Privacy Policy
Last updated: July 12, 2026
What We Collect
ScrollVault does not require user accounts or passwords. We do set cookies — our analytics and session-recording tools need them, and some of those cookies belong to Microsoft. They are itemised in Cookies below. Here is everything we collect:
| Data | Purpose | Stored Where | Retention |
|---|---|---|---|
| IP address, browser type, pages visited | Server security and abuse prevention | Hosting provider logs | 30 days |
| IP address (hashed) | Rate limiting on deck saves (max 10/hour) | Temporary server files | 1 hour |
| Page views, clicks, scroll depth | Anonymous site analytics | Google Analytics 4 | 14 months (Google default) |
| Session recordings (mouse movement, clicks, page interactions) | UX improvement and bug detection | Microsoft Clarity | 30 days (Clarity default) |
| Decklists, commander names, bracket results | Gallery feature (user-initiated save only) | SQLite database on our server | Until deleted by user or us |
| Anonymous deck list (cards only) | Spotting trends and improving the tools | Deck data | Kept anonymously |
| Edit keys for saved decks | Allow deck owners to edit/delete without an account | Your browser (localStorage) | Until you clear browser data |
| UI preferences (panel collapse state) | Remember your layout choices | Your browser (localStorage) | Until you clear browser data |
| Email address (newsletter) | Send occasional updates about banlist/bracket changes and new tools — only if you opt in via the signup form and confirm by email (double opt-in) | SQLite database on our server | Until you unsubscribe |
We only collect an email address if you voluntarily subscribe to our newsletter, and only after you confirm it (double opt-in). You can unsubscribe at any time using the link in every email. We do not collect names or payment information, and we do not sell your personal data.
Third-Party Services
When you use our tools, data is sent to these external services:
- Google Analytics 4 — anonymous page view and engagement analytics. Google Privacy Policy.
- Microsoft Clarity — session recording and heatmap analysis. Clarity records mouse movements, clicks, scrolls, and page content (including text you type into tool inputs) to help us identify usability issues. No personally identifiable information is collected. Clarity Privacy Disclosure.
- Scryfall API — when you analyze a deck, card names are sent to Scryfall to retrieve card data. Scryfall may log your IP address per their privacy policy.
- Commander Spellbook API — card names are sent to check for known combos. Commander Spellbook may log your IP address.
- Google Fonts — typefaces are loaded from Google servers. Google may collect anonymous usage data.
- TCGplayer — some card links on our tools and articles are affiliate links. If you follow one, TCGplayer knows the visit came from us and may set its own cookies. See Advertising and Affiliate Links.
Cookies
Today, the cookies we set are for analytics and session recording, and nothing else. Microsoft Clarity, which we use for session recording, is capable of setting Microsoft advertising identifiers, and we have explicitly turned that off — that stays off even once advertising is running, because Clarity is a session-recording tool for us and not one of our advertising partners. Advertising cookies are covered separately in Advertising and Affiliate Links.
That leaves four cookies. This is the complete list after a normal visit:
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
_ga, _ga_1CV3DS33WK | Google Analytics (first-party) | Distinguish visitors and sessions for anonymous traffic statistics | up to 400 days |
_clck, _clsk | Microsoft Clarity (first-party) | Link your page views into one session recording | 1–365 days |
Visitors in the EEA, the UK and Switzerland are asked first, and nothing above is set until you accept — if you decline, or simply ignore the banner, we store nothing at all. Everywhere else these cookies are on by default and you can switch them off at any time with the Cookie settings link in the footer of every page.
You can also refuse them by blocking third-party cookies, using a tracker-blocking extension, or using the opt-outs listed in Your Rights. Blocking every cookie on this list does not break any tool on ScrollVault — the calculators run entirely in your browser.
Advertising and Affiliate Links
We are in the process of adding third-party advertising to ScrollVault, through Mediavine. As of 1 August 2026 Mediavine's script is present on our pages but no advertising is being served and no advertising cookies are being set — we have verified this. We are naming the partner here in advance rather than after the fact, because an earlier version of this policy promised we would.
When advertising does go live, Mediavine and the advertising partners they work with may set cookies and similar identifiers, and may process personal data to select and measure ads. At that point:
- Visitors in the EEA, the UK and Switzerland will be asked through Mediavine's Consent Management Platform, which is registered with the IAB Europe Transparency & Consent Framework. No advertising cookie is set before you answer it.
