Version 2 · Last updated: 30 October 2026
The short version
- Card Portal is run by Ross Gray, trading as Ross Gray Digital, in the UK. Questions go to support@cardportal.online.
- We keep what you need to use the app: your name, email, password (scrambled), decks, groups and games. We also hold a few things that protect your account, like your IP address when you sign in. All of it is listed below.
- Your profile and decks are only seen by you, your friends and people in groups with you. Nobody else can find them.
- Other members of your groups can record you in games.
- Anyone who has the web address of an uploaded image can open it.
- We don't sell your data. No ads, no analytics, no tracking. Our emails aren't tracked either.
- Your data is stored on a server in London. We use a few companies to run things, and we name them below.
- You can download your data or delete your account at any time from your profile page.
- When you delete your account, most things go straight away. Your games stay in your groups' history, shown as "Deleted user".
- You must be 16 or older to use Card Portal.
- If you've only joined the waitlist, we hold just your email address and when you joined; see "The waitlist".
Who we are
Card Portal is run by Ross Gray, a sole trader trading as Ross Gray Digital, in the United Kingdom.
- Postal address: Enterprise Building, Rope Walk, Lincoln, LN6 7DQ
- Email: support@cardportal.online
- ICO registration number: ZC275642
We decide what happens to your data, so in law we are the "controller". We are too small to need a Data Protection Officer. Ross answers privacy questions himself.
Card Portal is run from the UK, mainly for players in the UK, but anyone can use it. Using it also means agreeing to our Terms of Use.
What we collect
Your account
- Your name. Other people see it.
- Your email address. Used to sign in and to send you account emails. Other users never see it.
- Your password. We only store a scrambled version (a "hash"). We can't read it.
- Whether you have confirmed your email.
- When you agreed to our Terms.
- If we've asked you to accept new Terms: when we asked, and when we sent a warning.
- Things you choose to add: a profile picture and a bio.
- Whether you let your group admins edit your decks (off unless you turn it on).
- A friend code that changes every day.
- If staff suspend your account: when, and the reason they wrote.
Keeping your account safe
- Two-factor authentication (2FA), if you turn it on. The secret code and backup codes are stored encrypted.
- Passkeys, if you add one. We store the name you give it, a public key and when it was last used. Your fingerprint or face scan never leaves your device. We never see it.
- Sign-in sessions: your IP address, your browser type and when you were last active.
- Password reset requests: your email and a scrambled one-time code.
- Rate limits: counters linked to your IP address, email address or account, to stop people guessing passwords or spamming forms.
Things you create
- Decks: name, format, description, a link to an outside deck site, a banner image, and the card list. For each card we keep which part of the deck it is in: main deck, sideboard, commander, companion or signature spell. We also keep the result of the deck's last format check.
- Groups: name, description, banner image, who is a member and who is an admin.
- Games: date, format, who played, which decks they used, who won, and an optional note about the win. Any member of a group can log a game and record which members played in it, so a game may record you even if you didn't log it. Only current members of the group can be recorded. To have your name removed, see "Your name in group history".
- Card bans: the card that was picked, the reason, who proposed it and how people voted.
- Achievements: which ones you were given, and in which group.
- Friends: friend requests, and who your friends are.
- Owner votes: your vote for a group's new owner, if a group loses its owner.
Images you upload
Profile pictures, deck banners, group banners and achievement icons. When you upload a JPG, PNG or WebP image we re-save it, which removes its hidden details (metadata), including where a photo was taken (GPS location).
We have also re-saved older JPG, PNG and WebP images the same way.
Two exceptions:
- GIF images (profile pictures, and some older banners) are stored exactly as they were uploaded, so animation works. Any text or data embedded in the file stays too, and anyone who can see the image can download it. Use a JPG, PNG or WebP if that matters to you.
- Older SVG profile pictures, uploaded before we stopped accepting SVG, are stored as they were sent. To remove one, upload a new picture or delete it.
Reports
- Bug reports and suggestions: what you wrote, the page you were on, and the report's status.
- Image reports: which image you reported and what happened to the report.
The waitlist
If you join the waitlist, we keep your email address (encrypted) and when you ticked the box to receive the launch email. If you joined before we started recording that, we have no record of when you ticked it. Joining the waitlist doesn't mean agreeing to our Terms; they apply once you have an account.
