Privacy Policy

Last updated: June 2, 2026

MTG Burrow ("we", "us", "the site") is a free, community-run collection tracker and trade tool for Magic: The Gathering playgroups. This policy explains what we collect, why, and the choices you have. The short version: we collect only what the site needs to work, we do not sell your data, and you can delete your account and its data at any time.

Information you provide

Most of what we hold is information you give us directly by using the site:

  • Account information. Your email address, username, and password. Passwords are handled by a dedicated authentication provider and stored in hashed form; we never see or store your raw password.
  • Optional profile details. A Discord username and a real name, if you choose to add them. Both are optional, and you control whether either is shown to other users.
  • Your collection and related data. The cards you add (including set, printing, quantity, condition, and foil status), your binders, your decks, and any optional Moxfield collection URL you save for syncing.
  • Social and trade data. Your friend connections, the groups you join, and the trade requests and messages you send or receive through the site.
  • Support data. Messages you send us through the contact / support form or by email, so we can respond to you.

Information collected automatically

When you use the site, some technical information is collected automatically to keep it running and help us improve it:

  • Usage analytics. Aggregate, non-identifying usage data such as page views and feature interactions. See "Analytics" below for what is and is not collected.
  • Standard technical data. Basic information your browser sends with each request (such as device and browser type) and routine server logs, used to operate and secure the site.

How we use your information

We use the information above only to operate and improve the site:

  • To create and authenticate your account.
  • To store and display your collection, binders, and decks, and to power search across your own and your playgroup's collections.
  • To enable friends, groups, and trade requests between you and other members you connect with.
  • To respond to support requests you send us.
  • To understand aggregate usage so we can fix problems and decide what to build next.

We do not use your data for advertising, and we do not build advertising profiles about you.

We do not sell your data

We do not sell, rent, or trade your personal information to anyone. We do not share your collection or profile with third parties for their own marketing. The only sharing that happens is the sharing you choose inside the site (with friends and groups) and the service providers and data sources described below that are necessary to make the site work.

What other members can see

MTG Burrow is built for playgroups, so some data is shared with other members by design. You control this through your privacy settings:

  • Collection visibility. You choose whether your collection is visible to friends and groups, to friends only, or kept fully private.
  • Binders and decks. You can independently hide or show your binders and decks.
  • Profile fields. You choose whether your real name and Discord username are shown.
  • Card-level controls. You can hide cards above a price threshold, and set a minimum quantity below which cards are hidden from others.

Your email address and password are never shown to other members.

Service providers and data sources

We rely on a small number of trusted third parties to run the site. They process data only as needed to provide their service to us, under their own security and privacy obligations:

  • Cloud hosting and infrastructure. A major cloud provider hosts the site and stores its data, and handles account authentication on our behalf. Your data is held within that provider's infrastructure.
  • Analytics. A third-party analytics service helps us understand aggregate usage. See "Analytics" below.
  • Scryfall. Provides card data, card images, and price information that the site displays. See our attribution page.
  • ManaPool. When you leave the optional ManaPool integration enabled, the site looks up live marketplace prices for specific card printings shown in trade dialogs. You can turn this off in settings.
  • Moxfield and Manabox. Only when you choose to import or sync. Imports are initiated by you and use data you provide (an export file or a collection URL).

Analytics

We use a third-party analytics service to understand how the site is used in aggregate. We deliberately avoid sending personal information to analytics: the only per-user identifier passed to it is an opaque, randomly generated account identifier. We do not send your email, username, real name, Discord name, or the contents of your collection or searches as analytics parameters.

Cookies

We use cookies that are necessary for the site to function, including a secure cookie that keeps you signed in and refreshes your session. Our analytics provider also sets cookies to measure usage. We do not use advertising or cross-site tracking cookies.

Most browsers let you block or delete cookies through their settings. Blocking the necessary cookies may stop you from staying signed in or using some features. To learn more about managing cookies, see your browser's help pages.

How we protect your data

We use reasonable technical and organizational measures to protect your information, including encrypted connections and access controls. No method of transmission or storage is perfectly secure, so while we work to safeguard your data we cannot guarantee absolute security.

Links to external sites

The site links to third-party websites and services. This policy does not cover how those third parties handle your information; their own privacy policies do. We are not responsible for the practices of sites we link to.

Do Not Track

Some browsers offer a "Do Not Track" signal. There is no common industry standard for how to respond to it, so the site does not currently change its behavior based on that signal. We limit tracking regardless, as described in "Analytics" and "Cookies" above.

Data retention and deletion

We keep your data for as long as your account is active. You can delete your account at any time from your settings page. Deleting your account permanently removes your profile and settings, your card collection, your binders and decks, your group memberships, and your friend connections. Some records that involve other members (such as a trade request you sent to someone else) may persist in that member's view, and routine backups or logs may retain data for a limited period before being cycled out.

Your choices

  • View and update your profile and privacy settings at any time.
  • Control collection, binder, deck, and profile-field visibility.
  • Turn the optional ManaPool integration on or off.
  • Delete your account and its associated data.
  • Contact us with any privacy question by email at admin@mtgburrow.com, or through the contact form if you have an account.

Your rights

Depending on where you live, you may have rights to access, correct, export, or delete the personal information we hold about you, and to object to or restrict certain processing. You can exercise most of these directly from your settings page, or contact us at admin@mtgburrow.com and we will respond within a reasonable time.

California residents

If you live in California, you have rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information we collect, to access or delete it, and to not be discriminated against for exercising these rights. Two points specific to MTG Burrow:

  • We do not sell or "share" your personal information as those terms are defined under California law, and we do not use it for cross-context behavioral advertising.
  • You can exercise your access and deletion rights yourself from your settings page, or by emailing us at admin@mtgburrow.com. We will not charge you or treat you differently for making a request.

Children's privacy

The site is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us at admin@mtgburrow.com and we will remove it.

Changes to this policy

We may update this policy as the site evolves. When we do, we will change the "Last updated" date at the top. Significant changes will be noted on the site.

Contact

Questions about this policy or your data? Email us at admin@mtgburrow.com, or use the contact form if you have an account. See also our Terms of Service and Legal & Attribution pages.