We don’t monetize you.

Who we are

In shortA small US company runs The Commons, and a person answers privacy email.

The Commons is a website and app for Magic: The Gathering players. It’s run by The Commons MTG, LLC, a company in the United States (“we”, “us”). We decide what happens to the information described here.

Questions, requests or worries about your privacy go to privacy@thecommonsmtg.com. A person reads every one.

What we keep, and why

In shortYour account, your cards and decks, and what Pro needs. Nothing about who you are beyond an email address.

We keep only what The Commons needs to work. Here’s all of it, with the legal reason for each under “Why”.

We don’t ask for your name, birthday, address, phone number or location, and we never open your contacts, photo library or microphone. The camera is used only by the card scanner (see below).

If you type something personal into a deck description or a note, it’s stored like any other text there and used for nothing else.

Signing in with Google

In shortGoogle sends your email address, account ID, name and picture link. We use them only to sign you in.

You can sign in with your Google account instead of an email code or a password. If you do, Google asks you first, then sends us:

• Your email address, and that Google has confirmed it.
• Your Google account ID, a number that tells us it’s the same Google account next time.
• Your name and a link to your profile picture, as they are on your Google account.

We use your email address and account ID only to sign you in and to find your account: if you already have one with the same email address, Google sign-in opens that account. Our sign-in provider, Supabase, keeps your name and picture link with your sign-in record; The Commons doesn’t show them or use them for anything. We never get your Google password, and we don’t ask Google for anything else: not your contacts, calendar, files or email.

We don’t sell what Google sends us, use it for ads, or share it with anyone except the providers that run The Commons for us (listed below). It’s deleted when you delete your account. You can also remove The Commons from your Google account at any time, under Security → Your connections to third-party apps & services.

The Commons’ use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Signing in with Discord

In shortDiscord sends your email address, user ID, username and avatar link. We use them only to sign you in.

You can sign in with your Discord account instead. If you do, Discord asks you first, then sends us:

• Your email address, and whether Discord has confirmed it. Discord sign-in works only with a confirmed address.
• Your Discord user ID, a number that tells us it’s the same Discord account next time.
• Your username, display name and a link to your avatar, as they are on Discord.

We use your email address and user ID only to sign you in and to find your account: if you already have one with the same email address, Discord sign-in opens that account. Supabase keeps your username, display name and avatar link with your sign-in record; The Commons doesn’t show them or use them for anything. We never get your Discord password, and we don’t ask Discord for anything else: not your servers, friends or messages, and we can’t post as you.

We don’t sell what Discord sends us, use it for ads, or share it with anyone except the providers that run The Commons for us (listed below). It’s deleted when you delete your account. You can also remove The Commons from your Discord account at any time, under User Settings → Authorized Apps.

Signing in with Apple

In shortApple sends a user ID and an email address, which can be a private relay address. We use them only to sign you in.

On an iPhone you can sign in with your Apple Account instead. If you do, Apple asks you first, then sends us:

• A user ID that Apple makes just for The Commons, so we know it’s the same Apple Account next time.
• An email address. Apple lets you share your real one or hide it: if you choose Hide My Email, we get a private address ending in privaterelay.appleid.com that forwards to you.
• Your name, the first time only, if you choose to share it. We don’t keep it.

We use the user ID and email address only to sign you in and to find your account: if you already have one with the same email address, Apple sign-in opens that account. A Hide My Email address won’t match an account you made another way; to use Apple with that account, sign in the usual way and link Apple in Settings → Sign-in methods. We never get your Apple Account password, and we don’t ask Apple for anything else.

We don’t sell what Apple sends us, use it for ads, or share it with anyone except the providers that run The Commons for us (listed below). It’s deleted when you delete your account. You can also stop using Apple sign-in with The Commons at any time, under Settings → [your name] → Sign-In & Security → Sign in with Apple on your iPhone.

On your device: storage and cookies

In shortA sign-in token, a few preferences, and for Pro an offline copy. No tracking cookies, so no cookie banner.

• Your sign-in. Your browser or phone keeps a sign-in token so you stay signed in until you sign out.
• Small preferences, like how you like a deck laid out, and a draft of a deck you haven’t finished.
• Offline copies (Commons Pro). With Pro, a copy of your collection and decks is kept on your device so you can use them without a signal. It syncs with your account when you’re back online.
• The card scanner. The camera is used only while the scanner is open, and frames are matched against a card list on your device. Photos of your cards are never uploaded.

Cookies

The Commons doesn’t use cookies to track you, and there are no advertising or analytics cookies. Cloudflare, which delivers the website, may set a short-lived cookie that tells real visitors apart from bots; it isn’t used to identify you. That’s why there’s no cookie banner: there’s nothing to ask you about.

To clear what The Commons keeps on a device, sign out, then clear the site’s data in your browser settings or delete the app.

