Privacy Policy

Deckcipher is a Magic: The Gathering and Commander tool site. This policy explains how information may be handled when people use the site, including tools such as Deck Import, Card Search, the live game tracker, and bracket or pricing workflows.

This is a plain-language starter policy based on the current codebase. It is not a claim that every legal standard has been reviewed or finalized.

Decklists pasted into Deckcipher tools may be processed in your browser. Unless a feature clearly says it saves or sends data, Deckcipher does not require an account to use these tools. Common examples include decklists entered into deck import or pricing tools, card names entered into search tools, and gameplay values entered into the tracker.

Deckcipher offers a newsletter signup through Mailchimp; see the sections below for what that involves. Deckcipher also offers an optional account (see "Accounts and My Decks" below) so you can save decks and sync them across devices; creating one is never required to use the tools. If you choose to paste personal or sensitive information into a deck field or search field anyway, you do so at your own discretion.

Deckcipher uses Mailchimp's connected-site script sitewide to power newsletter signup and to let Mailchimp associate site visits with subscriber activity. Deckcipher also uses Microsoft Clarity sitewide, which records aggregate and per-session behavior analytics, such as clicks, scrolling, and page navigation, to help understand how the tools are used.

Deckcipher uses Google Analytics in a cookieless configuration to measure page views, traffic sources, general engagement, and selected tool actions. Analytics storage remains denied, so Deckcipher does not use Google Analytics cookies. Google Signals and advertising personalization are also disabled.

Deckcipher also logs outbound affiliate-link clicks (which page, which retailer, plus the requesting IP address and browser user-agent) to a first-party database. This data is reviewed only in aggregate, by page and by retailer, to see which tools and articles drive affiliate traffic; the per-click IP address is also used to apply basic rate limiting against automated abuse.

Deckcipher's contact form similarly stores your message, an optional reply email address, the page you submitted from, and the requesting IP address and user-agent, so the site operator can review and reply to messages through an internal admin dashboard and so repeated automated submissions can be rate-limited. The anonymous newsletter popup analytics (for example, popup shown, submitted, or dismissed) also record the requesting IP address for the same rate-limiting purpose; these events are never linked to the email address you may separately submit to subscribe.

Some tools do make browser requests to third-party or same-origin data endpoints when you use them. The current codebase shows client-side requests to Scryfall for card data, requests to the site's own card-cache worker path at /api, and public Moxfield deck endpoints when you use Moxfield import features. Those requests are part of making the tools function.

When you run the Deck Audit, the “How this deck behaves” section computes a small set of normalized structural numbers (the Deck Fingerprint) and automatically contributes them to Deckcipher's anonymous comparison dataset so the audit can show you how a deck compares with similar decks. This happens as part of using the audit; there is no separate sign-in or profile involved.

What is sent is limited to non-identifying aggregate values: up to six normalized dimension scores (0–100), broad color-count and table-pressure bands, the fingerprint and audit formula versions, a coarse month bucket, and a random token used only for de-duplication and deletion. It never includes your decklist, individual card names, deck names, share links, room codes, account details, or any personal identifier. Because the contribution carries no identity, it cannot be traced back to you or to a specific deck.

These metrics are used only in aggregate to build the peer-comparison ranges shown in the audit and are never sold. If you would prefer your browser not to contribute at all, avoid running the Deck Audit, or clear Deckcipher's browser storage to remove the local de-duplication token.

Deckcipher's tools work fully without an account. My Decks lets you optionally create a free account to save multiple decks, sync them across devices, keep a history of deck versions and audit results, and choose whether each deck is private or shared with a public link.

Signing in only needs an email address: Deckcipher sends a one-time sign-in link and a 6-digit backup code, and never asks you to create or store a password. You can also sign in with Google, in which case Deckcipher receives your Google account's email address and profile name, not your Google password or other Google data. Signing in sets one strictly-necessary session cookie so the site knows you're signed in; this cookie is not used for advertising or cross-site tracking.

