Privacy Policy

Effective date: June 23, 2026

This Privacy Policy explains what information Spellforge ("Spellforge", "we", "us", or "our") collects, how we use it, and the choices you have. Spellforge is a web application for building and tuning Magic: The Gathering Commander decks. By using Spellforge, you agree to this Policy.

1. Who we are

Spellforge is operated by an individual. You can reach us at Support@spellforgemtg.com for any privacy questions or requests.

2. Information we collect

We try to collect only what we need to run the service.

• Account information. Your email address and a password. We never store your actual password — it is saved only as a one-way, salted cryptographic hash that cannot be reversed back into your password.
• Content you create. The decks you build and save, the commanders and preferences you choose, and the inputs you provide to the deck generator (for example, a commander name, color or theme preferences, and card lists).
• Payment information. Payments are processed by Stripe. We do not see or store your full card number. We store a Stripe customer identifier, your current plan/subscription status, and counts of how many deck generations ("forges") you have used, so we can apply your plan correctly.
• Basic technical information. Information needed to operate and secure the service, such as the requests your device makes to us. We use a single sign-in cookie (see Cookies below).

We do not sell your personal information, and we do not use it for third-party advertising.

3. How we use your information

We use the information above to:

• create and secure your account and keep you signed in;
• save and sync your decks across your devices;
• process payments and manage subscriptions and usage limits;
• send you essential service emails (for example, a password-reset link);
• operate, maintain, debug, and improve the service; and
• comply with legal obligations and enforce our Terms.

4. AI processing of your inputs

When you generate, tune, or analyze a deck, the inputs you provide (such as a commander name, preferences, and card lists) are sent to our AI provider, Anthropic, which processes them to produce your results. Please do not enter sensitive personal information into these fields, as they are not the place for it.

5. Service providers we share data with

We use a small number of trusted third parties to run Spellforge. They process information only to provide their service to us:

• Cloudflare — hosting and database storage.
• Stripe — payment processing.
• Anthropic — AI deck generation (processes the deck inputs described in Section 4).
• Scryfall — Magic: The Gathering card data lookups (we send card names; we do not send your personal information).
• Resend — sending essential service emails such as password resets.

We may also disclose information if required by law, or to protect the rights, safety, or property of our users or ourselves.

6. Cookies

Spellforge uses a single strictly necessary cookie to keep you signed in. It is set as HttpOnly and Secure. We do not use advertising cookies or third-party tracking cookies.

7. Keeping and deleting your data

We keep your information for as long as your account is active. You can delete your account at any time from within the app. Doing so permanently removes your saved decks, your sessions, and your account record from our database, and cancels any active subscription. Note that Stripe may retain certain payment records as required to meet its own financial and legal obligations.

8. How we protect your data

Passwords are stored only as salted hashes using a strong algorithm (PBKDF2). Sign-in sessions expire automatically. Data is stored with our hosting provider, Cloudflare. No online service can promise perfect security, but we take reasonable steps to protect your information.

9. Children

Spellforge is not directed to children under 13, or under the minimum age required in your country (for example, 16 in parts of the European Union). If you are under that age, please do not create an account or use the service.

10. Your rights

Depending on where you live (for example, under the GDPR, UK GDPR, or CCPA), you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to certain processing. Deleting your account from within the app handles most of these. For anything else, contact us at Support@spellforgemtg.com and we will respond as required by applicable law.

11. International processing

We and our service providers may process your information in the United States and in other countries where those providers operate. Privacy laws in those countries may differ from those where you live.

12. Changes to this Policy

We may update this Policy from time to time. When we do, we will change the effective date at the top. Significant changes may be highlighted in the app.

13. Contact

Questions or requests? Email us at Support@spellforgemtg.com.