Privacy Policy

What is this? This explains how we handle your personal information at ManaLotus. We believe in being straightforward about your data.

Our approach: We collect only what we need to make ManaLotus work. We don't sell your data to third parties.

Account stuff: Email, username, password (encrypted), and profile picture if you add one.

Your MTG data: Cards you own, deck lists, price alerts, and how you organize your collection.

Usage info: What you search for, which pages you visit, and basic technical info to keep the site working.

Payment info (future): If you subscribe to premium features, billing information through secure payment processors.

MTG data we use: We get card information and prices from public sources like Scryfall and MTGJSON. This doesn't involve your personal data.

To run ManaLotus: Show your collection, send price alerts, remember your settings, keep your account secure.

To make it better: See which features people use, fix bugs, plan improvements.

To communicate: Send important updates, password resets, and respond to your questions.

We DON'T: Sell your data, spam you, or track you on other websites.

We only share when: You make a deck public, we're legally required to, or we need to protect our service.

Service providers: AWS (hosting), email services, and payment processors when you subscribe.

Security: Everything is encrypted, stored on secure AWS servers, and regularly monitored.

How long we keep it: As long as your account exists. Delete your account and we permanently remove your data within 30 days.

You can: Edit your account, export your data, delete everything, turn off notifications, and control deck privacy.

California and EU residents: You have extra rights under CCPA and GDPR. Email [email protected] for requests.

Essential cookies: We use cookies to keep you logged in and remember interface preferences. The site needs these to work.

Analytics identifier: We set one first-party cookie (ml_device_id) containing a random identifier so we can tell when the same browser comes back, for up to one year. We use it only for our own usage analytics, like counting returning visitors. It is never shared with or sold to anyone, and it is not used to track you on other sites.

Usage data: We collect usage events (pages viewed, searches, clicks) along with your browser's user-agent string, which tells us the browser and device type. These events are tied to your account only when you're signed in.

Your choice: You can block or clear cookies in your browser. The site keeps working; we just won't recognize your browser when you return. You can also email [email protected] to have your data deleted.

Age limit: You must be 13 or older. If you're under 18, get your parents' permission.

If we update this policy: We'll email you about big changes and post the new version here.

Contact us: Email [email protected] with any questions about your data or this policy.