Privacy policy

Effective October 1, 2026

Mana Vault is a Magic: The Gathering collection and deck service available at app.manavault.cards and through its ChatGPT and Codex plugin. This policy describes information handled by Mana Vault. Contact us at Frioaj1@gmail.com with privacy questions.

Information we handle

How we use it

We use this information to provide account access, scan cards, enrich card data, manage collections and decks, support social and trade features, process subscriptions, respond to support requests, measure usage and advertising, prevent abuse, and keep the service working. Passwords and session or OAuth tokens are stored as verifiers or hashes rather than plaintext credentials.

Plugin connections

When you connect Mana Vault to ChatGPT or Codex, the plugin receives a scoped connection to your Mana Vault account. The tools can return card names, quantities, locations, deck names, notes and contents, saved review summaries, and card metadata to the connected OpenAI product when requested. If you grant trade-read access, tools can return the offered cards and username of the other participant in a trade you can access; they do not disclose that person's full collection. Tools with write permission can change collection quantities or decks in response to your request. Proposed changes are saved for your review before they are applied. When ChatGPT identifies cards from a photo, this intake flow sends names and quantities to Mana Vault rather than the photo itself. OpenAI processes information in its own product under its policies. You can disconnect the plugin in ChatGPT or Codex.

Services that help run Mana Vault

Cloudflare hosts the app and stores account and vault data. Scryfall supplies public card information and pricing. OpenRouter processes photos or deck information when you use AI features. Stripe handles subscription checkout and billing; Mana Vault stores billing status and identifiers, not full payment card numbers. Microsoft Clarity and Meta or Reddit measurement tools may receive website activity and technical information for analytics and advertising. Friends receive only the information exposed by the sharing and trade features you use.

Retention and security

We keep your account, collection, decks, scan results, and other vault records while your account is active. If you ask us to delete your account, we remove its account and vault records after verifying the request, except information we must retain for a legal, billing, security, or dispute reason. Temporary scan photos are deleted after processing or when the one-hour processing-storage limit expires. Scan results can remain in your account until you remove them or request account deletion.

App login sessions expire after 30 days. Plugin authorization codes expire after five minutes, access tokens after one hour, and refresh tokens after 30 days; expired authorization records are purged during subsequent authorization activity. Service logs and backups may remain under the relevant provider's retention schedule after account data is removed. Contact us for details about a particular deletion request. We use HTTPS, access controls, and user-scoped data access. No online service can guarantee absolute security.

Plugin change previews expire after 30 minutes and expired unused previews are removed during daily cleanup. Receipts for applied proposals are retained for 30 days to prevent retries from adding or changing cards twice, then removed during daily cleanup.

Your choices

You can edit or remove cards and decks in the app, disconnect the plugin, and ask us to access, correct, or delete account data by emailing Frioaj1@gmail.com. We may need to verify your identity before acting. Rights and response times depend on applicable law. Browser settings may limit some analytics or advertising technologies.

Updates

We may update this policy as the service changes. The effective date at the top shows when this version took effect.