Privacy policy

Spellseeker helps you search Magic: The Gathering cards, build decks, explore Commander recommendations and play paper Magic online. This policy explains what information is handled when you use spellseeker.app, and what stays on your device.

Summary

• Accounts are optional for public card search, Commander recommendations and guest deck building.
• Guest decks and preferences are saved in your browser. Signing in enables a private account workspace.
• Discord and our authentication provider process optional sign-in. We receive the identity information and email made available through that authorization.
• Search statistics count card lookups using a short-lived browser identifier, without attaching the counts to your Spellseeker account.
• Online play uses camera and microphone permissions. Live media is shared with people in your room; the service does not record your live video as part of ordinary play.
• Card recognition runs in your browser. Optional recognition feedback can upload a card crop and diagnostics when you submit it.

Information we handle

Optional Discord account

If you choose “Sign in with Discord,” Discord and Supabase process authentication. We request basic identity and email access. Account information can include your account identifier, display name, avatar URL and email when provided. Authentication cookies maintain your session. We do not receive your Discord password.

Saved decks and workspace

Your workspace can contain deck names, descriptions, card lists, card printings, tags, primers, collection and wishlist entries, and preferences. Guest drafts are stored on the browser where you created them. When you sign in, guest drafts can be merged into your account workspace and saved through Supabase. Private workspaces require account authorization; decks you make public can be viewed by other people.

Imported decks and files are processed to build your workspace. Import only information you have the right to use. Exported files are saved where you choose; you control any further sharing of those files.

Card search and recommendations

Search terms, filters and requested card identifiers are sent to the service to retrieve results. Commander recommendations use the selected commander, plan and card criteria. URLs can contain your search or commander selection, so sharing a URL shares those parameters.

To count card searches and limit duplicate or excessive events, we use a browser cookie named spellseeker_search_session that expires after one day. Search event records contain a card identifier, event identifier, date, time bucket and a daily one-way hash of the browser identifier. Event records older than the current and previous day are removed when new events are recorded. Per-card daily totals are retained separately. These statistics do not contain your deck lists, email or account identity.

Preferences on your device

Local storage keeps guest decks and supported preferences. Session storage can keep active-room recovery information. Browser storage remains until it expires, you clear site data, or the relevant application action removes it. Clearing site data can remove guest decks, so export information you want to keep first.

Online play

Play Magic uses the Snapcast game components. A display name and game settings are shared with other people in your room. The game system can use a pseudonymous guest authentication identifier to authorize room access without creating a public profile.

Camera, microphone and signaling

Players grant camera and microphone access in the browser. Audio and video are sent over encrypted WebRTC connections to room participants, directly when possible or through a TURN relay when needed. A relay carries media temporarily; it is not a recording store. Room membership, life totals, chat, turns and similar game state use the game’s signaling service. Other participants can see and hear what you share.

Card scanning can request a still from a participant’s camera for recognition. The scan request is visible to that participant. Recognition runs locally, and card artwork can load from Scryfall’s image hosts. Strong recognition results may be shared temporarily within the room to improve repeated lookups.

Recognition feedback and diagnostics

Submitting “Wrong card” or similar feedback can send a cropped still, recognition diagnostics and related game context to the game service. This is separate from ordinary live media. The game components can also record limited connection events and content-free lookup timing metrics to investigate failures and slow scans. These automatic diagnostics exclude camera and microphone content; optional recognition reports can include images.

Public room details are visible through game discovery. Game features can retain participant and result records where supported. For more detail about the underlying game components, see Snapcast’s privacy policy.

Service providers and third parties

Cloudflare provides hosting and search-statistics infrastructure. Supabase supports accounts, workspace storage and game services; Discord supports sign-in. Card data and artwork come from Scryfall and Wizards of the Coast. These providers may process technical information such as IP addresses and browser requests under their own policies. Visiting card retailers or other external links is governed by those services’ policies.

What we do not do

• We do not sell your personal information.
• We do not run third-party advertising trackers in the app.
• We do not require an account for public search or guest deck building.
• We do not automatically upload live game video as training data.

Children

Spellseeker is intended for Magic players generally and is not directed at children under 13. We do not knowingly collect personal information from children under 13. Use of the service is subject to the eligibility requirements in our terms of service.

Retention and your choices

Account workspaces remain saved while needed to provide the service. Operational records, feedback and diagnostics may be retained for service improvement, security and legal obligations. Local preferences remain until removed from your device. Temporary room state and short-lived search event records follow their respective expiration and cleanup behavior described above.

• Use public tools and guest drafts without signing in.
• Export your decks and remove entries using the available workspace controls.
• Clear local site data using browser settings.
• Deny camera or microphone permission, or leave a game to stop sharing media.
• Skip optional recognition feedback.
• Contact the operators to request access, correction or deletion of account information.

Changes

We may update this policy as Spellseeker evolves. We will change the “Last updated” date when we do.

Contact

Questions about privacy can be raised through the Spellseeker GitHub repository. Do not include private account information, credentials or sensitive data in a public issue.