Privacy Policy

Last updated: September 27, 2026

What We Collect

You do not need an account to use ScrollVault. Accounts are optional: they keep your saved decks and let you open them on any device. We do set cookies — our analytics and session-recording tools need them, and some of those cookies belong to Microsoft. They are itemised in Cookies below. Third-party advertising is also live on the site, and Mediavine and its partners set their own cookies and identifiers; that is described in Advertising and Affiliate Links. Here is everything we collect:

Data	Purpose	Stored Where	Retention
IP address, browser type, pages visited	Server security and abuse prevention	Hosting provider logs	30 days
Pages visited, referring site, country, device type — grouped into visits by a one-way identifier derived from your IP address	Our own traffic statistics, kept in-house instead of relying on a third party. Described in Measurement We Run Ourselves	SQLite database on our server	Per-visit rows 180 days; aggregate counts indefinitely. The identifier becomes irreversible after 2 days
Page performance measurements — loading and layout-stability timings, and which element moved. No identifier of any kind	Finding slow or visually unstable pages. Described in Measurement We Run Ourselves	Daily files on our server	Indefinite — there is nothing in them to tie to a person
IP address (hashed)	Rate limiting on deck saves (max 10/hour)	Temporary server files	1 hour
Page views, clicks, scroll depth	Anonymous site analytics	Google Analytics 4	14 months (Google default)
Session recordings (mouse movement, clicks, page interactions)	UX improvement and bug detection	Microsoft Clarity	30 days (Clarity default)
Decklists, commander names, bracket results	Gallery feature (user-initiated save only)	SQLite database on our server	Until deleted by user or us
Anonymous deck list (cards only)	Spotting trends and improving the tools	Deck data	Kept anonymously
Edit keys for saved decks	Allow deck owners to edit/delete without an account	Your browser (localStorage)	Until you clear browser data
UI preferences (panel collapse state)	Remember your layout choices	Your browser (localStorage)	Until you clear browser data
Email address (account)	Signing in with a password, and resetting it. We send it nothing else unless you also subscribe to the newsletter	SQLite database on our server	Until you delete your account
Password, stored only as a one-way hash (argon2id). We cannot read it	Signing in	SQLite database on our server	Until you change it or delete your account
Passkey public keys. The private key never leaves your device	Signing in with a passkey	SQLite database on our server	Until you delete your account
Sign-in sessions: a random token (stored hashed), the IP address and a one-way hash of your browser's user-agent string	Keeping you signed in; signing out everywhere when you reset your password	SQLite database on our server	30 days after last use, and never more than 180 days
Sign-in log: account, email address, what happened (signed in, wrong password, password reset), IP address	Spotting attacks on accounts	SQLite database on our server	90 days
IP address and a one-way hash of the email address	Limiting sign-in attempts and new accounts	SQLite database on our server	1 day
Decks in your account	Keeping your decks and their version history. A deck you make public can be seen by anyone with its link, including its notes and tags	SQLite database on our server	Until you delete them or your account
Likes: which account liked which public deck, and when	Showing a deck's like count and the most liked decks this week	SQLite database on our server	Until you remove the like or delete your account
A one-way hash of your IP address and browser, made with a key that changes every day	Counting each visitor to a public deck once a day	SQLite database on our server	2 days. The day's key is deleted with it, so the hash can no longer be linked to you
Email address (newsletter)	Send occasional updates about banlist/bracket changes and new tools — only if you opt in via the signup form and confirm by email (double opt-in)	SQLite database on our server	Until you unsubscribe

We only collect an email address if you voluntarily subscribe to our newsletter, and only after you confirm it (double opt-in). You can unsubscribe at any time using the link in every email. We do not collect names or payment information, and we do not sell your personal data.

Third-Party Services

When you use our tools, data is sent to these external services:

Google Analytics 4 — anonymous page view and engagement analytics. Google Privacy Policy.
Microsoft Clarity — session recording and heatmap analysis. Clarity records mouse movements, clicks, scrolls, and page content (including text you type into tool inputs) to help us identify usability issues. No personally identifiable information is collected. Clarity Privacy Disclosure.
Scryfall API — when you analyze a deck, card names are sent to Scryfall to retrieve card data. Scryfall may log your IP address per their privacy policy.
Commander Spellbook API — card names are sent to check for known combos. Commander Spellbook may log your IP address.
Google Fonts — typefaces are loaded from Google servers. Google may collect anonymous usage data.
TCGplayer — some card links on our tools and articles are affiliate links. If you follow one, TCGplayer knows the visit came from us and may set its own cookies. See Advertising and Affiliate Links.

