Privacy policy
Updated on November 7, 2026
DECKO stats is an app for TCG players to record matches and follow how their decks perform. It is a LLogWorks product. This page explains, in plain language, what data we keep, why, and who it is shared with.
What we keep
From your account: name, e-mail address and profile photo, provided by you or by Google when you sign in with it. From using the app: your decks (name, format, colors, notes, main deck and sideboard), matches (result of each game, play/draw, opponent, opponent's deck, league and date), the opponents and leagues you add and your card wishlists. We also keep technical access logs (date, IP address and errors) for security.
Your Google account data
If you choose "Continue with Google", we only request the basic sign-in scopes (openid, email and profile). With them we receive your name, e-mail address and profile photo, and we use this data only to create your account, identify you when you sign in and show your name and photo in the app. We do not access your contacts, Gmail, Drive, calendar or any other Google data, we do not sell this data, we do not use it for advertising and we do not transfer it to third parties, except Clerk, which processes sign-in on our behalf. DECKO stats' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
What we use it for
To run the app: show your decks, matches and statistics (winrate, matchups, play/draw), keep your account secure and answer when you ask for help. The data you record is private to your account and is not shown to other users. The legal basis (Brazil's LGPD) is performing the service you asked for when you created the account and, for security logs, our legitimate interest and Brazil's Marco Civil da Internet.
Where the data lives
The website runs on Cloudflare, and your data is stored in a PostgreSQL database on a LLogWorks-operated server, with backups in the same environment. Database access is restricted to the DECKO stats API.
How long
We keep your data while your account exists. If you ask us to delete your account, we delete the account and the decks, matches, opponents, leagues and wishlists linked to it; older backups are discarded in the normal rotation cycle.
Your rights
You can ask to access, correct, export or delete your data, and you can revoke the Google sign-in permission at any time (at myaccount.google.com/permissions). For any request, write to the e-mail address at the end of this page: we answer within 15 days.
What we don't do
We don't sell data, show ads, use third-party tracking tools or use your data to train AI models.
Changes to this policy
If this policy changes in a meaningful way, we will let you know in the app or by e-mail before the new version takes effect. The date at the top shows the current version.
Who else receives data
We use few third-party services, and each one receives only what it needs:
Clerk
United StatesProcesses sign-in and stores your account (name, e-mail, photo, hashed password and sessions). When you sign in with Google, Clerk receives the Google data on our behalf.
Google
United StatesOnly if you choose to sign in with Google: Google authenticates you and tells us your name, e-mail and photo.
Cloudflare
Global networkHosts the website and provides the secure connection to our API. It sees requests (IP, page addresses) like any hosting provider.
Scryfall
United StatesSource of Magic card data and images. Card search goes through our API, with none of your data; images are loaded by your browser straight from Scryfall's servers, which therefore see your IP.
Questions or requests about your data: privacidade@deckostats.com