Joining the waitlist doesn't promise you an account or a date. We send waitlist members one email, when sign-up opens. If we invite you before then, you get the invitation too. When you use it, you leave the waitlist.
Invitations
If staff invite you, we keep your email address (encrypted), who invited you, and when the invitation was sent, used, ran out or was cancelled. We only keep a scrambled copy of the invitation code.
Server logs
Our server keeps logs of requests and errors. They record IP addresses, and errors can include the page address and your account number.
Why we use it, and the law that lets us
The law says we need a reason (a "lawful basis") for each use of your data. Here are ours.
| What we do | Lawful basis | What that means |
|---|---|---|
| Run your account, decks, groups, games, bans, achievements and friends, including the banners and icons you upload for them | Contract | We need it to give you the app you signed up for. |
| Send the emails your account needs: confirming your email, password resets, account deletion, and warnings before deletion | Contract | These are part of running your account. They are the only emails an account gets. |
| Keep the app safe: sign-in sessions, 2FA, passkeys, rate limits, server logs, reports, suspensions and the staff action log | Legitimate interests | We have a fair reason (keeping the app and your account safe), and it doesn't override your rights. |
| Keep your old games in your groups' history after you leave or delete your account | Legitimate interests | The group's history and stats would be wrong without them. |
| Keep what members write about each other in game notes and ban reasons | Legitimate interests | It is the group's own record of its games and bans. You can ask us to remove your name (see "Your name in group history"). |
| Staff invitations | Legitimate interests | While sign-up is invite-only, this is how new people join. |
| The waitlist and the one launch email | Consent | You gave it by ticking the waitlist box. It is separate from your account emails. You can change your mind at any time. |
| Your bio and profile picture | Consent | They are optional. Remove them whenever you like. |
| Keep a record of when you agreed to our Terms, and delete accounts that don't accept new Terms | Legitimate interests | We need to show who agreed to our Terms, and not keep accounts that haven't agreed. |
| Answer your privacy requests and make your data download | Legal obligation | The law says we must. |
| Anything else the law makes us do, like answering a court order | Legal obligation | The law requires it. |
We don't make automated decisions about you or build a profile of you.
Who can see your data in the app
| What | Who can see it |
|---|---|
| Your profile (name, picture, bio, decks) | You, your friends, and members of groups you are both in. Nobody else can find it. |
| Your achievements and stats | You see all of them. Other people only see the ones from groups you share with them. |
| Your friends list | Only you. |
| Your email address | Only you, and staff. |
| Your decks | You, your friends, and members of groups you are both in. |
| A group, its games, bans and achievements | Members of that group. |
| Friend requests | The person you send one to sees your name and picture. |
You can only add a friend with their friend code, which changes every day. Group invites can only come from friends.
Staff (one person, Ross) can see account names, email addresses, suspension reasons, groups, reports, and waitlist and invitation email addresses in a staff area. Every staff search and change in the staff area is logged, and so is every look at the waitlist or invitations. Staff can't see your password.
Group admins can remove members, edit or delete games, remove images in their group, edit the decks of members who turned that on, and delete the group.
Uploaded images are stored at web addresses that can't be guessed. Anyone who has the address of an image can open it, even though the pages that show it are private.
Who we share it with
We never sell your data. There are no ads, no analytics and no tracking pixels.
These companies help us run Card Portal. They only use your data to do that job for us.
| Company | What they do | What they get | Where | Safeguard if reached from outside the UK |
|---|---|---|---|---|
| DigitalOcean | Hosts our server and stores the database and images | Everything stored in the app | Stored in London, UK. A US company; its staff may reach the server for support. | The UK-US data bridge, with standard contract clauses as a fallback |
| Laravel Forge | Sets up and updates our server | Access to the server, and therefore to the data on it, for management purposes | A US company; it reaches our London server from outside the UK | The UK-US data bridge, under Laravel's data processing agreement |
| Mailjet | Sends our emails | Your email address and the email itself. It receives your address unencrypted, as it must to deliver the email. | European Union | None needed: UK law accepts that the EU protects data properly |
We have turned off Mailjet's open and click tracking, so our emails don't track you.
Your browser also loads some things straight from other companies. They see your IP address and browser type:
- Scryfall (US): card pictures and mana symbols.
