Privacy Policy

This policy describes what Upkeep collects, where it is stored, and who else can see it. In short: Upkeep offers user accounts, and creating one stores your email address on our hosting provider’s servers. Most deck and collection data currently lives in your browser, but some of it is stored on our servers when you use sharing, forking, or publishing features.

1. Accounts and Authentication

Upkeep offers optional user accounts. Signing in is handled by Supabase, which acts as our authentication provider and database host. When you create an account, Supabase stores your email address, a unique account identifier, your account creation date, and the authentication credentials or provider tokens needed to sign you in. Upkeep can read your email address, account identifier, and creation date; these are shown to you on your account page.

You can browse cards, build decks, and use the playtest simulator without an account.

2. Data Stored on Our Servers

When you are signed in, the following may be stored in our database and associated with your account identifier:

• Decks — deck name, format, commander, card list, colour identity, estimated value, and any deck primer you write or generate.
• Deck versions — historical snapshots of a deck’s card list, so you can compare and restore earlier versions.
• Shared decks — a copy of a deck’s contents created when you generate a share link.
• Match history — result, deck name, colours, opponent, difficulty, game mode, and turn count from playtest games.

Not every deck reaches our servers today. Deck synchronisation is still being built out, so a deck you create in the builder is currently saved in your browser and may not be copied to your account. Do not treat Upkeep as a backup of your decks.

3. Data Stored in Your Browser

Upkeep uses your browser’s localStorage for decks you build, your card collection, playtest match records, cached card prices, and interface preferences. This data stays on your device and is not readable by us. Clearing your browser data will permanently remove anything that has not been copied to your account.

4. Public and Shared Content

Marking a deck as public, or creating a share link, publishes that deck’s contents so that anyone can view them. Public decks appear on the Explore page and are readable without an account. Share links are readable by anyone who has the link. Public deck records currently include the account identifier of the deck’s owner, though not your email address. Share links cannot presently be revoked once created — treat sharing a deck as permanent.

5. Third-Party Services

• Supabase — hosts our database and handles authentication. Account and deck data described above is stored there.
• Scryfall — supplies card data, images, and pricing. Card searches are sent to Scryfall’s servers. See Scryfall’s API documentation and privacy practices.
• Groq — powers the AI deck primer and the AI rules judge. When you use those features, the relevant deck contents or your question are sent to Groq for processing. Do not enter personal information into AI prompts.
• News sources — the news page aggregates public RSS feeds from third-party Magic sites. No information about you is sent to them.

6. Cookies

When you sign in, Supabase sets authentication cookies so your session persists between visits. These are necessary for the account system to function. Upkeep does not use advertising cookies or third-party tracking cookies.

7. Analytics

Upkeep does not use third-party analytics or advertising services, and does not sell or share your data with advertisers. The “Analytics” page inside the app shows only your own playtest match history.

8. Retention and Deletion

Account and deck records are retained until the associated account is deleted. Deleting your account removes your decks, deck versions, share records, and match history, which are linked to your account and removed with it. There is currently no self-service account deletion button in the app — to request deletion, contact us through our community channels. Data held only in your browser can be removed at any time by clearing your browser storage.

9. Changes to This Policy

We may update this privacy policy from time to time. Changes will be reflected on this page with an updated “Last Updated” date. Material changes to what we collect or who we share it with will be described here rather than made silently.