Privacy Policy
Protecting your data matters to us. This policy describes which personal data is processed on cedh.at (“MTG Commander Analytics”), for what purpose and on which legal basis (General Data Protection Regulation, GDPR, and the Austrian Data Protection Act, DSG).
This is a courtesy translation. In case of discrepancies, the German version prevails.
1. Controller
Stefan Grasmann, 5020 Salzburg, Austria – hsf.salzburg@gmail.com. See also the Legal Notice.
2. Hosting and server logs
The site runs on a virtual server operated by netcup GmbH (Karlsruhe, Germany, data centres in the EU). When you access the site, the web server automatically processes technical access data (IP address, time, requested address, amount of data transferred, browser identifier, referrer). These access logs serve the secure and stable operation of the site and troubleshooting; they are rotated automatically (size-limited, at most a few weeks) and are not combined with other data. Legal basis: legitimate interest in secure operation (Art. 6(1)(f) GDPR). The connection is encrypted using TLS.
3. Cookies
We only set one strictly necessary session cookie for login (encrypted, valid for 12 hours, deleted on logout). There are no tracking, analytics or advertising cookies and no audience measurement; for that reason we do not show a cookie banner. In addition, your browser stores locally (sessionStorage/localStorage, never sent to us) the last page you visited so you can return to it after logging in, display preferences of the deck editor and the state of the deck tester. The Game Tracker also stores running and – without an account – finished games, the player names used most recently and a copy of your playgroup data there for offline use; a service worker keeps the app’s files available offline (see section 6).
4. User account
For the logged-in area you create an account with a username and password (registration with an invitation code). For the Game Tracker you can also create an account without an invitation code (“tracker account”); it gives access to the tracker only (playgroups, shared game history), not to the other areas. We store the username, the password as a hash (bcrypt, never in plain text), your role (user, moderator, administrator or tracker account) and the creation time. Optionally you may add a display name, an e-mail address (shown only in your own menu; we neither send mail nor use it for login), pronouns, a short “About me” text and a profile picture (avatar) in your account settings, and link your account to your TopDeck player profile (your profile then shows your tournament statistics). Display name and avatar appear next to your contributions (blog, feedback, comments); the avatar can also be retrieved without login via a non-guessable address because it is shown next to posts on the public blog. Legal basis: performance of a contract / use of the service (Art. 6(1)(b) GDPR); for the optional details, your consent given by entering them (Art. 6(1)(a) GDPR, revocable at any time by deleting the entry). The account is deleted on request (see section 11); this also deletes your decks, tickets and comments. Game Tracker games in which you took part in a playgroup remain available to the other members – on request, your name in them is replaced with a pseudonym. What happens to playgroups you created (they also contain other members’ games) is agreed with you before the deletion.
5. Content you post
- Your decks: Deck lists you create or import from Moxfield/Archidekt are visible only to you by default. When importing, our server fetches the deck URL you provide from the respective provider; the provider sees our server’s IP address, not yours.
- Shared decks: If you share a deck via “Share”, we generate a non-guessable link. Anyone with the link sees a preview without logging in (deck name, commanders, card count, your username) and the full list after logging in. You can revoke the share at any time; the link stops working immediately.
- Feedback tickets and comments: Title, text, uploaded screenshots and comments are visible to all logged-in users together with your username or display name and the date. Please do not upload screenshots containing personal data of third parties.
- Blog posts are written by administrators and moderators only and are public (showing the author’s display name and avatar).
Legal basis: use of the service (Art. 6(1)(b) GDPR).
6. Game Tracker
The Game Tracker keeps track of life, commander damage, poison, turns and playing time in Commander games. It can be used in two ways:
- Without an account: The game (player names, chosen commanders, life and damage history, result, “Player Awards” handed out) is stored only locally in your browser (localStorage) and is not transmitted to us. The device also remembers the player names used most recently. Our server is only contacted for the commander search, commander images and award card images; this produces nothing but the server logs described in section 2. You delete this data in the tracker (“Delete game”) or by clearing your browser data. There is no backup – clearing your browser data loses it.
