Privacy Policy
Commandery (“the Service”, “we”, “us”) is a small tool for tracking Magic: The Gathering Commander games within your play group. This policy explains what personal data we collect, why, and the rights you have over it. We keep it short because we keep the data collection small: we don’t run ads, we don’t use third-party analytics or trackers, and we never sell your data.
Who is responsible for your data
The Service is built and operated by an individual in Denmark. For the purposes of the EU General Data Protection Regulation (GDPR), that operator is the data controller. You can reach us using the contact details at the end of this policy.
What we collect
- Account details — your first name, last name and email address, plus a securely hashed version of your password (we never store the password itself).
- Content you create — the pods you make or join, player names, game results and history, commander/deck details, and any avatar you choose.
- Technical data — a single login session cookie, and standard server logs (such as IP address and timestamps) that our host records to keep the Service running and secure.
- Security & audit records — a log of key account and pod actions (for example member and admin changes) that we keep to protect the Service and investigate abuse.
Some content you enter is about other people — the names of players in your pod. Please only record what you have a reasonable basis to record, and see “Data about other players” below.
Why we use it, and our legal basis
- To provide the Service — creating your account, saving your pods and games, showing your stats. Legal basis: performance of our agreement with you.
- To send essential emails — email verification and password resets. Legal basis: performance of our agreement with you.
- To keep the Service secure and working — abuse prevention, debugging, backups. Legal basis: our legitimate interest in operating a safe, reliable service.
We do not use your data for advertising or profiling, and we do not sell or rent it to anyone.
Cookies
We use exactly one cookie: a strictly-necessary session cookie that keeps you logged in. It is not used for tracking or advertising, and because it is essential to a service you asked for, it does not require a consent banner. We use no analytics, advertising or third-party tracking cookies of any kind.
Who we share it with
To run the Service we rely on a small number of processors, who handle data only on our instructions:
- Our hosting provider — runs the application servers and the database where your account and game data live.
- Our email provider — delivers verification and password-reset emails. This provider processes your email address for that purpose.
- Our donations provider — only if you choose to donate. Donations are handled entirely on their platform; we never see your card or payment details.
Some of these providers may process data outside the EU/EEA. Where that happens, transfers are covered by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
How long we keep it
We keep your account and content for as long as your account exists. If you delete your account, or ask us to delete it, we remove your personal data from the live Service. Note that games you took part in remain in your pod’s shared history so those records stay intact — your name may still appear there, but it is no longer linked to any account. Encrypted backups are retained for 30 days and then automatically deleted, so residual copies in backups are purged within that window. Security and audit-log records are kept for up to 1 year and then automatically removed. We may retain minimal records where the law requires it.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- receive your data in a portable format;
- object to, or ask us to restrict, certain processing;
- withdraw consent where we rely on it.
To exercise any of these, contact us using the details below. You also have the right to complain to your local data protection authority — in Denmark, that is Datatilsynet (datatilsynet.dk).
Data about other players
When you add players to a pod, you may enter names of people who don’t have their own account. You are responsible for having a legitimate reason to record that information. If someone asks to be removed from a pod’s records, the pod owner can edit or delete them, or you can contact us for help.
Children
The Service is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child has given us personal data, please contact us and we will remove it.
Changes to this policy
We may update this policy as the Service evolves. When we make material changes we will update the date at the top, and where appropriate we’ll let you know in the app or by email.
How to reach us
Questions about your data, or want to exercise a right above? Email morten@flyver.dk and we’ll help.
Fan content notice. Commandery is unofficial Fan Content permitted under the Wizards of the Coast Fan Content Policy. Not approved or endorsed by Wizards. Portions of the materials used are property of Wizards of the Coast. ©Wizards of the Coast LLC. See our Terms of Use for details.