Cookies

The cookies we set ourselves are for analytics and session recording. Microsoft Clarity, which we use for session recording, is capable of setting Microsoft advertising identifiers, and we have explicitly turned that off — that stays off now that advertising is running, because Clarity is a session-recording tool for us and not one of our advertising partners. Advertising cookies are set by Mediavine and its partners rather than by us, and are covered separately in Advertising and Affiliate Links.

That leaves four cookies of our own. This is the complete list of what we set after a normal visit. It does not cover advertising cookies, whose current list is maintained by Mediavine Partners:

Cookie	Set by	Purpose	Expires
`_ga`, `_ga_1CV3DS33WK`	Google Analytics (first-party)	Distinguish visitors and sessions for anonymous traffic statistics	up to 400 days
`_clck`, `_clsk`	Microsoft Clarity (first-party)	Link your page views into one session recording	1–365 days

Visitors in the EEA, the UK and Switzerland are asked first, and nothing above is set until you accept — if you decline, or simply ignore the banner, we store nothing at all. Everywhere else these cookies are on by default and you can switch them off at any time with the Cookie settings link in the footer of every page.

You can also refuse them by blocking third-party cookies, using a tracker-blocking extension, or using the opt-outs listed in Your Rights. Blocking every cookie on this list does not break any tool on ScrollVault — the calculators run entirely in your browser.

If you use an account, we also set these strictly necessary cookies. They exist only to keep you signed in and to protect the sign-in forms, so the cookie banner does not control them. Nothing is set unless you use an account.

Cookie	Set by	Purpose	Expires
`__Host-_logged_in_sv`	ScrollVault (first-party)	Keeps you signed in	30 days after last use
`__Host-sv_csrf`	ScrollVault (first-party)	Protects the password reset form from forged submissions	End of browser session
`__Host-_logged_in_wa`	ScrollVault (first-party)	Holds one passkey step while you confirm it	5 minutes
`__Host-_logged_in_pending`	ScrollVault (first-party)	Ties a password reset to the browser that asked for it	15 minutes

Measurement We Run Ourselves

Two of the things we measure do not involve a third party at all. Neither one sets a cookie or stores anything on your device, and for that reason neither is controlled by the cookie banner. We would rather describe them here than leave you to find them.

Traffic statistics from our own server logs. Every request a web server handles is written to a log, including yours. We read our own logs to count visits and see which pages get read. To tell one visit from another without keeping your IP address, each request is tagged with a short one-way hash of that address, computed with a random key that changes daily. That key is destroyed once it is two days old, and from then on the tag cannot be connected back to an IP address by us or by anyone who obtained the database. Each tagged row holds the page, the referring site, a country, a device type and a response time — nothing else. Rows are deleted after 180 days. The totals we build from them — how many people read a page in a given week — are kept indefinitely and identify nobody.

Page performance. Our pages send us a small measurement of how they actually performed for you: how long the main content took to appear, how much the layout shifted while loading, how quickly the page responded when you first interacted with it, and a description of whichever element moved. This is how we find out that an advert or an image is making a page jump around while you are trying to read it. It carries no identifier whatsoever — no cookie, no stored value, no visitor ID, no IP address and no browser string. It is a page address, a handful of numbers, and a rough device and connection category. Because there is nothing in it that could identify you, it is not gated on the cookie choice.

Both run on the basis of legitimate interest, and you can object to either by writing to us at the address in Contact. Blocking our scripts stops the performance measurement; the server-log statistics are a by-product of running a web server and can only be switched off at our end, which we will do on request.

Advertising and Affiliate Links

Third-party advertising is live on ScrollVault, through Mediavine, as of 16 September 2026. Mediavine and the advertising partners they work with set cookies and similar identifiers, and process personal data to select and measure ads.