An account stores your email address, display name, saved decks and their card lists, deck versions, saved audit results, and your site preferences. You can export a copy of everything an account stores from My Decks at any time, and you can delete your account from the same page. Deleting an account revokes every signed-in session immediately and permanently erases the account and its decks after a 14-day grace period, during which a link in the confirmation email can undo the deletion. Decks saved anonymously in your browser are never deleted as a result of creating, using, or deleting an account.

Deckcipher uses browser storage in the current codebase. Local browser storage is used for things like saved search state, saved deck import state, saved deck pricing state, tracker state, and cached collection data for pages such as Reserved List or Secret Lair.

The site also includes a service worker that can cache some site assets and navigation responses locally in your browser for faster loading. Browser storage and cache generally stay on your device unless you clear them in browser settings.

Mailchimp may set cookies as part of its connected-site script to support newsletter signup and related marketing features. Microsoft Clarity also sets its own cookies sitewide to support session analytics. Deckcipher keeps Google Analytics storage denied and does not use Google Analytics cookies. If you sign in to an optional Deckcipher account, the site sets one strictly-necessary session cookie so the site knows you are signed in. That session cookie is not used for advertising or cross-site tracking.

Your browser or third-party websites may still use their own cookies when you leave Deckcipher, but that would be controlled by those outside services rather than by this site's current front-end code.

Based on the current codebase, information is mainly used to operate the site's tools, remember local preferences or saved state in your browser, fetch card or pricing data, measure aggregate site and tool usage, and keep the experience usable across tools such as Deck Price Calculator and the live tracker.

If you use import tools, search inputs, or calculator forms, that information is used to generate results for you. If you create an optional account, your email and saved decks are used only to sign you in and show your own decks back to you; they are not used for advertising, and are never sold.

Deckcipher may link to third-party websites. Third-party websites have their own privacy policies and handling practices. Deckcipher does not control those outside privacy practices.

The codebase also includes affiliate link helpers and affiliate runtime scripts for certain outbound marketplace links. Disclosure details for those links are kept on the dedicated Affiliate Disclosure page rather than in this section.

Deckcipher may reserve space for ads or sponsored placements, but no active ad network was detected in the current codebase. The current site includes placeholder ad slots in some pages, yet no active ad provider script was detected in the shipped files reviewed for this policy.

Deckcipher does not appear to sell personal information in the current codebase. It does, however, rely on third-party sites or APIs when you choose features that request outside data, such as card data lookups or public deck imports.

Third-party links remain separate from Deckcipher. If you click away to another site, that service handles its own forms, cookies, checkout flows, and support systems.

Browser-stored data can remain until you clear it yourself. That includes saved local tool state and cached site assets stored on your device.

If you create an optional account, it and its decks are kept until you delete the account (see "Accounts and My Decks" above) or ask via the contact page. Deleting an account is permanent after its 14-day grace period; there is no way to recover it afterward.

Contact-form messages and affiliate-link click logs stored in the first-party database are retained indefinitely unless manually deleted by the site operator.

Pod Check rooms and shared game recaps also stay in the first-party database until the site operator deletes them. A Pod Check room stops being reachable when it closes or expires, and every access key for it is destroyed at that moment, but the summary it held (deck labels, commander labels, audit totals, intent answers, and the comparison) remains stored and can be reviewed by the site operator until it is deleted. Revoking or removing a shared game recap takes its public link offline; the recap content itself remains stored on the same basis. Full decklists are never stored for Pod Check.

Deckcipher is a general Magic: The Gathering tool site. It is not designed to knowingly collect personal information from children. If a parent or guardian has a concern, they can use the contact page.

You can block Google Analytics requests with browser privacy controls or a content blocker. You can also clear browser storage and cached site data through your browser settings, and avoid submitting personal or sensitive information into decklist, tracker, search, or calculator inputs.

If you want to ask a question about this starter policy, use the contact page. That page sends the message through Deckcipher's public contact workflow without publishing a personal inbox on the page.

Deckcipher uses reasonable measures where applicable for a static tool site, but no website, browser environment, or internet transmission can be guaranteed perfectly secure. You should use ordinary caution when sharing any information online.

This policy may be updated over time. The page shows a last updated label so visitors can see when the text was last reviewed or changed.

For privacy questions, use the contact page. No personal address, personal phone number, or private contact detail is intentionally published on this page.