Privacy Policy

The controller of your personal data is the operator of RoguEDH ("RoguEDH," "we," "us"). You can reach us about privacy at gerald@d20comms.com.

Account information. Your email address, your username, and your password (stored only as a secure hash by our authentication provider; we never see it). If you sign in with Google, we receive your name, email address, profile picture and Google account identifier from Google.

Play information. The leagues you create or join, your draft choices (the cards you were offered and the ones you picked), your decks, the game results you or others record, and the trophies and medals you earn. Statistics on your profile, such as win rates and favorite colors, are calculated from this.

Subscription information. If you pay for PRO or Patron, our payment processors (Stripe for cards, PayPal for PayPal and Venmo) collect your payment details. We receive and keep only their customer, subscription or order references, your plan, its status and renewal or end date, the amounts and dates of PayPal and Venmo payments, and whether you have used a one-time offer. We never receive or store your full card number or your PayPal or Venmo login. If you join or run a Patron group, we record who belongs to which group and when they joined.

Store information. If you run a Patron store, we keep the store name, logo, address, website, Discord invite and Discord webhook you provide. The webhook stays private and is used only to post your store's league announcements and results to your Discord server.

Email fingerprints. To keep the free league and the free PRO trial to one per person, we store a one-way, salted fingerprint (a hash) of your normalized email address. The fingerprint cannot be turned back into your address, but it can tell us whether the same address has been used before.

Technical information. Our hosting and database providers process your IP address, browser type and request logs to deliver the Service and keep it secure. Card images are loaded from Scryfall, so Scryfall's servers also see your IP address when your browser fetches them.

Messages. If you email us, we keep the correspondence so we can help you.

If you choose "Continue with Google," we request only the basic sign-in permissions (your name, email address and profile picture). We use this information solely to create your account and sign you in. Other players never see your Google name or picture: you choose a username the first time you sign in, and that is the only name shown in the Service. We do not request access to your Gmail, Drive, contacts, calendar or any other Google data.

RoguEDH's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, use it to train artificial intelligence or machine learning models, or allow humans to read it except with your consent, for security purposes, or where the law requires. You can revoke RoguEDH's access at any time from your Google Account permissions.

Under the EU and UK General Data Protection Regulation (GDPR), we must have a legal basis for each use of your data:

• To provide the Service (your account, drafts, leagues, standings, trophies, profile, playtester and exports), because it is necessary to perform our contract with you (Art. 6(1)(b)).
• To run subscriptions (billing, renewals, cancellations and Patron groups), also to perform our contract with you (Art. 6(1)(b)).
• To prevent abuse of free offers (email fingerprints), to keep the Service secure, and to keep league results intact for other players after an account is deleted, based on our legitimate interests in running a fair and sustainable service (Art. 6(1)(f)).
• To keep financial records as tax and accounting laws require (Art. 6(1)(c)).
• To send service emails such as sign-up confirmation and password resets, which are necessary to perform our contract (Art. 6(1)(b)). We do not send marketing email.

We make no decisions about you based solely on automated processing that have legal or similarly significant effects. Draft randomness is a game mechanic, not profiling.

Your username, profile statistics, trophies, medals and draft history are visible to other signed-in players. If you win or medal in a league run by a Patron store, your username, record and trophy also appear on that store's public page, which anyone can see. If you make a draft recap shareable, anyone with its link can see your username, that deck's commander and highlights, the league's name and your record there, until you make it private again. Your Daily Draft result, commander and username appear on that day's leaderboard, and your achievements and rivalries (who you've beaten and who's beaten you in shared games) appear on your profile. Notes you leave on cards are shown with your username to PRO players drafting the same commander; card upvotes are shown only as totals, never with your name. League members can see each other's usernames, decks, picks and game results within that league. If you join a Patron group, the Patron can see your username and the date you joined, but nothing else about your account. Your email address is never shown to other players.

We do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising. We share it only with service providers (processors) who help us run the Service under contracts that require them to protect it and use it only on our instructions:

• Supabase: authentication and database hosting.
• Vercel: website hosting and delivery.
• Stripe: card payments and subscription billing.
• PayPal (including Venmo): PayPal subscriptions and Venmo payments.
• Google: sign-in, if you choose it.

When a store league ends, the winner's and medalists' usernames and records are posted to that store's Discord server if the store has connected one; Discord's own privacy policy then applies to that message.

Scryfall serves card images directly to your browser. Exports to MPC Autofill or Moxfield happen only when you choose to download or copy your deck list, and anything you then upload to those sites is governed by their own policies. “Buy this deck” opens TCGplayer with the card names you leave ticked in the link; we send TCGplayer nothing else, and what you do there falls under TCGplayer's policies. If that link is an affiliate link, TCGplayer's affiliate network learns that the visit came from RoguEDH. We may also disclose information if the law requires it, to protect the rights and safety of our users or others, or as part of a sale or reorganization of the Service (in which case this policy will continue to apply).

RoguEDH is operated from the United States, and our providers may process data in the United States and other countries. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) in our providers' data processing agreements, or on a provider's certification under the EU-U.S. Data Privacy Framework.

• Account and play information: for as long as your account exists.
• After you delete your account: your email, profile picture, name and sign-in are erased immediately. Your decks, game results and trophies stay in the leagues you played in under an anonymous name such as "Deleted player 3f9a1c," so that other players' standings and trophies remain accurate. This remaining information is no longer linked to you.
• Email fingerprints: kept after deletion, so deleting and re-registering cannot reset the free league or trial. They are not linked to your profile once your account is deleted.
• Billing records: kept by Stripe, PayPal and us for as long as tax and accounting laws require, generally up to seven years.
• Backups and logs: deleted data can persist in encrypted backups and provider logs for a short period (typically up to 30 days) before it is overwritten.

Depending on where you live (and in any case if you are in the EEA, the UK or Switzerland), you have the right to:

• Access the personal data we hold about you and receive a copy of it;
• Rectify inaccurate data (you can change your username yourself, and we can update your email);
• Erase your data ("the right to be forgotten");
• Port your data to another service in a machine-readable format;
• Restrict or object to processing based on our legitimate interests;
• Complain to your local data protection authority, although we'd appreciate the chance to fix things first.

Do it yourself, instantly. On your account page, "Download My Data" gives you a JSON file of everything we store about you, and "Delete my account" erases your account as described in section 8. Deleting your account also ends any subscription immediately.

Or ask us. Email gerald@d20comms.com from the address on your account. We will respond within one month, and may need to confirm your identity first. We will not charge you or treat you differently for exercising your rights. U.S. residents of states with consumer privacy laws (such as California, Colorado, Virginia and others) have similar rights to know, correct, delete and port their data, and may use the same methods.

We use only strictly necessary cookies: the ones that keep you signed in and protect your session. We do not use advertising, analytics or tracking cookies, so we don't ask for cookie consent. Stripe and PayPal set their own cookies on their checkout pages, and the Venmo button loads PayPal's script on our PRO page, to process payments and prevent fraud.

The Service is not directed at children under 13, and they may not create accounts. In the EEA and the UK, if you are under the age at which you can consent to data processing in your country (between 13 and 16), you need permission from a parent or guardian. If you believe a child has given us personal information without permission, contact us and we will delete it.

We protect your data with encryption in transit (HTTPS), access controls that keep the database reachable only by our servers, hashed passwords, and providers that maintain recognized security certifications. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

We will post any changes here and update the effective date. If a change is significant, we will tell you by email or through the Service before it takes effect.

Questions, requests or complaints about privacy: gerald@d20comms.com.