Privacy policy

Last updated: 7 October 2026 · Deutsche Fassung (the German version is authoritative)

Deckjack is a free, unofficial fan app for managing a card collection with daily prices. There is no advertising, no analytics and no selling of your data. Data is only passed to the service providers named below that we need to run the app. We only process what the app needs – as described below.

1. Controller

The controller is the operator, a private individual. Name and postal address are given in the legal notice (Impressum). Privacy contact: kenearos@mastersofdungeons.de. No data protection officer is appointed (not required).

2. Hosting and accessing the app

The app and server run at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers in Germany (Falkenstein), under a data processing agreement (Art. 28 GDPR).

When you open the app, your browser necessarily transmits your IP address, the time and the requested address. We keep no access logs containing your IP address. To prevent abuse (limiting excessive requests) the server counts requests per IP address; this counter expires after about one minute. Failed sign-in attempts are counted for 15 minutes under a hash of e-mail address and IP address (pseudonymised, not in plain text). Technical application error logs (without IP addresses, e-mail addresses or credentials) are kept for 14 days. Legal basis: Art. 6(1)(f) GDPR (secure, stable operation).

Fonts, program files and card images come from our own server. The only exception: on start, the web app loads Sentry's error-reporting library (browser.sentry-cdn.com), which necessarily gives Sentry your IP address (section 10). Connections are always encrypted (HTTPS).

3. Account and sign-in

Data: E-mail address, verification status, language, your price and alert settings. If you sign in with Google we also store the account identifier issued by Google. If you use a password, we only store an irreversible hash.
Purpose and legal basis: Providing your account and syncing between your devices, Art. 6(1)(b) GDPR.
Retention: Until you delete your account. You can delete it at any time under “Account”; deletion is completed within 24 hours.

4. Sign in with Google

Only when you tap “Sign in with Google” are you redirected to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google then sends us your e-mail address and an account identifier; we never see your Google password. Google may also process data in the USA on the basis of the EU-US Data Privacy Framework adequacy decision. Legal basis: Art. 6(1)(b) GDPR. See Google's privacy policy.

5. Collection, wishlist, alerts

Your cards (quantity, condition, language, optional purchase price, notes), binders, wishlist with target prices, price alerts, portfolio history and change log are stored on the server so they are the same on all your devices; a copy is also kept locally in your browser or on your device. Legal basis: Art. 6(1)(b) GDPR. Retention: until your account is deleted (you can delete individual entries any time). Under “Account” you can download all your data as JSON or CSV.

6. Devices, sessions and local storage

For each signed-in device we store a random device identifier, the platform, a device name (in the browser only the browser name, in the Windows app the computer name) and when it was last used – so you can see under “My devices” where you are signed in and sign other devices out. When a new device signs in we send you a notice e-mail with the device name.

In the browser we only use strictly necessary storage (Section 25(2) TDDDG, no consent required): sign-in cookies (not accessible to scripts, 15 minutes and 30 days), a security value against forged requests, your e-mail address and device identifier for signing back in, and a local database with catalogue and collection. There are no tracking or advertising cookies. Legal basis: Art. 6(1)(b) and (f) GDPR. Retention: sessions expire after 30 days at the latest; device and session records on the server are deleted with the account. Signing out removes the sign-in data from the browser; the local copy of catalogue and collection stays in the browser until you clear the site data or delete your account – on a shared or borrowed device, clear the site data after signing out.

7. E-mails (Brevo)

We send e-mails via Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) under a data processing agreement: e-mail verification, password reset, new-device notices, price alerts by e-mail (only if you enable them; without card names or prices) and confirmation of account deletion. Brevo receives your e-mail address and the message content. Brevo keeps sending logs for one month and stores no copies of the messages. Brevo adds an invisible image (tracking pixel) to every e-mail, which cannot be switched off: if your mail program loads images, Brevo learns your IP address and that the e-mail was opened. We configured Brevo to count opens only anonymously, without linking them to you, and we do not evaluate them. If your mail program does not load images automatically, this does not happen. Legal basis: Art. 6(1)(b) GDPR, security notices (f).

8. Push notifications

Price alerts as push notifications are only sent if you explicitly allow them (Art. 6(1)(a) GDPR). Your browser or device creates a push address with its vendor's push service (e.g. Google, Mozilla, Apple, Microsoft); messages are delivered encrypted via that service and contain only a generic notice such as “New price alert” – no card names, no prices. For delivery the push service receives your device's IP address. The vendors run these services under their own responsibility and may process data outside the EU, in particular in the USA, on the basis of the EU-US Data Privacy Framework where the vendor is certified. You can withdraw permission at any time: in the app the push address is deleted immediately, if you withdraw only in the browser at the next delivery attempt.

9. Bug reports and feedback

When you use “Report a bug” or “Send feedback”, we store your text, the page you were on, app version and platform – and, only if you leave it switched on, a screenshot of the screen. A screenshot can show what was visible (e.g. your collection or e-mail address); you see it before sending and can switch it off. The report is transferred as a ticket to a non-public issue tracker on the operator's own server in Germany – with your account identifier, not your e-mail address. The operator receives a notice e-mail without content. Legal basis: Art. 6(1)(f) GDPR (fixing bugs, improving the app); sending is voluntary. Retention: reports and tickets are deleted after 180 days, and together with your account when you delete it (within 24 hours; if the issue server is unreachable, as soon as it is reachable again); a screenshot stays on the app server only until it is transferred, at most 30 days.

10. Error diagnostics (Sentry)

If the app or server crashes, we send a technical error report to Sentry (Functional Software, Inc., San Francisco, USA) with data storage in the EU (Frankfurt). It contains the error message, code location, browser or device type and operating system and at most your pseudonymous account identifier; e-mail addresses, credentials, inputs and screenshots are removed before sending. So that errors in the web app are captured, it loads Sentry's error-reporting library from Sentry's server (browser.sentry-cdn.com) on start, even if no error occurs. Loading and sending necessarily transmit your IP address. Sentry stores error reports without your IP address and without a location derived from it (switched off in our Sentry account since 7 October 2026). Basis for possible access from the USA: EU-US Data Privacy Framework and standard contractual clauses. Legal basis: Art. 6(1)(f) GDPR (a stable app). Retention: at most 90 days.

11. Card and price data

Our server fetches the card catalogue, card images and daily prices itself (Cardmarket, official card database). No data about you is transmitted.

12. Backups

The database is backed up encrypted every night and kept for 30 days – on the server and as an encrypted copy on the operator's own storage device in Germany. Hetzner additionally creates daily server backups (7 days). After a deletion request your data therefore also disappears from backups 31 days later at the latest (up to 24 hours until deletion, then 30 days of backup retention).

13. Your rights

Access (Art. 15 GDPR) – much of it is visible in the app, everything via data export.
Rectification (Art. 16), erasure (Art. 17 – directly in the app), restriction (Art. 18)
Data portability (Art. 20 – export as JSON/CSV)
Objection to processing based on Art. 6(1)(f) (Art. 21)
Withdrawal of consent (e.g. push) at any time with effect for the future (Art. 7(3))

Write to kenearos@mastersofdungeons.de. You may also lodge a complaint with a supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Kavalleriestr. 2–4, 40213 Düsseldorf, Germany.

You are not obliged to provide data to use the app, but without an e-mail address or Google account you cannot create an account. There is no automated decision-making or profiling.

14. Changes

If the app or the law changes, we update this policy. The version published here applies.