Privacy Policy

Who runs this

I Want My MTG is operated by Matthew Towles, an individual based in Maryland, USA. You can reach me at legal@iwantmymtg.net.

What I collect

• Account data - your email address, display name, and a hashed password. Passwords are never stored in plain text.
• Collection data - cards you add to your inventory, transactions you record, and price alerts you configure. This data is tied to your account.
• Technical data - your IP address is read in memory to enforce API rate limits. It is not written to our database or server logs.

I do not collect analytics, set tracking cookies, or load any third-party tracking scripts.

How I use it

• To provide the collection tracking features you signed up for.
• To send transactional email: account verification, password reset, and price-alert notifications you opted into.
• To protect the service from abuse (rate limiting, preventing account takeover).

I never sell your data. I do not share it for advertising, and I do not run ads on this site.

Third parties involved

Running the Service requires a small number of service providers. They only receive the data they need to do their job.

• Amazon Web Services - hosts the application and database (United States).
• Amazon SES - delivers transactional email.
• Scryfall - card images are loaded directly from scryfall.com by your browser.
• jsDelivr and Google Fonts - content delivery networks that serve fonts and icon libraries to your browser.
• TCGPlayer (via Impact) - only involved when you click a "Buy on TCGPlayer" link. Their site receives standard referral information and, if you make a purchase, the Service may earn a commission at no additional cost to you.

Cookies

The Service sets one cookie: an authentication cookie containing a signed session token. It is first-party, HTTP-only, and expires after one hour. No advertising or analytics cookies are set.

Some preferences (theme, first-visit hints, view options) are stored in your browser's local storage. That data stays on your device and is not transmitted.

How long I keep your data

Account and collection data is retained as long as your account is active. If you delete your account, your user record and related collection data (inventory, transactions, price alerts, notifications) are removed. Unverified pending-registration records expire automatically.

Your choices

• Access - your inventory, transactions, and account details are visible to you inside the app.
• Export - download a JSON copy of your account, inventory, transactions, and price alerts from your account settings page. If you'd prefer to receive the export by email, contact legal@iwantmymtg.net.
• Deletion - you can delete your account from your account settings page at any time.
• Email - you can disable price-alert emails by toggling or deleting your alerts. Transactional emails tied to account security (verification, password reset) cannot be disabled while the account is active.

California residents

If you are a California resident, the California Consumer Privacy Act gives you the right to know what personal information is collected, request its deletion, and not be discriminated against for exercising these rights. The rights above (Access, Export, Deletion) apply to you without any additional process.

Children

The Service is not directed at children under 13 and I do not knowingly collect personal information from them. If you believe a child has created an account, contact me and I will remove it.

Changes to this policy

If this policy changes in a meaningful way, the updated version will be posted here with a new "Last updated" date. For material changes I will also email active users.

Contact

Questions or requests: legal@iwantmymtg.net.