Privacy notice

Data we process

• Account and sign-in data: your account identifier, email address, connected sign-in providers, and authentication information managed by Supabase.
• Profile and settings: username, selected profile picture, optional social links, visibility and sharing choices, grading preferences, and onboarding state.
• Grades and activity: current normal and build-around grades, the time grades were saved, grade history, imports and exports recorded for achievements, and per-set privacy choices.
• Private card notes: the note text you choose to save, its associated card, and the time it was last updated. Notes are linked to your account.
• Security information: limited technical logs and account-moderation records where needed to protect the service and enforce its rules.

Why we use it

Account, profile, settings, grade, and private-note data are processed to provide the service you request. Optional publication of your profile or analytics and inclusion of your grades in community analytics are controlled by your choices and can be disabled in Settings. Security and abuse-prevention processing is based on the legitimate interest in operating a safe and reliable service. Data may also be processed where necessary to comply with a legal obligation.

Internal usage totals

Administrators can view aggregate registration and grading counts to understand use of the service. These totals include private accounts and grades, but do not display individual grades, private notes, or account identities. They use existing database records without adding browser tracking. Guest grading is not included unless you sign in and merge those grades.

Guest mode and device storage

Guest grades remain in this browser and are not sent to the application database unless you sign in and choose to merge them. Guest grades expire 30 days after their last save. Theme and quick-grade preferences also stay in the browser. Authentication uses cookies when you sign in. These items provide requested site functions; myLimitedGrades does not currently use advertising or behavioral-tracking cookies. See the cookies and local storage notice for details.

Sharing and public features

A private profile and its grades are excluded from public profiles, shared summaries, public analytics, and leaderboards. Community summaries use only opt-in grades and do not publish individual grade histories. When you explicitly share a set and your profile settings allow it, visitors can see your latest normal card grades for that set in your public profile and analytics. Build-around grades, private notes, individual grade history, and grade timestamps are not included in those shared views. Social links appear only when the relevant visibility controls allow them. You can stop sharing a set from its set page or My Grades sharing controls, or disable public visibility in Settings.

Recipients and external services

• Clever Cloud: hosts the website in Paris, France, and processes web requests and operational logs, which may include IP addresses, request paths, browser information, and errors.
• Supabase: provides the production database and authentication service in Frankfurt, Germany, processing account information, profiles, grades, private card notes, and authentication records.
• Brevo: sends account confirmation and password-reset emails, processing recipient email addresses, message content, and delivery events. Email events may also include opens and clicks depending on tracking settings. Brevo reports database hosting in France, Germany, and Belgium; see its data storage information.
• Google, Discord, and Twitch: when you choose one of these sign-in providers, it processes the login under its own privacy policy and supplies the identity information you authorize, such as your email address and basic profile, to our authentication service.
• Scryfall: card images and symbols may load directly from Scryfall, which receives ordinary web-request information such as your IP address and browser details. Your grades are not sent to Scryfall.
• 17Lands: licensed public data is used for benchmarks. Your grades are not sent to 17Lands.

International processing

The website and primary account database are hosted in the EU. This does not mean all processing stays in the EU/EEA: providers and their subprocessors may process support, security, email, or sign-in data elsewhere. Transfer arrangements depend on the provider and destination. Supabase publishes a data processing agreement containing EU standard contractual clauses; your sign-in provider describes its own transfer safeguards in its privacy policy. Contact the privacy address above for information about the arrangements applicable to your data.

Retention and deletion

Account data and grade history are kept while your account exists so the service can provide history, analytics, and achievements. You can permanently delete your account in Settings; profile data, grades, private card notes, private rating history, settings, social links, and connected sign-in methods are removed through the account relationship. Published product updates are retained without account attribution.

• Hosting logs: Clever Cloud documents a standard seven-day log retention period.
• Database and API logs: the current Supabase Free plan provides one day of API and database log retention. This period does not describe all authentication, security, or backup records.
• Email records: Brevo stores transactional logs and email previews indefinitely by default unless a shorter retention period is configured. These records are separate from your application account and are not automatically removed by deleting it in Settings. See Brevo's retention documentation; contact us to request deletion of email records associated with your account.

Account deletion does not immediately erase copies in provider logs or backups. Backup copies are subject to the provider's backup lifecycle. Security and moderation records may be retained separately where necessary to investigate abuse, enforce restrictions, or meet legal obligations. Contact us for information about remaining records and deletion requests.

Your rights

Depending on the circumstances, you may request access to, correction or deletion of, or restriction of processing of your personal data; receive portable data; object to processing based on legitimate interests; and withdraw an optional sharing choice at any time. You can update many details, download your data, change sharing settings, or delete the account directly in Settings. The complete account-data download (JSON) includes your private card notes with card identifiers and names; the grades-only CSV download does not include notes. You can also remove an individual note from its note editor. Email the privacy contact for anything the controls do not cover. You may also complain to the Swedish Authority for Privacy Protection (IMY) or the supervisory authority where you live or work.

Security and changes

Access controls and database row-level security are used to limit access to account data. No internet service can promise absolute security. Material changes to this notice will be dated here and, when appropriate, highlighted in the application.