Privacy

The short version

Deckhand keeps your email address and a list of which cards you own. It has no analytics, no advertising, no trackers, and no third-party SDKs collecting anything. Photographs taken by the scanner never leave the device you are scanning on — your phone, or the browser tab on your laptop. You can delete everything at any time, from inside the app.

What is stored

• Your email address and password. Handled by Supabase Auth. The password is stored only as a hash, and Deckhand never sees it in a form it could reuse.
• Your collection. Which cards, how many of each, when the row last changed, and whether it arrived by hand, by scan or by import.
• Decks you save or mark as built. A reference to a deck in the public corpus, and which of those two it is.
• Scan sessions. The cards counted in a batch, until you commit or discard it.
• A per-account usage count, so tier limits can be enforced.
• Which plan you are on, and if you pay for it, three references to the subscription at Stripe: a customer id, a subscription id, and when the paid period you are in ends. See Payments below.

That is the entire list. There is no field for rarity, set, condition, purchase price or where you bought anything — not as a privacy measure but as a product decision, and the effect on privacy is the same.

What is not stored

• Photographs. The scanner reads the card’s name on your device — in the browser tab, or on the phone — and sends only the text it read. Each captured frame is deleted immediately after it is read. No image is uploaded, and none is kept. There is a paid fallback in the code for reads on-device recognition cannot manage, which would send one photograph to a recognition service; nothing in either app calls it, no plan currently offers it, and if it is ever switched on it will say so and ask before it sends anything.
• Location, contacts, calendar, photo library, microphone. The app asks for none of them and has no code that could use them.
• Advertising or analytics identifiers. There is no analytics service in this app at all.

Who else sees it

Supabase hosts the database and the authentication service, so your account and your collection are stored on their infrastructure. They are a processor: the data is not theirs to use.

Card images come from YGOPRODeck (Yu-Gi-Oh!) and Scryfall (Magic: The Gathering), and they are fetched by this server rather than by your device — so browsing the app does not tell them anything about you.

Stripe sees your email address if you buy a plan, and nothing otherwise — see Payments below.

Nothing is sold, and nothing is shared with anyone else. There is no third party receiving a copy for any purpose.

Payments

Paid plans are billed by Stripe, who are the merchant of record: the seller named on your receipt, and the party responsible for collecting any sales tax or VAT. The checkout page and the billing portal are Stripe’s own. Deckhand never sees your card number, and there is no code in it that could store one.

When you start a checkout, Deckhand tells Stripe your email address and an identifier for your account, so that the payment can be matched back to it. Stripe tells Deckhand which plan was paid for and until when, and that is what is stored: the customer id, the subscription id and the end of the current paid period, so your account page can say when the plan renews without asking Stripe each time. Nothing about the payment itself — amount, card, address — comes back to Deckhand.

The billing record — your name and address as you gave them at checkout, the card, and every invoice — is held by Stripe under Stripe’s privacy policy. Changing the card, downloading an invoice or cancelling is done in their billing portal, reached from your account page.

Deleting your account cancels the subscription first, so nothing renews against an account that no longer exists — you do not have to cancel separately. The cancellation is immediate, so any time left on a paid period is not refunded; if that matters, cancel from your account page instead, which runs the plan to the end of what you have paid for, and delete the account once it has ended. The delete button says the same before you press it. If we cannot reach Stripe to cancel, the deletion is refused and says so rather than going ahead and leaving you being charged; try again, or cancel in the billing portal first.

Server logs

Requests are counted per account, and per network address where there is no account yet, so that the service cannot be overwhelmed by one caller. Those counters live in memory, are never written to a database, and are gone when the server restarts.

How long it is kept

For as long as you have an account, with one exception: on a free account nobody has used for 30 days, the decks you have saved or marked as built may be removed to keep the free tier’s storage bounded. Your collection and the decks you wrote yourself are not touched by this. Paid accounts are never subject to it.

Using Deckhand resets the clock — you do not have to sign in again. Opening any screen while signed in counts, as does saving a deck or marking one built. We say this precisely because the obvious reading would be wrong: your sign-in lasts a long time and renews itself quietly, so somebody who uses Deckhand every day may not have typed a password in months, and counting only sign-ins would treat the most active free accounts as the most abandoned ones.

Deleting your account

Open your account page on the web, or tap Account in the app and choose Delete account. It is immediate and it is permanent: your collection, your saved decks and your scan sessions are removed along with the login, and there is no copy kept and no recovery window.

Children

Deckhand is not directed at children under 13 and no account is knowingly created for one.

Contact

Questions about any of this go to [email protected].

Trademarks

Yu-Gi-Oh! and all associated names are trademarks of their respective owners. Deckhand is an independent tool for organising a collection you already own. It is not produced, endorsed by, or affiliated with them, and it sells no cards.