- Visitors in US states with opt-out rights will be able to exercise them through the same control, which supports the IAB Global Privacy Platform, and through the Cookie settings link in our footer.
- This section will be updated again to describe what is actually running, including where to find the current list of advertising vendors.
Advertising will not change how any of our tools work, and we will not put advertising between you and a result you asked for.
We do use affiliate links. Card and deck links pointing to TCGplayer carry an affiliate tag: if you buy something after following one, we earn a commission at no extra cost to you. It never changes the price you pay, and it never changes a tool's output — the bracket calculator, mana base calculator, and every other tool return the same result whether or not a card happens to be purchasable. Affiliate links are marked rel="sponsored" in the page source.
How We Use Deck Data
When you analyze a deck, we keep an anonymous copy of the card list — just the cards, never anything that identifies you (no name, IP, account, or login). We use it to spot trends and make the tools better, like which cards are popular for a commander or how decks land across brackets. We never publish your deck, never tie it to you, and never try to work out whose it is. This includes decks already saved to the gallery.
The Discord Bot
Our Discord bot answers /bracket and lets you log games you have played with /log. If you never run a command, we hold nothing about you at all.
When you do use it, here is exactly what is stored and what is not:
- We do not store your Discord ID. We store a one-way keyed hash of it. That hash lets us keep your own history together and lets you delete it, but it is not a Discord ID and cannot be turned back into your profile, name, or avatar by anyone reading our database.
- What a logged game records: which deck (the deck link you analyzed), whether you won, the turn the game ended, and how many players were at the table. That is all.
- We never record your Discord name, avatar, message content, who else was in your pod, or your location. The bot reads only the command you type.
- The server a command was used in is also stored as a one-way hash, so we can see which servers are active without identifying them to anyone reading the data.
You can see and delete everything, yourself, at any time. Run /mygames to see exactly what we hold on you, and /forgetme to permanently delete every game you have logged along with your logging identity. Deletion is immediate and total — there is no soft delete and no copy kept.
We use game logs to understand how decks actually perform, and to publish aggregate findings such as how bracket relates to how quickly games end. Anything we publish is aggregated across many players and never traceable to a person or a pod.
Legal Basis for Processing (GDPR)
We process data under legitimate interest (Article 6(1)(f) GDPR) for analytics, security, and service operation. Deck saving is based on your voluntary action (you choose to click “Save & Share”). Logging a game with the Discord bot is likewise your voluntary action — nothing is recorded unless you run the command — and the identifier we keep is a one-way hash rather than your Discord ID. We do not process sensitive personal data. We also keep anonymized decklists (cards only, not linked to you) to improve our tools under legitimate interest. Once anonymized, this is no longer personal data under GDPR.
Your Rights
Under GDPR (EU/EEA) and CCPA (California), you have the right to:
- Access — request what data we hold about you
- Deletion — request deletion of your saved decks or any associated data. For Discord bot game logs you do not need to ask us at all: run
/forgetmeand it is done immediately - Object — opt out of our analytics and session recording. Any tracker-blocking extension stops both. For Google Analytics specifically, use the Google Analytics opt-out extension. For the Microsoft identifiers described in Cookies, use the Microsoft advertising opt-out and the DAA WebChoices tool
- Data portability — your decklists are always visible and copyable from the gallery
To exercise any right, email support@scrollvault.net. We will respond within 30 days.
Do Not Sell or Share My Personal Information (CCPA/CPRA)
We do not sell your personal information, and we receive no money for anyone's data. The Microsoft advertising identifiers that Clarity would otherwise set are switched off (see Cookies). Once third-party advertising is live, some US state privacy laws treat serving personalised ads as "sharing" personal information for cross-context behavioural advertising — so from that point you will be able to opt out of it through the Cookie settings link in our footer, which is our "Do Not Sell or Share My Personal Information" control. See Advertising and Affiliate Links for where that stands right now. To withdraw from analytics, use the same link, the opt-outs in Your Rights, or email support@scrollvault.net and we will confirm what we hold.
Children
ScrollVault is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided data to us, contact us and we will delete it.
External Links
Our content may link to external sites (Wizards of the Coast, MTGGoldfish, etc.). We are not responsible for the privacy practices of those sites.
Changes to This Policy
We may update this policy when we add features or change data practices. The “last updated” date at the top reflects the most recent revision.
Contact
Questions about this policy? Email support@scrollvault.net.