Privacy policy

Last updated: 5 October 2026

1. Who is responsible

Card Box Manager is an Android app and this website. They belong together: your collection lives on your phone and under your account on our server, so that the phone and the website show the same thing. Card Box Manager contains no advertising, no analytics or tracking services and no third-party crash reporting. We do not sell data and do not build profiles.

2. Your account

Accounts are issued by us; none can be created in the app. For your account we store:

• the account name you sign in with,
• your password, only as a bcrypt hash it cannot be recovered from,
• your display name, which others see; it is assigned automatically and you can change it,
• a profile picture, if you choose one,
• the number of failed sign-ins: after eight the account is locked for 15 minutes,
• every device you are signed in with (phone or browser): its name, its kind, a fingerprint of its key, and when it was created and last used. The key itself is not stored. Pairing codes from the website are valid for ten minutes and only once.

This is needed to sign you in and to protect your account (Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for protection against misuse). It is kept until your account is deleted. A browser sign-in ends by itself after 14 days unused.

3. Your collection

So that your phone and the website show the same collection, we store under your account:

• your decks and card locations with name, format, notes, archive state and the box a deck is kept in,
• every card with its printing, language, finish, condition, quantity, section of the deck, state (present, missing, ordered and so on), the place it lies and notes,
• the identifier of an NFC tag you linked to a card location,
• the picture chosen for a deck or card location, and photos you take for it or upload here,
• every earlier state of a collection, so changes can be followed and changes made on the phone and the website at the same time can be merged,
• planned moves, online backups you create yourself, and the identifier of a collection you deleted, so it does not come back from another device.

Notes are free text and are transferred with the rest. Please do not put anything there nobody else should read.

The legal basis is Art. 6(1)(b) GDPR. The data is kept until you delete it or your account is deleted.

4. Recognising cards from a photo

When you photograph a card in the app and start recognition, that one photo is sent to our server and compared with our card data. We keep the last 200 photos with their result to find faults and improve recognition; they are not linked to your account, and older ones are deleted automatically (Art. 6(1)(b) and (f) GDPR). Photos from an analysis we explicitly start are kept until that analysis ends.

"Read name" recognises the card name on your phone itself, through the text recognition of Google Play services. The image does not leave your phone.

5. Sharing decks

When you share a deck by link, we store the link with its label, a code if you set one (readable, so you can look it up), and an expiry date. Anybody with the link sees the deck, its analysis, prices and your notes, but never where a card lies or what state it is in.

Every visit is counted with its time. Recognising a visitor who comes back is done only with their consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG): their browser then gets a random identifier. As the owner you see visitors only as numbers. Consent can be changed on the page at any time.

6. Cookies and browser storage

This website sets only these cookies:

The first three are necessary for the site to work (§ 25(2) no. 2 TDDDG). On a shared deck page your browser also remembers your view settings; they are not transferred.

7. Server logs

Our server logs requests without IP address, without user name and without headers: only the time, the address requested, the result and how long it took. This serves operation and troubleshooting (Art. 6(1)(f) GDPR). The logs are overwritten continuously once they reach a fixed size.

8. Hosting

The server and the database run at netcup GmbH, Karlsruhe, in a data centre in Nuremberg, Germany. netcup processes the data on our behalf under Art. 28 GDPR. Every night we make a backup copy of the accounts and collections on the same server and keep it for 14 days. What you delete is gone from those copies after 14 days at the latest.

9. Other services

• Scryfall (USA). Card data, card pictures and mana symbols come from our server. Only when it cannot be reached, or lacks a picture or symbol, does the app ask Scryfall directly. The card name searched for or a card's identifier and your IP address then go to Scryfall. Scryfall's privacy policy: scryfall.com/docs/privacy
• Cardmarket. Our server downloads a public price list once a day. No data of yours is transferred.
• Google Play. The app is installed and updated through Google Play; Google's privacy policy applies to that.

10. On your phone

The app stores your collection, card pictures, cover photos and settings on your phone. Uninstalling removes them there. Backup files you export are wherever you save them. The app uses the camera (photos, reading names, cover photos), NFC (reading and writing tags) and the internet.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20; you can save your collection as a file in the app and here at any time), objection (Art. 21) and to withdraw consent at any time (Art. 7(3)). You may complain to a data protection supervisory authority (Art. 77).

To have your account deleted, write to leonstue.dev@gmail.com. We then delete your account and everything that belongs to it: collections, their earlier states, backups, photos, share links and devices. This cannot be undone. It is gone from the nightly backup copies after 14 days at the latest.

12. Age

Card Box Manager is not aimed at children under 16.

13. Changes

When what we process changes, we change this policy and the date above.