- Bunny Fonts: the font the site uses.
Our server also gets card details from Scryfall (US). Once a day it downloads Scryfall's public list of all cards and keeps a copy in our database. Card searches and pasted deck lists are matched against that copy on our server, so what you type never goes to Scryfall. Only when a card isn't in our copy yet, or our copy of it is more than 30 days old, does our server ask Scryfall for it, by Scryfall's card ID. It never sends your name, email or anything else about your account.
If you click a deck link to another site, that site may see your visit like any other.
We will share data if the law makes us, for example a court order.
Where your data is stored
Our server and database are in London, UK. Some of the companies that help us run Card Portal are based outside the UK, and their staff can reach our server to manage it. Where that happens, we rely on a legal safeguard approved for UK transfers, named in the table above. Mailjet is in the European Union, which UK law accepts as adequately protective.
Cookies and similar technologies
We only use cookies the site needs to work. That's why there is no cookie banner.
| Cookie | What it's for | How long it lasts |
|---|---|---|
Session cookie (its name ends in _session) |
Keeps you signed in | Ends after 120 minutes without activity |
XSRF-TOKEN |
Stops other sites sending forms as you | Same as your session |
remember_web_… |
Keeps you signed in if you tick "Remember me" | Up to 30 days |
If you ticked "Remember me" before the date at the top of this policy, your browser may keep you signed in for up to 400 days from then. Signing out ends it.
We also store small notes in your browser tab (your scroll position on your profile page, and which tab you had open in group settings). They vanish when you close the tab.
If you close the notice we show when this policy changes, your browser remembers that until our next update. It stays on your device and we never see it.
Light or dark mode follows your device; no cookie is used.
If we ever want to add a cookie the site doesn't need, we will update this policy and ask you first.
How long we keep it
| Data | How long |
|---|---|
| Your account, decks, friends and profile | Until you delete them or your account |
| Accounts that never confirm their email | Deleted 30 days after the account was last changed, unless they have been used (for example they have decks, groups or friends) |
| Accounts that don't accept new Terms | Deleted 60 days after we first show you the new Terms, if you haven't accepted them. We always email a warning at least 7 days before. |
| Games | As long as the group exists. They stay after you leave or delete your account (see below). |
| Sign-in sessions | End after 120 minutes without activity; old records are then cleared |
| "Remember me" | Up to 30 days |
| Password reset requests | The link works for 60 minutes. The request is deleted within 24 hours of the link expiring. |
| Rate limit counters | They stop counting after at most 24 hours. Old counters are cleared the next time the same limit is checked. |
| Your data download link | 24 hours |
| Invitations | The link works for 7 days. Unused ones are deleted 30 days after they run out or are cancelled. A used one is kept with the account it created and deleted with it. |
| Waitlist | Deleted when you unsubscribe or use an invitation. Otherwise deleted 14 months after you joined, or 12 months after the launch email, whichever comes first. |
| Bug reports and image reports you sent | Until you delete your account |
| Reports other people made about an image | 12 months after the report is closed |
| Staff action log | 2 years |
| Emails that failed to send (who they were for, what they said and the error) | 30 days |
| Server logs (these record IP addresses) | 30 days |
| Short-lived copies of the database made before a major update | Deleted within 7 days |
We don't keep routine backups. Before a major update we take a short-lived copy of the database so we can roll back if something goes wrong. Those copies are deleted within 7 days. That means if something goes badly wrong, data could be lost.
When you delete your account
You delete your account from your profile page with your password, plus your passkey or 2FA code if you use one. If you use neither, we email you a link instead, and your account is deleted when you open it and confirm (the link works for 30 minutes). Deleting removes straight away: your account, profile picture, decks, friends, group memberships, ban votes, the achievements you were given, owner votes, reports, passkeys, 2FA secrets and backup codes, sign-in sessions and your invitation. The group's achievements themselves stay. We email you to confirm it's done.
Some things stay:
- Games you played keep a reference to your account, so the group's history and stats stay right. Pages show "Deleted user" and "Deleted deck" instead of your name. Notes about a game stay too, including any you wrote.
- Card bans you proposed stay with the group, with their reason. Pages show "Deleted user" instead of your name, and nothing links them to your account any more.
