Privacy Policy

This policy explains what information DeckDen collects when you use the site, how it's used, and what control you have over it. DeckDen is a free, independently-run deck-building tool — we don't sell data, and we don't run ads or trackers.

Information we collect

When you create an account, we collect:

• Your username, which is shown publicly on your profile and on any decks you make public.
• Your email address, used to log you in — it is never shown publicly.
• Your password, which is hashed with bcrypt before it's stored. We never store or have access to your password in plain text.

When you build a deck, we store the deck's name, game, format, description, and public/private status, along with the cards you add to it — each card's name, quantity, category, and an image link sourced from that game's card database.

Card search and third-party services

DeckDen doesn't maintain its own database for every game. When you search for a Yu-Gi-Oh! or Pokémon card, that search is sent directly from your browser to the relevant third-party card database — YGOPRODeck for Yu-Gi-Oh! and the Pokémon TCG API for Pokémon. DeckDen's own servers don't see or log those searches. Union Arena card search is handled by DeckDen's own database instead.

Public vs. private decks

Decks you mark public — along with your username — are visible to anyone who visits DeckDen, including on the Browse Decks pages and your public profile. Decks left private are visible only to you when you're logged in.

How your data is stored

Account and deck data is stored in a PostgreSQL database. When you log in, we issue a session token (a JWT) that's stored in your browser's local storage and expires an hour after it's issued, at which point you'll need to log in again.

If you request a password reset, we generate a random, single-use token, store it (hashed — never the raw token) with a 30-minute expiry, and email it to you. The token stops working the moment it's used or that window passes, and it's cleared out entirely if you delete your account.

Cookies and tracking

DeckDen does not use tracking cookies, third-party analytics, or advertising scripts of any kind. The only thing kept in your browser is the login session token described above.

Password reset emails

To send password reset links, DeckDen uses Resend, a transactional email provider. Your email address is shared with Resend only when you request a password reset, solely to deliver that one email — it isn't used for marketing, and DeckDen doesn't send any other kind of email.

Your data, your control

You can delete individual decks and cards yourself at any time from within your account. You can also delete your account entirely, any time, from your Account page — doing so immediately and permanently removes your profile and every deck you own, public or private. If you'd rather we handle it for you, or you have a question about what data we have on file, contact us.

Children's privacy

DeckDen is not directed at children under 13, and we don't knowingly collect information from anyone under that age.

Changes to this policy

If this policy changes in a meaningful way, we'll update the date at the top of this page. Continuing to use DeckDen after a change means you accept the updated policy.

Questions

If anything here is unclear, or you want to know more about your data, reach out — we're happy to explain.