Visitors in the EEA, the UK and Switzerland are asked through Mediavine's Consent Management Platform, which is registered with the IAB Europe Transparency & Consent Framework. No advertising cookie is set before you answer it.
Visitors in US states with opt-out rights can exercise them through the same control, which supports the IAB Global Privacy Platform, and through the Cookie settings link in our footer.
The current list of advertising vendors is maintained by Mediavine at Mediavine Partners.

Advertising does not change how any of our tools work, and we do not put advertising between you and a result you asked for.

Mediavine Programmatic Advertising (Ver 1.1)

The Website works with Mediavine to manage third-party interest-based advertising appearing on the Website. Mediavine serves content and advertisements when you visit the Website, which may use first and third-party cookies. A cookie is a small text file which is sent to your computer or mobile device (referred to in this policy as a “device”) by the web server so that a website can remember some information about your browsing activity on the Website.

First party cookies are created by the website that you are visiting. A third-party cookie is frequently used in behavioral advertising and analytics and is created by a domain other than the website you are visiting. Third-party cookies, tags, pixels, beacons and other similar technologies (collectively, “Tags”) may be placed on the Website to monitor interaction with advertising content and to target and optimize advertising. Each internet browser has functionality so that you can block both first and third-party cookies and clear your browser’s cache. The “help” feature of the menu bar on most browsers will tell you how to stop accepting new cookies, how to receive notification of new cookies, how to disable existing cookies and how to clear your browser’s cache. For more information about cookies and how to disable them, you can consult the information at All About Cookies.

Without cookies you may not be able to take full advantage of the Website content and features. Please note that rejecting cookies does not mean that you will no longer see ads when you visit our Site. In the event you opt-out, you will still see non-personalized advertisements on the Website.

The Website collects the following data using a cookie when serving personalized ads:

IP Address
Operating System type
Operating System version
Device Type
Language of the website
Web browser type
Email (in hashed form)

Mediavine Partners (companies listed below with whom Mediavine shares data) may also use this data to link to other end user information the partner has independently collected to deliver targeted advertisements. Mediavine Partners may also separately collect data about end users from other sources, such as advertising IDs or pixels, and link that data to data collected from Mediavine publishers in order to provide interest-based advertising across your online experience, including devices, browsers and apps. This data includes usage data, cookie information, device information, information about interactions between users and advertisements and websites, geolocation data, traffic data, and information about a visitor’s referral source to a particular website. Mediavine Partners may also create unique IDs to create audience segments, which are used to provide targeted advertising.

If you would like more information about this practice and to know your choices to opt-in or opt-out of this data collection, please visit National Advertising Initiative opt out page. You may also visit Digital Advertising Alliance website and Network Advertising Initiative website to learn more information about interest-based advertising. You may download the AppChoices app at Digital Advertising Alliance’s AppChoices app to opt out in connection with mobile apps, or use the platform controls on your mobile device to opt out.

For specific information about Mediavine Partners, the data each collects and their data collection and privacy policies, please visit Mediavine Partners.

We do use affiliate links. Card and deck links pointing to TCGplayer carry an affiliate tag: if you buy something after following one, we earn a commission at no extra cost to you. It never changes the price you pay, and it never changes a tool's output — the bracket calculator, mana base calculator, and every other tool return the same result whether or not a card happens to be purchasable. Affiliate links are marked rel="sponsored" in the page source.

How We Use Deck Data

When you analyze a deck, we keep an anonymous copy of the card list — just the cards, never anything that identifies you (no name, IP, account, or login). We use it to spot trends and make the tools better, like which cards are popular for a commander or how decks land across brackets. We never publish your deck, never tie it to you, and never try to work out whose it is. This includes decks already saved to the gallery.

The Discord Bot

Our Discord bot answers /bracket and lets you log games you have played with /log. If you never run a command, we hold nothing about you at all.

When you do use it, here is exactly what is stored and what is not:

We do not store your Discord ID. We store a one-way keyed hash of it. That hash lets us keep your own history together and lets you delete it, but it is not a Discord ID and cannot be turned back into your profile, name, or avatar by anyone reading our database.
What a logged game records: which deck (the deck link you analyzed), whether you won, the turn the game ended, and how many players were at the table. That is all.
We never record your Discord name, avatar, message content, who else was in your pod, or your location. The bot reads only the command you type.
The server a command was used in is also stored as a one-way hash, so we can see which servers are active without identifying them to anyone reading the data.

