Privacy policy

Last updated 10 October 2026

This policy explains what personal data the Deckster app and this website handle, why, and what you can do about it. Deckster is in closed beta, and we will update this policy as the app changes.

Who is responsible

Stable Growth AS (org. no. 833 364 162), Mo i Rana, Norway, is the data controller for Deckster. Contact us about anything in this policy at post@stablegrowth.no.

What we collect in the app

• Your account. When you sign in with Google or Apple, we receive your email address, your name and an identifier from that provider. We use them to sign you in and to show who you are in the app. There are no Deckster passwords. If you use Apple's "Hide My Email", we only see the relay address.
• Your collection. The cards you add, with their condition, language, finish, what you paid, where you got them, your asking prices, storage locations, decks, wants, imports and the history of changes. Members of a collection you share can see and change it according to the role you give them.
• Share links. When you share a collection by link, anyone with the link can view what you chose to share, without signing in. We store only a fingerprint of the link, so we can't recreate it. You can turn a link off at any time.
• Subscriptions. If you buy Premium, the purchase goes through Google Play or the App Store. We never see your card or payment details. We store which product you have, its status and dates, and the store's transaction id, so the app knows which features to unlock.
• Technical logs. Our server logs requests (time, address, what was asked for, errors) to keep the service running and secure.

The camera stays on your phone. When you scan cards, or read a card from a photo, the images are processed on your device and deleted straight away. They are never uploaded.

The app has no advertising and no third-party analytics today. If that changes, we will update this policy first and ask for your consent where the law requires it.

What we collect on this website

• Beta applications. If you apply for the beta, we receive your name, your Google account email, your collection size and anything you write in the form. We use it to invite you and to talk to you about the beta.
• Deletion requests. If you ask us to delete your account through this website, we receive the details in that form and use them only to handle your request.
• No cookies or tracking. The website sets no cookies, has no analytics and loads its fonts from our own server. Our hosting provider keeps short-lived technical logs, such as IP addresses, to deliver the site and protect it from abuse.

Why we may use it

• To provide the app you signed up for: your account, collection, sharing and subscription (GDPR article 6(1)(b), contract).
• To keep the service secure and working, and to handle beta applications and support requests (article 6(1)(f), our legitimate interest in running and improving Deckster).
• To keep accounting records of purchases where the law requires it (article 6(1)(c), legal obligation).

We never sell your data, and we don't use it for advertising profiles.

Who helps us

These companies process data on our behalf, under data processing agreements:

• Supabase: sign-in. Data is stored in the EU.
• Render: our server and database, in Frankfurt, Germany.
• RevenueCat: checks subscription purchases with the app stores. It knows you only by a Deckster account id.
• Cloudflare: hosts this website.
• Web3Forms: delivers the website's forms to our inbox by email.

Google and Apple handle sign-in and purchases under their own privacy policies. Card images in the app are loaded directly from Scryfall, which sees your device's IP address as with any website.

Some of these companies are based in the United States. Where data leaves the EU/EEA, the transfer is covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

• Your account and collections: until you delete your account. Ending a subscription does not delete anything.
• Database backups: deleted data can remain in backups for up to 30 days, after which the backups expire.
• Server and website logs: up to 30 days.
• Beta applications: until the beta ends, or sooner if you ask us to delete yours.
• Purchase records: as long as Norwegian accounting law requires.

Your rights

You can ask to see, correct, delete or move your data, object to how we use it, or ask us to restrict its use. Much of this you can do yourself in the app:

• Settings → Download all my data gives you everything as one file. Each collection can also be exported as CSV or JSON.
• Settings → Delete account deletes your account and your collections. See Delete your account for the details, and for how to ask without the app.

For anything else, email post@stablegrowth.no. We answer within a month. If you think we handle your data unlawfully, you can complain to the Norwegian Data Protection Authority (Datatilsynet).

Children

Deckster is not meant for children under 13, and you must be at least 13 to create an account.

Changes

When we change this policy, we update the date at the top. If a change matters to how your data is used, we will tell you in the app before it takes effect.