Privacy notice

Data we process

• Account and sign-in data: your account identifier, email address, connected sign-in providers, and authentication information managed by Supabase.
• Profile and settings: username, selected profile picture, optional social links, visibility and sharing choices, grading preferences, and onboarding state.
• Grades and activity: current normal and build-around grades, the time grades were saved, grade history, imports and exports recorded for achievements, and per-set privacy choices.
• Security information: limited technical logs and account-moderation records where needed to protect the service and enforce its rules.

Why we use it

Account, profile, settings, and grade data are processed to provide the service you request. Optional publication of your profile or analytics and inclusion of your grades in community analytics are controlled by your choices and can be disabled in Settings. Security and abuse-prevention processing is based on the legitimate interest in operating a safe and reliable service. Data may also be processed where necessary to comply with a legal obligation.

Guest mode and device storage

Guest grades remain in this browser and are not sent to the application database unless you sign in and choose to merge them. Guest grades expire 30 days after their last save. Theme and quick-grade preferences also stay in the browser. Authentication uses cookies when you sign in. These items provide requested site functions; myLimitedGrades does not currently use advertising or behavioral-tracking cookies. See the cookies and local storage notice for details.

Sharing and public features

A private profile and its grades are excluded from public profiles, shared summaries, public analytics, and leaderboards. Community summaries use only opt-in grades and do not publish individual grade histories. Public analytics and social links appear only when the relevant sharing controls allow them, and you can disable sharing in Settings.

Recipients and external services

Supabase provides authentication and database services. Your chosen OAuth provider processes information when you use social sign-in. Card images and symbols may be loaded directly from Scryfall, so Scryfall receives ordinary web-request information such as your IP address and browser details; grades are not sent to Scryfall. Licensed public 17Lands data is used for benchmarks, but your grades are not sent to 17Lands. The production hosting provider and its operational-log retention will be added here before public deployment.

Some providers may process data outside the EU/EEA. Before public deployment, the controller will document the selected data regions and applicable transfer safeguards, such as an adequacy decision or standard contractual clauses.

Retention and deletion

Account data and grade history are kept while your account exists so the service can provide history, analytics, and achievements. You can permanently delete your account in Settings; profile data, grades, private rating history, settings, social links, and connected sign-in methods are removed through the account relationship. Published product updates are retained without account attribution. Short-lived security and infrastructure logs and provider backups may remain for their documented retention periods; those periods will be specified before public deployment.

Your rights

Depending on the circumstances, you may request access to, correction or deletion of, or restriction of processing of your personal data; receive portable data; object to processing based on legitimate interests; and withdraw an optional sharing choice at any time. You can update many details, download your data, change sharing settings, or delete the account directly in Settings. Email the privacy contact for anything the controls do not cover. You may also complain to the Swedish Authority for Privacy Protection (IMY) or the supervisory authority where you live or work.

Security and changes

Access controls and database row-level security are used to limit access to account data. No internet service can promise absolute security. Material changes to this notice will be dated here and, when appropriate, highlighted in the application.