Privacy Policy

Account Data

When you save your account, we collect:

• Email address: used to sign you in and to recover the account. If you sign in with Apple or Google, it is the address they share with us.
• Display name: chosen by you, visible to friends and game participants.

What You Create

When you use the app, we store the following on our servers, with or without a saved account:

• Games: life totals, commander damage, counters, tokens and the other events of each game, and the history of the games you played.
• Decks: the decks you build and their cards.
• Collection and lists: the cards you own, where you keep them and what you paid, and the lists you keep.
• Friends and trades: your friends, pending requests, and the trades you write down with them.
• Price alerts: the cards and prices you watch.
• Settings: the choices you make in the app, such as your price market.

The scanner reads cards on your phone. Camera images stay on the phone unless you choose to upload the frames of cards it could not name.

Analytics Data

We use PostHog to see how the app and this website are used and to find what breaks. This includes:

• Which screens are opened and which actions are taken.
• Crash and error reports, and how long things take to load.
• Device model, OS version and app version.

Analytics events carry your account's id, a random identifier with no name or email address in it, and whether the account has Pro. That is how we can tell how one account uses the app over time. We never send PostHog your email address or your display name. The app's analytics discard the IP address the events come from.

Subscription Data

If you subscribe to Stackheim Pro in the app, Apple or Google takes the payment, and RevenueCat tells us whether the subscription is active. RevenueCat receives your account's id and the purchase record from the store. A subscription bought on stackheim.com was paid through Stripe; for those we store the subscription status and a Stripe customer ID. We do not collect or store payment details such as card numbers: Apple, Google and Stripe hold those.

Email

We send email through Resend: sign-in codes and links, notices about your account, and the price alert emails you turn on.

Push Notifications

If you allow notifications for price alerts, we store the following with your account:

• Device push token: an identifier that Firebase Cloud Messaging issues to the app on your phone, so a notification can be addressed to it.
• Platform and app version: whether the phone runs iOS or Android, and which version of Stackheim it has.

We use the token only to send you the price alerts you set. Each notification names a card and how many of your alerts fired, and is delivered through Firebase Cloud Messaging, a Google service. On iPhone, Firebase hands it to Apple’s push notification service. Nothing is registered unless you allow notifications, and you can turn price alert notifications off in the app’s Settings or in your phone’s settings at any time.

We use your data to:

• Provide and operate the app (game tracking, history, multiplayer sync, decks, the collection and lists).
• Authenticate your account and manage sessions.
• Process and manage your subscription status.
• Send the price alert notifications you have turned on.
• Understand how the app is used and fix what breaks, through analytics.
• Send the emails the app needs, such as sign-in codes and the price alert emails you turn on.

We do not sell your data. We do not use your data for advertising.

We share data only with the following third-party processors, solely to operate the app:

We may also disclose data if required by Norwegian or EU law.

Your data is stored on Supabase servers in Sweden (EU). We use industry-standard security measures including encryption in transit (TLS) and at rest. Access to production data is restricted to authorized personnel.

• Active accounts: Data is retained as long as your account exists.
• Deleted accounts: All personal data is deleted within 30 days of account deletion.
• Device push tokens: Deleted when you sign out on that phone, when another account signs in on it, when Firebase reports the token is no longer valid, or with your account.
• Analytics: Kept under your account's id. Once the account is deleted, that id no longer leads to an email address, a name or anything else we hold about you.

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access your personal data.
• Correct inaccurate data.
• Delete your account and associated data.
• Export your data in a portable format.
• Object to or restrict processing of your data.

To exercise any of these rights, contact us at hello@stackheim.com.

Account Deletion

You can delete your account in the app: open your profile from the Play tab (the person icon at the top) and tap Delete account. Your data is removed from our database at once, and from backups within 30 days. If you cannot open the app, email hello@stackheim.com from the address on the account and we will delete it for you.

We do not knowingly collect data from children under 16 years of age. If you believe a child under 16 has created an account, please contact us and we will promptly delete it.

You can use Stackheim without signing in. The app then creates an unsaved account for you: a random id with no email address attached. Everything you create is stored on our servers under that id from the first launch, the same as for a saved account, and analytics carry it too. Saving the account later adds an email address or an Apple or Google sign-in to the same id, so nothing moves.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. Continued use of the app after changes constitutes acceptance.

For privacy-related questions or requests: