Privacy

Who is responsible

The controller of your data is Pablo Rufat Muñoz (tax ID 73211519N), with address at Carrer del Pare Rodés, 3. 08208 Sabadell (BA). For anything about your data, write to pablorufatdev@gmail.com.

What data we process

You can create and export cards without an account. In that case we process none of your data on our servers.

If you create an account and save cards, we store:

• Your email address, to sign you in with a one-time code.
• The cards you save: name, land types, texts and abilities, framing, rarity, language, photographer credit and the other fields of the card, and the expansion they belong to.
• The photos of those cards, re-encoded without EXIF metadata, so without location or camera data.
• The symbols of the expansions you create, as SVG files.

The servers that deliver the website may also keep technical data in their logs, such as your IP address and browser type.

We count how the website is used anonymously, only as daily totals: visits, cards created and exports in each format. When one of those happens, your browser sends our server only the type of event, with no cookies or identifiers, and the server adds one to that day's total. We don't store your IP address or anything that could tell who did what: our code only uses it in memory to limit how many counts it takes per minute and prevent abuse, and neither saves it in the database nor writes it to its logs. Separate from that are the hosting's technical logs, described above, which may keep the IP address of each request. We don't use third-party analytics tools.

Your account

Giving your email address is necessary to have an account: without it we cannot create one. The rest of the app works without an account.

The account is for people aged 14 or over (in Spain, 14 is the minimum age to consent to the processing of data, art. 7 LOPDGDD). If you are younger, do not create an account.

What we do not process

The photos you do not save with an account never leave your browser. The landscape detection runs on your device: the photo is not sent anywhere to be analysed, and the card is drawn and exported in your browser.

The drafts you make are kept only in your browser (see Cookies). We cannot see them.

The first time you use the detection, your browser downloads the model files (about 90 MB) from the Hugging Face servers. That request reaches Hugging Face as any web request does (your IP address and browser data), but it contains none of your photos. See the Hugging Face privacy policy.

Legal basis

• Performance of a contract (art. 6.1.b GDPR): to provide your account and to save your cards, photos and symbols.
• Legitimate interest (art. 6.1.f GDPR): keeping the website secure and working, and counting its use with anonymous totals.

Automated decisions

We make no automated decisions that have legal or similarly significant effects on you.

Who else receives the data

We only share data with providers that work for us:

• Supabase (sign-in, database and file storage): processes your email, cards, photos and symbols on our behalf, as a processor.
• Railway (hosting): serves the website and may keep technical logs such as your IP address, as a processor.
• Hugging Face: only serves the model files described above.
• Resend (delivery of sign-in emails): receives your email address and sends you the one-time codes, as a processor.
• Cloudflare (Turnstile, the check against bots on the sign-in screen): only on that screen, before the code is sent to you. It receives your IP address, technical data about your browser and device, and signals of your interaction with the page, to check that you are a person; it does not receive your email. It relies on our legitimate interest in protecting the sign-in. See the Turnstile privacy policy.

Besides the providers above, no other third party receives your data.

International transfers

Some of these providers may process data outside the European Economic Area, for example in the United States. In that case the transfer relies on an adequacy decision (such as the EU–US Data Privacy Framework) or on standard contractual clauses, according to each provider.

How long we keep it

Your account, cards, photos and symbols are kept until you delete them or delete your account.

You can delete cards and expansions whenever you want, and you can delete your account from «My expansions». Deleting the account removes it together with the cards, photos and symbols saved in it.

The technical logs of the servers are kept for the time their provider sets. The drafts in your browser stay until you delete them or clear the site data.

Your rights

You can ask for access to your data, its rectification or erasure, the restriction of its processing, to object to it and to receive it in a portable format. Write to pablorufatdev@gmail.com and include enough information to identify your account.

You can erase your data yourself by deleting your account from «My expansions».

Complaints

If you think we are not processing your data properly, you can complain to the Spanish Data Protection Agency (AEPD, aepd.es) or to the authority of your country.