Privacy Policy

Last updated: October 2026

This policy explains what ScrySpire ("we", "the app") collects, why, and what you can do about it. It applies to the mobile app and to this website.

Who we are

The controller of your personal data is Lukáš Jakoubek, Kubova 505/6, Karlín, 186 00 Praha, company no. 04598482. For anything in this policy, including requests about your data, write to scryspire@gmail.com.

What we collect

Account: email address, password (stored by Supabase Auth — we never see your plain-text password), display name, optional avatar image and colour.
Sign-in with Google or Apple: what they share is stored with your login — your email address, and from Google also your name and profile picture.
Gameplay: games you log (results, brackets, damage, notes, tags), decks, achievements, pod membership, friends, events, tournaments, and community threads you post.
Open tables: tables you host (city, venue, time, the exact address you enter and any note), the tables you join, leave or are removed from, a note you leave for the host when cancelling late, and the show-up record worked out from those.
Settings: notification preferences, privacy flags (discoverability, friend requests).
Device (optional): if you turn on push notifications, a push token tied to your account. We ask before the system prompt, and you can decline.
Support: messages you send with Send feedback, kept with your account so we can reply.
Invites: if you join through a friend's invite link, we record who invited you and when you played your first game. Your friend sees that in their invite list, and you two become friends.
Usage: when you close a Free game, its length, number of players, format and date, tied to your account. It shows us how the app is used and never appears in your stats.

We do not collect your location or contacts, we use no advertising identifiers, and we do not buy data about you from anyone else.

Picking up an invite: so you don't have to type a code, on first launch the app checks where it was installed from (Android, from Google Play) or, once, looks for an invite link on your clipboard (iPhone, which asks your permission first). Only a ScrySpire invite link is used; anything else on the clipboard is ignored and never sent anywhere.

Location (optional): if you allow it, the app reads your phone's approximate location to show open tables and public events nearest you first. The sorting happens on your phone — your location is never sent to us or stored, and you can turn it off at any time in your phone's settings or pick a city by hand instead.

Why we use it, and on what legal basis

To run the app for you — sign you in, sync data with your pod, compute stats and achievements, show your profile to other players. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
To keep the service working and safe — prevent abuse, diagnose faults, protect accounts. Legal basis: our legitimate interests (Art. 6(1)(f)).
To send push notifications, if you turn them on. Legal basis: your consent (Art. 6(1)(a)) — you can withdraw it any time in your device settings or in the app.
To understand how the app is used — how many Free games are played, and how long. Legal basis: our legitimate interests (Art. 6(1)(f)).

We do not sell your data, we do not use it for advertising, and we do not profile you for marketing.

Who can see your data

Pod-scoped data (games, pod stats) is visible to members of pods you belong to, enforced by database access rules.
Friends games are visible only to their participants.
Your profile — level, achievements, honors received, and summary stats over all your games (games, wins, win rate, K/D, playstyle, recent results, most played decks) — is visible to any signed-in user who opens it, unless one of you has blocked the other. They see only those numbers: not the games themselves, your opponents or the pods, unless they could already see that game.
Anyone who has your invite link or friend code can see your display name — and nothing else — so the sign-up screen can say who invited them.
Your own tags on games are private to you.
Public events and community threads are visible more broadly, as labelled in the app when you post them.
Open tables are public: any signed-in user can see a table, who is seated at it, who left or was removed and when, and each player’s show-up record (tables counted, shown up to, cancelled late). The exact address is visible only to the host, the players seated at the table and the app’s moderators; a note you leave when cancelling, only to the host and the moderators. Reports about a table, with their reasons, are visible only to the moderators.
If a pod’s owner or admin removes you from that pod, the pod keeps a moderation record that you are blocked from rejoining it — who removed you and when. Only that pod’s admins can see it; it is deleted when they unblock you, when the pod is deleted, or when you delete your account.
When someone reports a thread or post, the report keeps a copy of it as it was at that moment — the text and who wrote it — so editing or deleting it afterwards doesn’t remove the evidence. Reports, and who filed them, are visible only to the app’s moderators.
If your account is suspended, other users can see that it is. The reason and the moderator who suspended you are visible only to moderators — and to you, as the reason on your suspension screen. Any pod you own is handed to another of its members, who is notified that they are its new owner (not why).

Who processes it for us

Supabase — hosting, database, authentication and file storage (avatars).
Scryfall — public card data and images when you search commanders or import a decklist. Scryfall receives the card names you look up, not your account or identity.
Expo, Apple and Google — app distribution and, if you enable it, push delivery.
Resend — delivers account emails (email verification and password reset).
Vercel — hosts this website.

Where your data is stored

Your account and gameplay data are stored and processed in the EU (Frankfurt). Where one of the processors above handles data outside the European Economic Area, that transfer relies on the safeguards that provider offers — standard contractual clauses or an adequacy decision.

How long we keep it

Account and gameplay data: until you delete your account.
When you delete your account, your login, profile, decks, achievements and personal data are removed immediately. Games you played remain for your podmates, but your seat in them is deleted — your name no longer appears.
Deleting a thread or post — or your account — removes your words and your name. Where other people already replied, a “[deleted]” placeholder stays so their replies keep their place; otherwise it is removed entirely. Reports about your posts, with their copies, are deleted with your account.
Deletion is final — there are no provider backups holding a copy that would have to roll off later.
In-app notifications are capped at the 50 most recent per person; older ones are deleted automatically.

Your rights

Under the GDPR you can ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, or have it handed to another service. You can withdraw a consent you gave at any time, without affecting what happened before.

Export: Profile → Account → Export my data. Delete: Profile → Session → Delete account. Both are immediate and need no request.
Anything else: email scryspire@gmail.com. We answer within one month.
If you think we have handled your data badly, you can complain to your data protection authority. In the Czech Republic that is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.cz).

Deleting your account

In the ScrySpire app: Profile → Session → Delete account. It takes effect immediately.
Without the app — for example if you have already uninstalled it: email scryspire@gmail.com from the email address your account uses, with the subject "Delete my account". Writing from that address is how we confirm the account is yours. We delete it within one month and reply when it is done.
What goes and what stays is described under "How long we keep it": your login, profile, decks, achievements and personal data are deleted; games you played stay for your podmates without your name.
If you created a pod that still has other members, it has to be handed over or emptied first — we will tell you if that applies, and how.

Automated decisions

We make no automated decisions about you that have legal or similarly significant effects. Stats, levels and achievements are calculated from the games you log — they change what the app shows you, nothing more.

Storage on your device

The app keeps your sign-in session, your preferences and some cached card art on your own device, so it works offline and does not re-download everything. A game you save without a connection, and a game you are in the middle of, also stay on the device until they are uploaded or finished. They belong to your account: signing out keeps them for the next time you sign in on that device, and another account signed in there cannot see them. The website uses the equivalent browser storage. We use no advertising or tracking cookies. Clearing the app's data, or your browser storage, removes all of it.

Security

Data travels over encrypted connections, and access is restricted per account by database-level rules. No service can promise perfect security, but the app is designed around the principle that you can only read what belongs to you and to your pods.

Children

The app is not intended for children under 15, and we do not knowingly collect their data. If you believe someone under 15 has an account, write to scryspire@gmail.com and we will delete it.

Changes

We may update this policy. The "Last updated" date changes with it, and continued use after a change means you accept the revised policy.