Privacy Policy
This policy explains what personal data ManaCollector handles, why, who it is shared with and what you can do about it. ManaCollector is made by Bjurhager ("we", "us"), who decides how your data is used. You can reach us at [email protected].
The short version
- You can use the app without an account. Then your collection stays on your device and we do not receive it.
- If you create a Global Account we store your email, a scrambled (hashed) version of your password and what you choose to save to the cloud.
- We do not sell your data and we do not use it for our own advertising or profiling.
- You can delete your account and its cloud data at any time, in the app or on this page.
What we collect and why
Without an account
Your collection, lists and settings are stored on your device only. The app downloads card data and prices from our servers. Like any server, ours (hosted by Cloudflare) see your IP address and basic technical information about the request, which is needed to deliver the data and to keep the service secure.
With a Global Account
One account works across our apps and websites. We store, for as long as the account exists:
- your email address, an optional username, and your password as a salted hash (we cannot read your password);
- your sessions: a hashed sign-in token, when it was created and when it expires;
- short-lived tokens for email verification and password reset (hashed), and a pending registration (email and hashed password) for up to 24 hours until you confirm your email;
- your access for each app: your plan (Plus or Premium) and when it ends.
This is needed to provide the account, to sign you in and to give you the access you have paid for.
Cloud Sync and website
With Plus or Premium you can sync your collection between your devices and the website. We then store the data you put in ManaCollector: your lists, folders, the cards and quantities in them, notes, finish, language and condition, and your app settings.
Safety copy
To avoid losing your data, the app saves one copy of the data on your device to our servers when you first sign in and each time you sign out. This works for every account, also without a subscription, and is only used to restore your data (for example on a new phone). It is not shown on the website and is replaced each time. The app also keeps a copy on the device when another account is signed in, so you get your data back when you sign in again.
Subscriptions
Purchases are handled by Apple or Google. We never see your payment card. To unlock your plan on the website and for Cloud Sync, the app sends us the proof of your purchase (the store transaction). We store the store, the transaction and product identifiers, and the status and end date. We also receive notifications from Apple and Google about renewals, cancellations and refunds so your access follows your subscription.
Ads
Without a subscription the app shows ads served by Google AdMob. Google may collect device identifiers (such as the advertising ID), your IP address and how you interact with ads, to show and measure ads and to prevent fraud. Plus and Premium remove ads. You can limit ad personalisation in your device settings (on Android: Settings, Google, Ads; on iOS: Settings, Privacy & Security, Tracking). See Google's ads policy.
On this website
We do not use advertising or tracking cookies. The website stores the following in your browser so it works: your sign-in tokens, a local copy of your collection for signed-in users, your display preferences and cached card images and data. You can clear this in your browser settings or by signing out.
Emails
We send emails only to verify your address and to reset your password.
Who we share data with
We use these service providers to run ManaCollector. They process data on our behalf, or in the case of the stores and Google Ads under their own policies:
- Cloudflare: hosting, database and file storage for the website, the accounts, your cloud data and the card data.
- Resend: sends the verification and password reset emails.
- Apple App Store and Google Play: purchases and subscriptions.
- Google AdMob: ads in the app (see above).
- Scryfall (cards.scryfall.io): card images are loaded directly from this provider, which therefore sees your IP address when images are shown.
These providers may process data outside the EU/EEA. They rely on safeguards such as the EU Standard Contractual Clauses. We do not sell your personal data and do not share it for anyone else's marketing.
How long we keep it
- Account and cloud data: until you delete your account. Deleting it removes your account, sessions, cloud data, safety copy, plan and linked purchases from our systems right away.
- Database backups kept by Cloudflare for recovery may still contain the data for up to 30 days after deletion, after which it is gone.
- Records of store notifications (without your name or email) are kept for 30 days for troubleshooting.
- Data that only exists on your device stays there until you delete it or uninstall the app.
Deleting your account does not cancel a subscription. Cancel it in the App Store or Google Play, otherwise it keeps renewing.
Your rights and choices
Under the GDPR and similar laws you can ask us for access to your data, to correct it, to delete it, to receive a copy, to restrict or object to how we use it, and to withdraw consent you have given (for example for ads) at any time.
- Delete: in the app under Cloud Sync, Manage account, Delete account, in Manage account on the website, or at /delete-account without the app.
- Change: you can change your username and password in Manage account.
- Copy: you can export your lists from the website.
- Anything else: email [email protected]. If you are not happy with our answer you can complain to your local data protection authority.
Our legal bases are: providing the service you asked for (account, sync, subscription), our legitimate interest in keeping the service secure and working, a legal obligation where one applies, and your consent for personalised ads where the law requires it.
Security
Passwords are stored as salted hashes, connections use HTTPS, and sign-in tokens are short-lived. No system is perfectly secure, but we limit what we store and who can access it.
Children
ManaCollector is not directed at children under 13 (or the higher age limit in your country). We do not knowingly collect their data. If you think a child has given us data, contact us and we will delete it.
Changes
If we change how we handle data we will update this page and the date at the top. For significant changes we will also tell you in the app or by email.
Contact
Bjurhager · [email protected]