- Groups you own: if nobody else is in the group, it is deleted. If there is another admin, you choose who takes over. Otherwise, or if your account is deleted automatically, the members vote for a new owner.
- The staff action log may keep your account number for up to 2 years, and, if you were ever suspended, the reason staff wrote.
- Reports other people made about your images keep the number of the account, deck or group the image belonged to, until 12 months after each report is closed.
- Server logs for up to 30 days, and any short-lived database copy for up to 7 days.
Your name in group history
When you leave a group or delete your account, that group's games and bans stop showing your name. They show:
- "Former member" if you left the group but still have an account,
- "Deleted user" if your account is gone,
- "Deleted deck" where the deck used in a game is gone.
Some boxes let people type anything: game notes, ban reasons, deck names and descriptions, group and achievement names and descriptions, and bios. Someone may have typed your name, or something else about you, into one of them. We don't search these boxes when an account is deleted, so what was typed into something that stays (such as a game note) stays too.
If your name or anything else about you is in something that stays, email us and tell us where it is. We will remove it, or change it to "Former member", within one month. You can also ask the person who wrote it, or a group admin, to change it.
Your rights
You have the right to:
- See your data and take it with you. Use "Download your data" on your profile page. We email you a link to a file with your profile, decks, groups, games, achievements, bans and votes, friends and reports. For anything that isn't in it, such as your sign-in records or your images, email us.
- Fix it. Change your name, email, bio and picture on your profile, and your decks on each deck's page.
- Delete it. Delete your account from your profile page. To remove your name from something someone else wrote, see "Your name in group history" above.
- Leave the waitlist. Every waitlist email has an unsubscribe link.
- Take back consent. Remove your bio or picture, or leave the waitlist. This doesn't affect what we did before.
- Object to how we use your data, or ask us to limit it. Some of it we need to run your account and keep it safe, so if you object to that, we may not be able to keep your account going.
For anything you can't do yourself, email support@cardportal.online. We will reply within one month. If a request is complex, or you send several, we may take up to two more months; if so, we will tell you within the first month and explain why.
If you're unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk. If you live in the EU, you can complain to the data protection authority in your country.
Keeping your data safe
- Passwords are stored scrambled. 2FA secrets, waitlist emails and invitation emails are encrypted.
- The site uses a secure (HTTPS) connection.
- You must confirm your email to create decks, groups and games. Changing your email asks you to confirm it again.
- You can turn on 2FA and add passkeys.
- We limit how often people can try to sign in or send forms.
- Deleting your account needs your password, plus your passkey or 2FA code if you use one. Without either, we email you a link to confirm. We email you again when it's done.
- Uploaded images are re-saved to remove hidden details such as location (except GIFs and older SVG profile pictures; see "Images you upload").
- If a data breach puts your data at risk, we tell the Information Commissioner's Office within 72 hours of finding out. If it is likely to put you at high risk, we also tell you without undue delay.
To report a security problem, email support@cardportal.online with "Security" in the subject.
Age
You must be 16 or older to use Card Portal. You confirm this when you sign up. We don't ask for your date of birth. If we find out an account belongs to someone under 16, we will close it.
Because we only ask you to confirm your age, we assume some people using Card Portal are under 18 and design for them. We have assessed the risks to young people in a data protection impact assessment and a children's access assessment under the Online Safety Act.
If you are 16 or 17
The law gives extra protection to anyone under 18, and Card Portal is built with that in mind:
- Your profile and decks are private from the start. Only your friends and people in groups with you can see them, and nobody can search for you. People can only add you as a friend with your daily friend code.
- We don't track you, show ads, use analytics or build a profile of you.
- We don't keep your precise location. Photos are re-saved to remove where they were taken.
- Nothing in the app asks you to share more than you need to, and nothing rewards you for coming back every day.
- You can download your data or delete your account at any time from your profile page. If you're not sure about something, ask an adult you trust.
Changes to this policy
When we change this policy, we change the date and version at the top. If the change is important, we show a notice in the app for 30 days.
If we change our Terms, we ask you to accept the new version. If you do not accept the new Terms within 60 days of first being shown them, your account is deleted. We always email a warning at least 7 days before. You can download your data or delete your account instead of accepting.
Contact
- Email: support@cardportal.online
- Post: Ross Gray Digital, Enterprise Building, Rope Walk, Lincoln, LN6 7DQ