MTGBuilder

Privacy Policy

Effective: 1 July 2025

1. Data Controller

The data controller responsible for your personal data is MTGBuilder. If you have any questions about this privacy policy or how your data is handled, please contact us at [email protected].

2. Categories of Personal Data Collected

We collect and process the following categories of personal data:

  • Email address — provided via Google Sign-In for account identification and communication.
  • Display name — provided via Google Sign-In for personalisation within the app.
  • Card collection data — records of Magic: The Gathering cards you add to your digital library.
  • Deck data — deck lists you create, import, or manage within the app.

3. Legal Basis for Processing

We process your personal data under the following legal bases as defined by the General Data Protection Regulation (GDPR):

  • Consent — you provide explicit consent when signing into the app via Google Sign-In and when opting in to personalised advertising.
  • Legitimate interest — we process data necessary to provide and improve the core service, including syncing your collection across devices, delivering push notifications you have subscribed to, and collecting crash diagnostics to maintain app stability.

4. Firebase Authentication (Google Sign-In)

MTGBuilder uses Firebase Authentication with Google Sign-In to manage user accounts. When you sign in, the following data is collected from your Google account:

  • Email address
  • Display name
  • Profile photo URL
  • Unique user identifier (UID)

This data is used solely for authentication purposes and to personalise your experience within the app. Firebase Authentication is provided by Google LLC and is subject to Google's privacy policy.

5. Google AdMob (Advertising)

MTGBuilder displays advertisements via Google AdMob to users on the free tier. AdMob may collect the following data:

  • Advertising identifiers (e.g., Google Advertising ID)
  • Device information (model, OS version, screen size)
  • IP address (for approximate location-based ad targeting)
  • App interaction data for ad relevance

Personalised ads are shown by default. You may opt out of personalised advertising through your device settings (Settings > Google > Ads > Opt out of Ads Personalisation). When personalised ads are disabled, you will still see advertisements, but they will not be tailored to your interests.

6. Firebase Crashlytics (Crash Reporting)

We use Firebase Crashlytics to collect crash reports and diagnostic data to maintain and improve app stability. Crashlytics may collect:

  • Crash reports and stack traces
  • Device information (model, OS version, orientation, RAM, disk space)
  • App state at the time of the crash
  • Crashlytics installation UUID (a unique identifier for the app installation)

This data is used exclusively for identifying and resolving software defects. No personal content (such as card collection or deck data) is included in crash reports.

7. Firebase Cloud Messaging (Push Notifications)

MTGBuilder uses Firebase Cloud Messaging (FCM) to deliver push notifications. When you install the app, a unique device registration token is generated and stored. This token is used to:

  • Send notifications about new deck suggestions
  • Inform you of app updates or service announcements
  • Deliver account-related notifications

You can disable push notifications at any time through your device notification settings. The registration token is refreshed periodically by Firebase and does not contain personally identifiable information.

8. On-Device ML Kit (Card Scanning)

MTGBuilder uses Google ML Kit for on-device card recognition. When you scan a Magic: The Gathering card with your camera:

  • All image processing and text recognition happens entirely on your device.
  • No image data is transmitted to external servers for recognition purposes.
  • No photographs of your cards are stored, uploaded, or shared.

The camera is used solely to identify card names via on-device text recognition. Once a card is identified, only the card's metadata (name, set, and collector number) is saved to your collection.

9. Scryfall API (Card Data)

MTGBuilder retrieves card information (names, images, oracle text, pricing, legality) from the Scryfall API, a publicly available Magic: The Gathering card database.

  • No personal data is shared with Scryfall.
  • API requests contain only card identifiers or search queries — never user accounts, email addresses, or collection data.
  • Scryfall is an independent third-party service not affiliated with MTGBuilder.

10. Data Storage and Retention

Your data is stored using Firebase Firestore, a cloud database service provided by Google. MTGBuilder operates on an offline-first architecture with cloud synchronisation:

  • Your card collection and deck data are stored locally on your device for offline access.
  • When an internet connection is available, data is synchronised to Firebase Firestore for backup and multi-device access.

Retention Period

Your data is retained for as long as your account remains active. If you delete your account:

  • Your data will be permanently removed from our active systems.
  • Backup copies will be purged within a maximum of 30 days after account deletion.

11. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

  • Right of access — you may request a copy of all personal data we hold about you.
  • Right to rectification — you may request correction of inaccurate or incomplete data.
  • Right to erasure — you may request deletion of your personal data ("right to be forgotten").
  • Right to restriction of processing — you may request that we limit how we process your data.
  • Right to data portability — you may request your data in a structured, machine-readable format for transfer to another service.
  • Right to object — you may object to processing based on legitimate interest, including profiling for advertising purposes.

12. Exercising Your Rights

To exercise any of the rights described above, please contact us at [email protected]. We will respond to your request within 30 days as required by GDPR. You may also delete your account directly within the app under Settings > Account > Delete Account.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO).

13. International Data Transfers

Your data is stored and processed on Firebase infrastructure located in us-east1, United States. As your data may be transferred outside the European Economic Area (EEA), we rely on the following safeguards:

  • Google LLC participates in the EU-US Data Privacy Framework, which has been recognised by the European Commission as providing adequate data protection.
  • Google's data processing terms include Standard Contractual Clauses (SCCs) as an additional transfer mechanism.

These safeguards ensure your data receives an equivalent level of protection as it would within the EEA.

14. Google Play Billing (Subscription Data)

MTGBuilder offers a premium subscription tier at £3 per month, processed entirely through Google Play Billing. When you subscribe:

  • Payment is processed by Google — MTGBuilder does not collect, store, or have access to your payment card details.
  • We receive confirmation of your subscription status (active, cancelled, or expired) from Google Play to manage premium feature access.
  • Subscription management (cancellation, payment method changes) is handled through the Google Play Store.

15. Cookies and Similar Technologies

The MTGBuilder website (furious-angels.net) does not use cookies or tracking technologies. The MTGBuilder Android app uses the following local storage technologies:

  • SharedPreferences / DataStore — stores app preferences and settings locally on your device.
  • SQLite (Room database) — stores your card collection and deck data locally for offline access.
  • Firebase local cache — enables offline-first data access and synchronisation.

None of these technologies are used for cross-site tracking or third-party advertising purposes beyond what is described in the Google AdMob section above.

16. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:

  • The "Effective" date at the top of this page will be updated.
  • For significant changes, we will notify you via push notification or in-app message.
  • Continued use of the app after changes are posted constitutes acceptance of the updated policy.

We encourage you to review this policy periodically to stay informed about how your data is protected.

17. Children's Privacy

MTGBuilder is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected] and we will take steps to delete such information promptly.

If we become aware that we have collected personal data from a child under 16 without verification of parental consent, we will delete that data as soon as reasonably possible.