Privacy Policy

1. Overview

This Policy explains how MTG Relics Tools processes personal data when you visit the website, create an account, use the tools, subscribe to the Pro plan, or contact us. Processing complies with applicable law, including Brazil's General Personal Data Protection Law (LGPD).

By using the service, you also agree to the Terms of Service. Mandatory rights under the laws of the user's country or region remain unaffected.

2. Data controller and contact

You can use this contact to exercise your rights, ask questions, or report a suspected incident. Never send a password, security code, or full card number by email.

3. Data we may process

Account data

• display name, email address, and internal account identifier;
• authentication and security data. Your password is processed by the authentication service and is not available to MTG Relics in readable form;
• preferences, plan, account role, and information needed to recover access.

Subscription and payment

• subscription status, currency, subscribed product, billing dates, and Stripe customer and subscription identifiers;
• billing information provided to Stripe and limited payment method information, such as the card network and last digits, when made available;
• records of payments, cancellations, refunds, failures, and invoices.

MTG Relics does not receive or store your full card number or security code. This information is processed directly by Stripe.

Use of the tools

• tool usage and operational records when necessary, including to apply the Basic or Pro limits shown in the interface;
• cards, queries, lists, and other information you choose to enter to use a tool;
• evaluations and other data you choose to save to the cloud, when that feature is available on your plan;
• interactions needed to deliver results, prevent abuse, and improve the service.

Data stored only in your browser stays on your device. When you use a cloud storage feature available on your plan, data saved through that feature is linked to your account and processed on the service's servers.

Relics AI

Relics AI receives your account access token to validate the session and check your Free or Pro plan, your questions and the context needed to answer them. Authentication tokens are used for account validation; they are not included in prompts sent to the AI provider. Questions, responses, usage records and answer caches may be processed on the Relics AI server. Do not include sensitive personal information in your questions.

Technical and support data

• IP address, date and time, browser, device, pages accessed, and error and security logs collected by the website and its providers;
• messages, attachments, and other information you send to support.

4. Why we use data and the legal bases

• Providing the service and performing the contract: creating accounts, authenticating users, delivering tools, applying limits, processing subscriptions, and providing support.
• Complying with legal and regulatory obligations: retaining tax, accounting, payment, support, and rights-related records when required.
• Exercising rights: preventing and responding to fraud, abuse, disputes, incorrect charges, and breaches of the Terms.
• Legitimate interests: protecting accounts, measuring performance, correcting errors, and improving the service, while assessing necessity and respecting users' rights.
• Consent: when required by law, such as for promotional communications or optional technologies. Consent may be withdrawn through the channels provided.

Operational messages about registration, security, payment, and material changes to the service are not advertising and may be necessary for our relationship with the user.

5. Who data may be shared with

We share only what is necessary to operate and protect the service and comply with related obligations. The principal providers currently contemplated are:

• Supabase: authentication, database, and server functions;
• Stripe: checkout, payment processing, subscriptions, invoices, fraud prevention, and the Customer Portal;
• HostGator: website hosting and delivery;
• DigitalOcean: hosting the Relics AI server;
• OpenAI: processing questions and context when Relics AI uses its model API to generate a response;
• Google Fonts and delivery networks such as jsDelivr: delivering fonts or application libraries when used by a tool. These requests can expose your IP address and technical browser data to the provider;
• Card data sources and APIs, such as Scryfall: when a tool needs to retrieve Magic information. Necessary technical queries may be sent, without MTG Relics intending to share your account identity with those sources.

Some providers also process data under their own legal obligations and policies, particularly for security, fraud prevention, and financial compliance. We may also share data in response to a legal order, to protect rights and security, or in a possible reorganization of the service, with appropriate safeguards.

We do not sell personal data or share it with advertisers for behavioral advertising.

6. International transfers

Supabase, Stripe, HostGator, and other providers may store or process data in countries other than the user's country of residence. Using the service may therefore involve international data transfers.

Where applicable, we seek to use providers with appropriate contractual, technical, and organizational measures and transfer mechanisms permitted by law. Additional information about a relevant transfer may be requested through the privacy contact.

7. Cookies and local storage

The service uses essential browser mechanisms, such as local storage and session tokens, to keep you signed in, protect your account, and remember the state needed for the tools to work. Infrastructure providers may also use cookies strictly necessary for security and payment processing.

As of this version, MTG Relics Tools does not use its own cookies for behavioral advertising. If optional analytics or marketing technologies are added, this Policy and consent controls will be updated when required.

8. Retention and deletion

You can request deletion of your account and associated data. Support handles the request after verifying your identity. Data stored only in your browser must also be removed on your device.

We retain data for as long as needed to provide the service and fulfill the purposes described. After an account is closed, data may be deleted, anonymized, or retained for the period needed for legal obligations, fraud prevention, auditing, billing, and the regular exercise of rights.

Payment and billing records held by Stripe may be subject to its own policies and legal retention periods. Backups may remain for a limited time until safely replaced.

9. Your rights

Under the LGPD and other applicable laws, you may request, as applicable:

• confirmation that processing takes place and access to your data;
• correction of incomplete, inaccurate, or outdated data;
• anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data;
• portability, subject to regulations and the protection of commercial and industrial secrets;
• information about sharing and about the ability to refuse or withdraw consent;
• deletion of data processed with consent, where applicable;
• objection to unlawful processing and review of decisions made solely by automated means, where applicable.

Send your request to mtgrelics@gmail.com from the email address linked to your account. We may request additional information strictly necessary to confirm your identity and protect your data. Requests will be handled free of charge within the legal deadlines, except where the law permits otherwise.

You may also submit a petition to Brazil's National Data Protection Authority (ANPD) or the competent authority in your region.

10. Children and adolescents

People under 18 must not subscribe directly to the paid plan. If a minor uses free features, they must do so with the knowledge and supervision of a legal guardian. If you identify improper processing of a child's or adolescent's data, contact us so we can investigate and take appropriate measures.

11. Security

We adopt technical and administrative measures appropriate to the service's stage of development to reduce the risks of unauthorized access, loss, alteration, or improper disclosure. No system is completely immune to incidents; if a significant event occurs, we will take containment measures and provide the notices required by law.

You should also use a unique password, protect access to your email, and promptly report any suspected misuse of your account.

12. Changes to this Policy

This Policy may be updated to reflect legal or operational changes or changes to the tools. The current version will always be available on this page. Material changes will be highlighted in the service or communicated to the registered email address, as appropriate.

13. Contact

For questions or requests about personal data, write to mtgrelics@gmail.com. Include your account email and a clear description of the request; do not send passwords or full card details.