Your information, explained.

Updated September 15, 2026. This notice describes the current My Deck Needs Help accounts, saved decks, Community and mock simulator.

Accounts and security

Public accounts are available. We store your email, verification status, display name, stable account identifier, password hash when used, linked provider identifiers, session records including connection information, and MFA/security records. These support sign-in, recovery, account protection and abuse prevention. Google supplies basic identity information only; we do not request Gmail or Drive access.

Service providers

Cloudflare hosts the application, verifies anti-bot challenges with Turnstile, protects connections and forwards incoming support mail. Neon stores account data. Resend delivers verification, reset and security emails. Google processes Google sign-in if you choose it. Authentication establishes identity; application permissions remain controlled by My Deck Needs Help.

Cookies and retention

Essential, secure authentication cookies keep you signed in for up to 30 days. You can sign out one session or all devices. Password-reset and verification links expire after ten minutes. Expired session and verification records are removed by bounded maintenance batches. Account and provider records are retained while the account remains open; security notification and audit records are retained for investigation and account protection. Backups may retain earlier records within the provider recovery window. We use no advertising trackers. Anonymous first-party counts help us understand page views and feature usage. These counts use no visitor identifier or analytics cookie and respect Do Not Track and Global Privacy Control. Aggregate metrics and availability samples are retained for 30 days; grouped operational errors for 7 days and observed build references for 90 days. Keyed network hashes are used separately for short-lived abuse limits.

Decklists and reports

The mock simulator processes submitted deck text transiently. It does not save submitted decklists as library decks, log deck contents, fetch deck links, or run real game engines. Reports are synthetic examples. New hosted mock runs require a verified account. Free report retrieval expires after 1 hour. Historical Guest reports keep their original 5-minute retention. Keyed network/request hashes and short-lived receipts support abuse controls. Minimal usage receipts remain for the rolling 24-hour allowance, then bounded maintenance removes them. Expired report content is removed in maintenance batches. Visitors have no hosted simulation allowance; a verified Free account has its own two-report allowance. Report-preview depth does not change your account tier.

Saved decks and Community

When you choose to save a deck, we store its content, versions and organization separately from mock inputs. Private decks require owner access. Unlisted links can be shared with anyone who has the link; public publications can appear in discovery. Publications pin a chosen version. Community stores posts, replies and interaction/moderation records under your public handle. Contact support about deletion and retained version or audit history; unpublishing is not deletion of all stored records.

Your choices and questions

You can manage sessions and MFA on the account page. support@mydeckneedshelp.com handles account recovery, privacy and deletion requests. We verify account ownership before making sensitive changes. Never send passwords or recovery codes by email. Public billing remains unavailable. Saved deck versions are immutable; public and unlisted publications pin a chosen version. Private deck content is not advertising data. Future sponsorship eligibility is evaluated from application entitlements; ads remain off. Community posts use your chosen public handle; your email remains private.

Operational information

Limited operational logs record service outcomes, without authentication secrets, message contents or request query strings. Our hosting providers process connection information needed to operate their services. See Cloudflare’s privacy policy, Neon’s privacy policy and Resend’s privacy policy.