You can see and delete everything, yourself, at any time. Run /mygames to see exactly what we hold on you, and /forgetme to permanently delete every game you have logged along with your logging identity. Deletion is immediate and total — there is no soft delete and no copy kept.

We use game logs to understand how decks actually perform, and to publish aggregate findings such as how bracket relates to how quickly games end. Anything we publish is aggregated across many players and never traceable to a person or a pod.

Legal Basis for Processing (GDPR)

Different things we do rest on different grounds, so we have set them out separately rather than claim a single basis for all of it.

Google Analytics and Microsoft Clarity rest on your consent (Article 6(1)(a) GDPR), not on legitimate interest. In the EEA, the UK and Switzerland nothing is set and nothing is sent until you accept, and you can withdraw at any time through the Cookie settings link in our footer. Withdrawing is as easy as accepting. Elsewhere these are on by default and the same link switches them off.
Our own server-log statistics and the page performance measurement rest on legitimate interest (Article 6(1)(f)). They are described in Measurement We Run Ourselves, they do not place anything on your device, and they run regardless of the cookie choice. Our interest is in knowing whether the site works and is read; against that, the server-log tag stops being linkable to you after two days and the performance measurement identifies nobody at any point. You can object — see Your Rights.
Security and abuse prevention rest on legitimate interest (Article 6(1)(f)): raw web server logs kept for 30 days, and a short-lived hash of your IP address used to rate-limit deck saving.
Saving a deck, subscribing to the newsletter and logging a game with the Discord bot rest on your voluntary action. Nothing is recorded unless you click Save & Share, confirm a newsletter subscription by email, or run a bot command. The bot identifier we keep is a one-way hash rather than your Discord ID.
Anonymised decklists (cards only, never linked to you) are kept to improve the tools under legitimate interest. Once anonymised, this is no longer personal data under GDPR.
Accounts rest on contract (Article 6(1)(b)): an account exists because you asked for one, and we keep only what signing in and your saved decks need. The sign-in log, the limits on sign-in attempts and the once-a-day count of visitors to a public deck rest on legitimate interest (Article 6(1)(f)): protecting accounts from attack, and showing how many people looked at a deck without being able to tell who they were.

We do not process sensitive personal data, and we do not rely on legitimate interest for anything that requires consent.

Your Rights

Under GDPR (EU/EEA) and CCPA (California), you have the right to:

Access — request what data we hold about you
Deletion — request deletion of your saved decks or any associated data. For Discord bot game logs you do not need to ask us at all: run /forgetme and it is done immediately
Object — opt out of our analytics and session recording. Any tracker-blocking extension stops both, as does the Cookie settings link in our footer. The server-log statistics described in Measurement We Run Ourselves are the one thing a blocker cannot reach, because they are produced at our end rather than yours; email us and we will exclude you from them. For Google Analytics specifically, use the Google Analytics opt-out extension. For the Microsoft identifiers described in Cookies, use the Microsoft advertising opt-out and the DAA WebChoices tool
Data portability — your decklists are always visible and copyable from the gallery
Delete your account — at any time, from the deck builder (Delete my account). It removes the account, every deck in it, their version history, your likes, your passkeys, your sessions and your sign-in log at once.

To exercise any right, email support@scrollvault.net. We will respond within 30 days.

Do Not Sell or Share My Personal Information (CCPA/CPRA)

We do not sell your personal information, and we receive no money for anyone's data. The Microsoft advertising identifiers that Clarity would otherwise set are switched off (see Cookies). Third-party advertising is now live, and some US state privacy laws treat serving personalized ads as "sharing" personal information for cross-context behavioral advertising — you can opt out of it through the Cookie settings link in our footer, which is our "Do Not Sell or Share My Personal Information" control. See Advertising and Affiliate Links for what is running and who the partners are. To withdraw from analytics, use the same link, the opt-outs in Your Rights, or email support@scrollvault.net and we will confirm what we hold.

Children

ScrollVault is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided data to us, contact us and we will delete it.

External Links

Our content may link to external sites (Wizards of the Coast, MTGGoldfish, etc.). We are not responsible for the privacy practices of those sites.

Changes to This Policy

We may update this policy when we add features or change data practices. The “last updated” date at the top reflects the most recent revision.

Contact

Questions about this policy? Email support@scrollvault.net.