and will never reach our servers.
• Your location beyond the coarse region your request arrives from, which our host records in its logs.
• Contacts, device identifiers, or anything from other sites you visit.

Each of these sees only what it needs to do its job.

• Supabase — database, authentication and file storage. This is where your library lives.
• Vercel — hosting, CDN and request logs. Logs include IP address, user agent and requested path, and are retained for a short operational window.
• Google (Gemini) — AI deck generation and collection chat. Prompt content is sent only when you use an AI feature. That content can include card names and deck contents from your library; it does not include your email address or password.
• Resend — transactional and newsletter email.
• Upstash (Redis) — rate limiting and short-lived caches, keyed by account or IP.
• Scryfall and Card Kingdom — sources of card and price data. Requests to them are made by our servers for card data; no personal information is sent.
• eBay — only if you connect an account, and only for the actions you trigger.

We set authentication cookies so you stay signed in, scoped so a session works across manascry.com and app.manascry.com. There are no advertising or cross-site tracking cookies. Clearing them signs you out.

We use Vercel Web Analytics, which reports aggregate page views and referrers. It does not set a cross-site identifier and does not build a profile of you across other websites.

No advertising is currently served. The product is designed to support ad-supported free access in future, and an ad-free entitlement exists in the codebase for that reason, but no ad provider is configured and no ad requests are made today. If that changes, this page will be updated before any ad code is enabled, and the provider will be named here.

Your library is kept for as long as your account exists. Deleting your account removes your account record and the data attached to it. Card and price reference data is not personal to you and is retained as a shared cache. Host and infrastructure logs age out on our providers' own schedules, which are measured in days, not years.

• Export — Settings includes a data export that returns your collection in a portable format.
• Delete — Settings includes account deletion. It removes your account and its data and cannot be undone.
• Correct — profile, email and preferences are all editable in Settings.
• Unsubscribe — every newsletter email carries an unsubscribe link, and unsubscribing does not affect your account.

If you are in a jurisdiction that grants additional rights over your personal data, such as the UK/EU GDPR or the CCPA, you may exercise them by contacting us; the export and delete controls above already cover access, portability and erasure.

ManaScry is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will remove it.

If this policy changes materially, the effective date above changes with it. Continuing to use the service after that date means the updated policy applies.

Questions, requests, or a privacy concern: reach us through the contact page.