ColorlessBox

Privacy policy

Last updated: 19 July 2026.

1. What data we collect

  • When you sign in with Google or Discord: your email, your public username and your avatar.
  • The content you create: decks, cards in your collection and wishlist, comments, likes, favourites and who you follow.
  • If you sign up with email and password: your email (verified) and an encrypted password — we never store or see your password in plain text.
  • If you report content, or someone reports a deck, comment or your username: the reason for the report, so we can review it.

2. What we use it for

Solely to run the service: identifying you, showing your decks and collection, and letting other users find you if you make your profile, collection or wishlist public. We do not sell your data, nor do we share it with third parties beyond the providers necessary to operate the service (see next point). We show ads via Google AdSense to help cover the site's running costs — see the Cookies section for how that works and what choices you have.

3. Where it's stored

Your data is stored in a Postgres database managed by Supabase. The backend is hosted on Render and the frontend on Vercel.

4. Third-party services

  • Google / Discord: for signing in (OAuth). We never receive your password.
  • TCGdex: card data and images.
  • Cardmarket / TCGPlayer: card prices.
  • Resend: sends account verification and password reset emails (receives your email solely for that purpose).
  • Sentry: monitors technical errors on the site so we can fix them; it may receive technical browser and error information, not your account data.
  • Google AdSense: shows ads on the site and may use cookies to personalise them, subject to your consent.
None of these services receive data tied to your account (email, username, decks) beyond what's strictly necessary for signing in. Google AdSense operates independently of your account; see Google's own privacy policy at https://policies.google.com/technologies/ads for details on how it processes data.

5. Cookies

We use two technical cookies: one to keep you signed in, and another to remember your preferred language. We also save your light/dark theme preference and your chosen accent colour in your browser's local storage (localStorage, not a cookie) — neither identifies you nor ever leaves your browser. None of this requires your prior consent. We also show ads via Google AdSense, which may set cookies to personalise them. If you're in the EEA, the UK or Switzerland, Google shows a consent message the first time you visit, letting you consent, decline, or manage your choices — declining still shows ads, just non-personalised ones. You can change your choice at any time from that message.

6. Your rights

You can export your data or delete your account yourself, at any time and without having to ask, from My profile.

7. Changes to this policy

We may update this policy from time to time; the last-updated date appears above.