Do Not Track and Global Privacy Control

We don’t track you across sites or sell or share your information, so there’s nothing for these signals to turn off. We treat them as a request not to, and always will.

What other people can see

In shortOnly the decks you choose to share, with your display name. Never your collection.

Your collection, its value and your account details are never shown to anyone else.

Decks are private when you make them. You can change that for each deck:

• Unlisted: anyone with the link can see the deck.
• Public: the deck also appears in Browse public decks.

A shared deck shows its name, description, cards and your display name. Making it private again takes it down, though anyone could have copied it while it was shared.

Companies that help us run it

In shortThe service providers listed below, and no advertisers. We don’t sell your information.

A few companies help us run The Commons. They handle your information only to do that job for us, under contracts that don’t let them use it for anything else. None of them are advertisers.

Card images and shops

Card images load straight from Scryfall, a card database. Like any website, Scryfall sees your IP address when your device fetches an image; we don’t send it anything about you.

When you tap a link to buy a card, the link tells the shop which card you want, and you leave The Commons. That shop’s own privacy policy applies from there.

If something changes hands

If The Commons is ever sold or merged, your information moves with it and stays covered by this policy, and we’ll tell you before anything about it changes.

Requests from the government or police

In shortOnly with a valid legal order, as little as it requires, and we’ll tell you when we’re allowed to.

We hand over information only when the law requires it, such as a valid court order or subpoena, or when someone’s safety is at immediate risk. We check every request, push back on ones that are too broad, give only what the request requires, and tell you about it unless the law or a court forbids us to.

Decisions made by software

In shortSuggestions come from software. Anything that affects your account is decided by a person.

The Commons uses software to suggest cards, find combos, estimate a deck’s bracket and work out what your collection is worth. Commons AI answers questions with an AI model, and its answers can be wrong. Any change it proposes to a deck happens only if you apply it. These are suggestions: none of them changes your account or what you can do. Reports are read by a person, never decided by software alone.

Emails from us

In shortOnly emails about your account, and none of them track you.

We email you only about your account or your waitlist signup: things like confirming you’re on the waitlist, confirming your subscription or how to cancel it. We don’t send newsletters or promotions unless you’ve asked for them, and any we do send will have a one-click unsubscribe. Our emails have no tracking pixels and no tracked links.

Your choices and rights

In shortSee, copy, correct or delete your information at any time, for free.

Wherever you live, you can:

• See your information, or get a copy of it. Email us and we’ll send it.
• Correct it. Most of it you can change yourself in the app.
• Delete your account in the app, under Settings → Delete account. It takes effect at once: your account, collection, decks and history are removed. Payment records stay for tax law, with the link to you removed. Copies in backups and logs are overwritten on their normal schedule, within 90 days. A Pro subscription bought through Apple or Google has to be cancelled there as well.
• Leave the waitlist with the link at the bottom of the email we sent you, or by emailing us.

We reply within 30 days and never charge for it. To protect your account, we answer requests about it at the account’s own email address, and we may ask you to confirm it’s you. We never treat you differently for asking.

California

Under California law you can know what we collect and why, get a copy, correct it, and delete it. We don’t sell or “share” personal information as California defines those words, we don’t give it to anyone for their own marketing, and we don’t use sensitive information beyond what’s needed to run the service. Someone you authorize can make a request for you.

Europe and the UK

The legal reason for each kind of information is shown in the table above. You can also object to how we use it, ask us to restrict it, take it to another service, and withdraw your agreement at any time. You can complain to your local data protection authority.

The Commons runs in the United States. When your information goes there, it’s protected by the standard contractual clauses our providers offer.

Children

In shortFor people 13 and older. Commons AI is for people 18 and older.

The Commons is for people 13 and older, or older where your country requires it. It isn’t made for children younger than that, and we don’t knowingly collect their information. If we learn that a child under 13 has an account, we delete it. If you’re a parent and think your child has signed up, email privacy@thecommonsmtg.com.

We comply with the Children’s Online Privacy Protection Act (COPPA) by not allowing accounts for children under 13.

Commons AI is for people 18 and older. The first time you open it, you confirm your age; we keep only that you confirmed, never your birthday.

Keeping it safe

In shortEncrypted, locked to your account, and we’ll tell you if something goes wrong.

Everything travels over encrypted connections. Our database only lets each account read its own cards and decks. Passwords are stored scrambled, payment details never reach our servers, and the keys that unlock our systems are never put in the app. No system is perfectly secure, so if something goes wrong that affects your information, we’ll tell you as the law requires.

If you think someone else got into your account, or you’ve found a security problem, email security@thecommonsmtg.com.

Changes to this policy

In shortEvery change is listed here, and you’ll get an email before any that matter.

When this policy changes, we update the date at the top and list the change here. If it matters, like a new kind of information or a new reason for using it, we email you before it takes effect.

Contact