Privacy and terms
Last updated
Deck Sandbox runs entirely on your device. You can import decks, play and export games without creating an account and without sending us anything. The account exists only to sync what you already have across your devices.
Who operates it
Deck Sandbox
- Privacy, data and account deletion [email protected]
- Anything else [email protected]
What stays on your device
Until you create an account, nothing leaves your browser. Stored locally:
- the game in progress
- your decks
- your screen preferences
- the card catalog and the images you downloaded
This is not an implementation detail: it is how the app was designed. Clearing the site data in your browser erases all of it, and we have no copy.
What the account stores
If you create an account, we store:
- your email, to sign in and to recover your password
- your password, never as text — only a hash, which does not allow recovering the original password
- what you choose to sync: up to 6 decks, 3 games in progress and 3 game histories
We do not ask for your name, phone, address, date of birth or payment details. There is no payment in Deck Sandbox.
This data is stored on servers of an infrastructure provider working on our behalf, and is not shared with anyone else.
What we use it for
We use your data to make the service work: signing in, syncing your decks and games across your devices, and recovering your password if you ask.
That is all. If that ever changes, this page is updated first.
Game data, never player data
Today we analyse nothing. No statistics, report or study is being produced from what you store here.
If that ever happens, this is the limit, and it is the commitment we make: what interests us is game data, never the data of the people playing.
- what would come out of it are aggregate numbers, never content tied to a person
- nothing that identifies you is published, sold or shared
- your decks and games remain yours. They are linked to your account because that is what makes syncing possible — that is the only reason
Who else receives anything
Card images and data come from Scryfall, a public Magic data service. When you open a card, your browser requests the image directly from them, so they see that request. We send nothing of yours along: they receive neither your email, nor your decks, nor who you are.
What we do not do, and will not do:
- we do not sell and do not rent your data
- we do not profile you and do not make automated decisions about you
Polls
When a poll is open on the site, it counts votes and never people. To prevent repeat voting, your network address is read and not stored; what remains is a scrambled mark, valid only in that poll, which ceases to exist when it closes.
Deleting your account
You delete your account whenever you want, from the app itself.
- the request is marked immediately and deletion happens 5 days later
- signing in before that cancels the request
- after the 5 days, we delete your email, your password and everything you had synced
- your device keeps everything. Deleting the account deletes the sync, not your decks or your games
Your rights
You can ask at any time for confirmation that we process your data, access to it, correction, deletion and portability. Two of these are already product features, and you do not need to ask:
- portability: exporting decks and games is a button in the app, and the file is yours
- deletion: deleting the account is described above
For the rest, write to the privacy address above.
Changes
If this page changes, the last updated date changes with it. A change that alters what we do with your data is announced inside the app before it takes effect.
About Magic: The Gathering
Deck Sandbox is fan content, is not affiliated with Wizards of the Coast and is not endorsed by them. Magic: The Gathering and the cards are their property. This project is free.