Privacy Policy

What we collect

Account information. When you register, we collect your email address and a password. Your password is stored in a form we cannot read.

Your card collection. The cards you add and the details you record about them, such as quantity and finish, including anything you bring in through the CSV import.

How you use your account. We record when you last signed in, how many times you have signed in, and when each card was added to your collection, so we can see whether people return to the service and keep using it.

Feedback you send. When you use the feedback page, what you write is emailed to us along with your email address, so we can reply. We keep feedback emails for as long as they help us improve the service, and delete them if you ask.

Technical records. Our server keeps request logs that include your IP address, the time of the request, the page or endpoint you asked for, and the response. These are used to debug problems, keep the service running, and deal with abuse.

Why we use it

• To create your account, sign you in, and keep you signed in.
• To store your collection and show you its contents and estimated value.
• To send you account email, such as address verification and password resets, and to put together a periodic summary of your own collection.
• To diagnose errors, monitor performance, and protect the service against abuse.
• To understand whether people come back to the service and which parts of it they keep using, so we know what to work on.

We do not use your collection or your email address for advertising, and we do not build advertising profiles about you.

We send email that relates to your account, such as verifying your address, resetting your password, or telling you about a change that affects you. We may also send you a periodic summary of your own collection. Every summary has an unsubscribe link, and unsubscribing does not stop the account email you need in order to use the service. We do not sell or rent your email address, and we do not send marketing email.

Cookies and local storage

We and the providers we use may set cookies, local storage and similar technologies on your device. We use them to keep you signed in, to remember interface preferences such as your colour mode and table settings, to keep the service secure and protect it against abuse, and to measure how the site is used.

Some of this storage is set by us and some is set by the providers we rely on to host, protect and measure the site, including analytics providers. The specific technologies and providers we use may change over time.

Analytics

We use analytics to understand how the site is used, such as page views, referring site, approximate location, device and browser information, and which parts of the site people spend time in.

We look at this both in totals and at the level of an individual visit, and we use it to operate, secure and improve the service. We do not use it to build advertising profiles. The analytics providers we use may change over time.

Aggregate and de-identified information

We may produce, publish and share statistics derived from collection data across all users, such as how commonly a card is owned or how a set trends in value, and from usage and request data, such as traffic volumes, error rates and which features get used. This information is aggregated and de-identified: it does not name you, and it is not presented in a way meant to single you out. We reserve the right to use and share this kind of aggregate information freely, and to keep it for as long as it is useful.

Storage, hosting and disclosure

We use third-party providers to host, operate and monitor the site. Your information is stored on and passes through their systems, and their handling of it is governed by their own terms and privacy policies. We do not sell your personal information, and we do not share it with third parties for any purpose other than hosting, operating and monitoring the service.

We may store and process your information in any country. While it is in a given country it is subject to that country's laws, which can include lawful access by its courts and government authorities.

Only the people who operate the service can reach the database, and they do so to investigate problems and keep it running.

We may be required to disclose information to comply with the law. If that happens we will review the request, push back on anything overly broad or unclear, disclose only the narrowest information needed to comply, and tell you about it as soon as we are permitted to. We may also disclose information where it is necessary to investigate a credible threat to the security of the service or to someone's safety.

Magic card data

Card names, images, printings and prices come from public sources such as Scryfall and MTGJSON. That data flows into our service. Nothing about you or your collection is sent back to those sources, and the card images you see are served by us rather than requested from them by your browser.

How long we keep it

Your account and your collection are kept until you delete them. We do not expire accounts for inactivity, and we do not quietly discard collection data.

We keep request logs only as long as we need them for troubleshooting, security and abuse investigation, and they are deleted automatically within 90 days. We may keep specific records longer where there is an ongoing security or abuse investigation, or where the law requires us to. That limit applies to logs that can be traced back to you. Aggregate statistics derived from them, such as traffic volumes, error rates and response times, contain nothing that identifies you and may be kept indefinitely. Backups are kept on a rolling basis, so a copy of deleted data can persist in them for a short time before it ages out.

Your choices and controls

• Export. You can download your entire collection as a CSV file at any time from your account page.
• Delete your collection. You can erase every card you have recorded from your account page. This cannot be undone.
• Delete your account. You can delete your account and everything in it from your account page. This cannot be undone.

Your rights

Canadian privacy law gives you the right to ask what personal information we hold about you, to get a copy of it, to have it corrected if it is wrong, and to withdraw your consent to our use of it. Withdrawing consent means closing your account, because the service cannot function without storing your email address and your collection.

We are accountable for the personal information in our care, and privacy requests are handled by a designated contact. Write to privacy@tolariantower.com and we will respond within thirty days. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada.

Children

The service is not intended for children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we will remove it.

Security

Your connection to the site is encrypted, and passwords are never stored in a readable form. No service can guarantee perfect security. Please do not store anything here that you could not stand to lose, and do not reuse a password you use elsewhere.

Changes to this policy

We may update this policy as the service changes. The effective date at the top will always tell you when it was last revised, and we will give notice in the app for changes that meaningfully affect how your information is handled.

Contact

You can send questions, requests and complaints to privacy@tolariantower.com. See also our Terms of Service.