Privacy notice

Last updated 10 October 2026

MTG Card Collector is a free fan site run by Edward Billington. This notice explains what it keeps about you, why, and how to delete it.

The short version: it keeps your name, your email address and your collection, uses them only to run your shelf, and deletes all of it when you ask.

What it keeps

• From Google, when you sign in: your name, your email address, and the id Google gives your account. It asks Google for nothing else, and never sees your Google password.
• Your collection: the binders, decks and cards you add, the log of the changes you make, and your colour settings.
• A sign-in cookie, so you stay signed in. It holds a random code, and the site stores only a scrambled (hashed) copy of it. It lasts until you sign out, or 30 days after you last used the site. While you’re signing in, a second cookie lasts 10 minutes, to check that Google’s reply is for your browser. There are no other cookies: no analytics, no advertising and no tracking.
• In your browser only: your colours and the page each binder was last open at, so pages look right straight away. These stay on your device.
• Server logs: like any website, the server notes each request it handles and the internet (IP) address it came from, to keep the site running and to fix problems.

What it’s used for

Only to run your shelf: to sign you in, and to show you your collection and keep it up to date. It isn’t sold, shared with anyone, or used for advertising. In data protection terms, it’s used because it’s needed to provide the service you sign up for, and the logs because there’s a legitimate interest in keeping the site working.

Who can see it

Your shelf is private: nobody else who uses the site can see it. Edward, who runs the site, can see the database, and only looks at it to keep the site working.

Other services involved

• Google signs you in. What Google does is covered by Google’s privacy policy.
• Google Fonts supplies the site’s fonts, so your browser fetches them from Google, which sees your IP address.
• Scryfall supplies the card data, images and prices. When you search for a card to add, the site asks Scryfall itself, without anything that identifies you. Most card images come from this site, but some pictures (the art on your decks, set and mana symbols, and cards you’re picking from Scryfall) load straight from Scryfall’s servers, which see your IP address.

How long it’s kept

Until you delete your account. Accounts aren’t deleted automatically. Sign-in cookies end 30 days after you last use the site.

Deleting your account

On your shelf, select your name at the top, then Delete my account. Your account and everything in it are deleted from the database straight away: your binders, decks and cards, the change log, your settings and your Google sign-in. The space they took up is overwritten. Backups of the database made before then keep a copy until they’re replaced by newer ones.

From the same place you can download your whole collection as a spreadsheet (CSV) first.

Your rights

You can ask to see the data held about you, to have it corrected or deleted, or object to how it’s used. Email [email protected]. If you’re not happy with the answer, you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes

If this notice changes, the date at the top changes with it.