- With an account in a playgroup: Games are assigned to a playgroup and stored by us: name and members of the playgroup, invitations and invitation links (valid for 14 days), and for each game the date, duration, participants, seating order, commanders or decks played, the complete event log (changes to life and damage, turns, pauses), result, eliminations, the optional “happy/salty” rating as well as Player Awards and tracked ongoing effects. If one of your own decks is linked, its card list is stored as it was played. A running game is additionally kept as an interim state so that another device can take over (deleted when the game ends, at the latest after 7 days). This data and the statistics derived from it (rankings, win chances) are visible only to the members of the playgroup; they are not public. Games that were first stored only locally are transmitted only when you explicitly add them to a playgroup.
- Players without an account (guests): Whoever enters other players as guests stores their names (a first name or nickname is fine) together with the game results in the playgroup. Please only enter others with their consent. The owner of the playgroup can remove guests; if you no longer want to appear as a guest, you can also contact us directly (hsf.salzburg@gmail.com) – we will then replace the name with a pseudonym in existing games as well.
Legal basis: for account holders, use of the service (Art. 6(1)(b) GDPR); for the names and results of guests, the playgroup’s legitimate interest in a shared game history (Art. 6(1)(f) GDPR), to which you may object at any time. Local storage without an account is technically necessary for the function you request (§ 165(3) Austrian Telecommunications Act 2021).
7. Third-party tournament data (TopDeck.gg)
The core of the site consists of analyses of publicly available tournament results which we obtain through the official API of TopDeck.gg and – for older tournaments whose deck lists the API does not provide – from the public deck pages on topdeck.gg. This includes player names or display names, TopDeck player IDs, standings, results of individual games, commanders played and deck lists as well as event location and date. From this we compute statistics (e.g. player profiles and ratings) which are shown to logged-in users. The data subjects published this data themselves on TopDeck.gg or consented to its publication when taking part in the tournament; we process it on the basis of our legitimate interest in the sporting and statistical analysis of the format (Art. 6(1)(f) GDPR) and do not pass it on to third parties.
Objection: If you are a player and do not want to appear in our analyses, write to hsf.salzburg@gmail.com (stating your TopDeck name or profile). We will promptly remove or pseudonymise your entries and exclude them from future imports. We cannot change the data on TopDeck.gg itself.
8. External services
- TopDeck.gg: Tournament data and dates are fetched server-side. On the public home page and on the tournament map, preview images of upcoming tournaments are loaded directly from the image services TopDeck uses (imagedelivery.net, Cloudflare, and in a few cases firebasestorage.googleapis.com, Google), which therefore receive your IP address. Tournament links lead to topdeck.gg.
- OpenStreetMap: The tournament map (logged-in area) loads its map tiles directly from tile.openstreetmap.org (OpenStreetMap Foundation, UK), which receives your IP address and the map section shown.
- Scryfall: Card data and images (including the artwork crops behind commander names) are fetched by our server, cached and served by us – your browser does not contact Scryfall.
- Moxfield / Archidekt: only if you import a deck URL yourself (see section 5).
We use no external fonts, no social media plug-ins and no analytics services.
9. Recipients and transfers to third countries
Data is neither sold nor passed on to third parties, except to the hosting provider as a processor (EU) and the requests described in section 8. When tournament images are loaded via Cloudflare or Google, processing outside the EU cannot be ruled out (both are certified under the EU-US Data Privacy Framework); the OpenStreetMap Foundation is based in the United Kingdom (EU adequacy decision).
10. Retention
Account data is kept until the account is deleted; your own content until you delete it or the account is deleted. Playgroup games are kept until they or the playgroup are deleted; interim states of running games for at most 7 days. Games stored locally in your browser (without an account) stay only on your device until you delete them; the tracker keeps at most the last 30 there. Tournament data is stored permanently for historical analysis (or until an objection, section 7). Server logs are rotated automatically. Daily database backups are retained on the server for 14 days; an encrypted copy is additionally kept by the controller (protection against data loss) and deleted on the same schedule.
11. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). Simply write to hsf.salzburg@gmail.com. If you believe that the processing violates data protection law, you may lodge a complaint with the Austrian Data Protection Authority.
12. Data security
TLS encryption, passwords stored only as bcrypt hashes, access to the analyses by invitation only (tracker accounts see nothing but the tracker and their own playgroups), rate limits on login and registration attempts, regular security updates of the server.
13. Changes
This policy will be updated when the site or the legal situation changes. The version published here applies.
Last updated: 10 October 2026