Privacy Policy

1. Data controller

The data controller for deckaugur.com is the individual operating this website, based in Belgium. For questions or requests regarding your personal data, use the feedback form inside the application (sign in and open the user menu).

2. Analytics

Cloudflare Web Analytics

This website uses Cloudflare Web Analytics to understand how visitors use the site. It is privacy-first by design:

• No cookies are set on your device.
• No persistent identifiers or fingerprints are created.
• IP addresses are used only to determine approximate country and are not stored by Cloudflare Web Analytics.
• Data is collected in aggregate form: page views, referrer domain, browser family, operating system, and country.
• No individual user sessions are tracked across pages or visits.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR). The processing is limited to aggregated, non-identifiable statistics used solely to understand which pages are visited and to improve the service. This interest is not overridden by your privacy rights given that no personal profile is built and no cookies are used.

Data processor: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare processes data under Standard Contractual Clauses (SCCs) approved by the European Commission, providing an adequate level of protection for transfers outside the EEA. See Cloudflare's privacy policy for full details.

Retention: Cloudflare Web Analytics retains aggregated statistics for 90 days.

PostHog (product analytics)

The website and the application can also use PostHog to see which pages and features are used, for example how many decks are saved or imported. PostHog is a third-party service, so it only loads after you explicitly accept the cookie banner shown on your first visit. If you decline, or make no choice, it never loads and sends nothing. Even once accepted, PostHog runs in memory only: no cookies or local storage of its own are written, and visits are not linked to one another. Session recording is disabled at the account level, and automatic click tracking is off.

Events sent, once accepted: page views; sign-ups, sign-ins, and sign-outs; deck saves and imports; collection imports, card additions, and collection transactions; community deck copies; and feedback submissions. Some events include a count, such as how many cards an import had or the quantity of a transaction. Decklists, card names, and account details, including your email address, are not sent. Data is hosted in the EU (eu.i.posthog.com).

Legal basis: Consent (Article 6(1)(a) GDPR), given through the cookie banner before any data is sent. See section 5 for how that choice is stored and how to change it at any time. Data processor: PostHog, Inc., a US company. Transfers outside the EEA are covered by standard contractual clauses. See PostHog's privacy policy for full details.

3. Account data

If you create an account, the following is stored in our database (hosted on Supabase, Frankfurt region, EU):

• Email address, used for authentication only.
• Username and display name, chosen by you, visible on your public profile.
• Decks and collection data you enter.
• Points and activity history within the application.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR). Account data is necessary to provide the service you signed up for.

Data processor: Supabase, Inc. Data is stored in the eu-central-1 region (Frankfurt, Germany) and does not leave the EEA for storage purposes. See Supabase's privacy policy.

Retention: Account data is retained for as long as your account is active. You may request deletion at any time.

4. Feedback messages

If you submit feedback through the application, the message and the page you were on are stored in our database. This is used solely to improve the service and is only visible to the site administrator. Legal basis: legitimate interests (Article 6(1)(f) GDPR).

5. Cookies and local storage

Deckaugur does not use advertising cookies or third-party tracking cookies of any kind. Two things are stored on your device, both listed here in full:

• deckaugur_cookie_consent (local storage): remembers whether you accepted or declined PostHog. Strictly necessary to avoid asking you on every visit, so it is not itself subject to consent. Not set until you make a choice, and kept until you change it. Change it any time via the "Cookie preferences" link in the site footer, or the same item in the app's menu.
• Authentication session (local storage, Supabase's default): keeps you signed in. Strictly necessary for your account to function, and is not transmitted to any third party beyond Supabase itself (see section 3).

PostHog (section 2) writes no cookie or local storage of its own, even once accepted: it runs in memory only and forgets everything on reload. Cloudflare Web Analytics (section 2) remains cookie-free by design, unconditionally.

6. No data sales or advertising

Your data is never sold, rented, or shared with advertisers. Deckaugur contains no advertising and is not connected to any advertising network.

7. Your rights under GDPR

As a resident of the EEA, you have the following rights:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate data.
• Right to erasure: request deletion of your account and associated data.
• Right to restriction: request that we limit processing of your data.
• Right to object: object to processing based on legitimate interests.
• Right to data portability: receive your data in a structured, machine-readable format.

To exercise any of these rights, use the feedback form inside the application or contact us through your account. We will respond within 30 days.

You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit): gegevensbeschermingsautoriteit.be.

8. Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date at the top. Continued use of the service after changes are posted constitutes acceptance of the revised policy.