Privacy policy

The controller is César (the ColorlessBox project). For anything about your data or to exercise your rights, email zorcedev@gmail.com.

Solely to run the service: identifying you, showing your decks and collection, and letting other users find you if you make your profile, collection or wishlist public. We do not sell your data, nor do we share it with third parties beyond the providers necessary to operate the service (see next point). We show ads via Google AdSense to help cover the site's running costs — see the Cookies section for how that works and what choices you have.

We process your account data and content to provide the service you request (Art. 6(1)(b) GDPR); personalised ads rely on your consent (Art. 6(1)(a)); and security and abuse prevention on our legitimate interest (Art. 6(1)(f)).

Your data is stored in a Postgres database managed by Supabase. The backend is hosted on Render and the frontend on Vercel.

Some providers (e.g. Vercel, Render or Sentry) may process data outside the European Economic Area, including the United States. Those transfers rely on the European Commission's Standard Contractual Clauses or the Data Privacy Framework.

We keep your data while your account is active. If you delete it, your data is removed except what the law requires us to keep. Verification and password-reset tokens expire within 24 hours.

• Google / Discord: for signing in (OAuth). We never receive your password.
• TCGdex: card data and images.
• Cardmarket / TCGPlayer: card prices.
• Resend: sends account verification and password reset emails (receives your email solely for that purpose).
• Sentry: monitors technical errors on the site so we can fix them; it may receive technical browser and error information, not your account data.
• Google AdSense: shows ads on the site and may use cookies to personalise them, subject to your consent.
• Umami: usage analytics with no cookies or personal data, to see which pages are visited.

None of these services receive data tied to your account (email, username, decks) beyond what's strictly necessary for signing in. Google AdSense operates independently of your account; see Google's own privacy policy at https://policies.google.com/technologies/ads for details on how it processes data.

We use two technical cookies: one to keep you signed in, and another to remember your preferred language. We also save your light/dark theme preference and your chosen accent colour in your browser's local storage (localStorage, not a cookie) — neither identifies you nor ever leaves your browser. None of this requires your prior consent. We also show ads via Google AdSense, which may set cookies to personalise them. If you're in the EEA, the UK or Switzerland, Google shows a consent message the first time you visit, letting you consent, decline, or manage your choices — declining still shows ads, just non-personalised ones. You can change your choice at any time from that message.

You must be at least 14 to create an account. We only show personalised ads to adults who have confirmed their age; visitors and minors are shown non-personalised ads. We don't store your date of birth, only whether you're an adult.

You can access, rectify, erase, object to the processing of, or request portability of your data, and withdraw consent to personalised ads at any time. You can export your data or delete your account yourself from My profile; for anything else, email zorcedev@gmail.com.

If you believe we handle your data improperly, you can complain to your country's data protection authority (in Spain, the AEPD, www.aepd.es).

We may update this policy from time to time; the last-updated date appears above.