Privacy Policy

Last updated: 6 June 2026

This policy explains what personal data Cardboard Deals (“we”, “us”) collects when you use this website, why we collect it, who we share it with, and the rights you have over it. If you have any questions, email hello@cardboarddeals.com.

Who we are

Cardboard Deals is a Magic: The Gathering deal-finding and collection-tracking service operated by Byte Studio Limited, a company registered in England and Wales (company number 11081608), with its registered office at 51 Ashtree Road, Norwich, England, NR5 0LR. Byte Studio Limited is the data controller for the personal data described here.

What we collect

Account data. When you register we store your email address and an encrypted password, or — if you sign in with Google or Discord — the basic profile information (such as email, display name, and avatar) that provider shares with us. If you enable two-factor authentication we store the data needed to verify your codes.
Profile & collection data. Anything you choose to add — your display name and public slug (if you opt into a public profile), the cards in your collection, acquisition prices, and notification preferences.
Click tracking. When you click an outbound link to a marketplace listing, we record the click and a country-level location derived from your network (via Cloudflare). We do not store your IP address. These records are used for affiliate attribution and aggregate analytics.
Push subscriptions. If you enable web push notifications, we store the subscription token your browser provides so we can send them.
Technical & error data. Standard server logs and error reports (via Sentry) that help us keep the site running and secure.

Cookies

We use cookies that are necessary for the site to work — to keep you signed in, protect forms against cross-site request forgery, and remember preferences such as your light/dark theme. We do not sell your data or use third-party advertising cookies.

Affiliate links

Some outbound links to marketplaces are affiliate links. When you follow one and make a qualifying purchase, we may earn a commission at no extra cost to you, as a member of the eBay Partner Network. To attribute commissions, an anonymous tracking token is attached to the outbound link; the marketplace’s commission report is reconciled back to your click using that token. Commission amounts are never shown publicly.

Who we share data with

We share data only with the service providers needed to run Cardboard Deals:

eBay — marketplace listing data and the eBay Partner Network affiliate programme.
Scryfall — Magic: The Gathering card data and images.
Google and Discord — only if you choose to sign in with them.
Cloudflare — content delivery and the country-level location signal.
Sentry — error monitoring.
Our email provider, to send account and notification emails.

We do not sell your personal data to anyone.

How long we keep it

We keep your account and collection data for as long as your account exists. Outbound-click records are automatically deleted after 90 days. You can delete your account and associated data at any time from your account settings.

Your rights

Under UK and EU data protection law you have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. We provide self-serve data export and account deletion in your account settings. To exercise any other right, or to make a complaint, email hello@cardboarddeals.com. You also have the right to complain to the UK Information Commissioner’s Office (ICO).

Children

Cardboard Deals is not directed at children under 16, and we do not knowingly collect their data.

Changes

We may update this policy from time to time; the “last updated” date above reflects the latest version. Material changes will be highlighted on the site.