Privacy statement
Version 2026-10-10 (2)
Deck-house runs Deck House and is responsible for your personal data (“controller” under the GDPR/AVG). Questions or requests: contact@deckhouse.nl.
What we store and why
| Data | Why | Basis |
|---|---|---|
| Username, display name, password (stored only as a salted scrypt hash), when you accepted the terms | your account and sign-in | performing the service |
| Your e-mail address (and whether you confirmed it) | confirming that an account belongs to a real person, one account per person, and contacting you about your account. It is never shown to other members and never used for advertising | legitimate interest (security) and performing the service |
| Warnings for photos that are not cards (date and a fingerprint of the photo, not the photo itself), suspensions and bans | applying the rules in the Terms (section 4) and keeping banned accounts from returning. After a permanent ban a fingerprint of the e-mail address is kept to block it | legitimate interest (security) |
| Optional profile: bio, favourite faction, public/private choice | your profile page and the lobby | your choice (consent) |
| Your collection, decks, wishlist, match results and rating | the features you use | performing the service |
| Card photos you upload, and the result of the card check | showing artwork to you and — if you share them — to other signed-in members | your choice (consent) |
| Reports about images (who reported what) and moderator decisions | keeping the community and its content in order, handling rights complaints | legitimate interest |
| Your IP address, briefly in server memory | limits against abuse and flooding. It is not written to the database and disappears within an hour | legitimate interest (security) |
We do not use advertising, tracking or analytics, and we do not sell data.
Who sees what
- Other members see your display name, rating and, if your profile is public, your bio, favourite faction, match record, wishlist and presence in the lobby. A private profile is not listed or findable. Your collection is shown to other members only if you switch on Share my collection; your decks are never shown. Photos are visible to others only if you share them; the uploader is named only when their profile is public.
- Mistral AI (OCR service, a processor) receives a card photo when you upload it or use “Add by photo”, only to read the text on the card. When a photo is not recognised as a card, the same service may look at it once more to tell a poor photo of a card from something else (including explicit images, which are not allowed). It is sent over an encrypted connection and not used by us for anything else. Without the card check being switched on, no photo leaves the server.
- Mailjet (e-mail service, a processor in France/EU) receives your e-mail address and the text of the confirmation and password reset messages, only to deliver them.
- Hosting provider of the server, as processor.
- Moderators see reported images, who reported them and the uploader’s username.
Cookies and local storage
One functional cookie keeps you signed in (7 days, HTTP-only). Your browser also stores your light/dark choice and the collection view you prefer. There are no tracking cookies, so no cookie banner is needed.
How long
Your data is kept while your account exists. When you delete your account, your profile, collection, decks, wishlist, photos, reports and sign-in are deleted; finished matches stay without any link to you. Backups are overwritten within 14 days.
Your rights
You can look at, correct, download and delete your data yourself on your profile page (“Your data”). You can also object to processing or ask for restriction by writing to contact@deckhouse.nl. If you are not satisfied, you may complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Security
Passwords are hashed, sign-in sessions are signed, connections are encrypted when the site runs over HTTPS, and the server limits sign-up and sign-in attempts. This is an alpha: do not reuse an important password.
Deck House is an unofficial fan project. It is not affiliated with, endorsed or sponsored by Hasbro, Wizards of the Coast or any other rights holder.