Cookie Policy

This Cookie Policy explains how Spellbinder LLC, a Minnesota limited liability company ("Spellbinder," "we," "us," or "our"), uses cookies and similar technologies, including browser storage such as local storage, session storage, and IndexedDB, when you use Spellbinder's website, applications, content, and related services (collectively, the "Service").

1. What are cookies

Cookies are small text files stored on your device by your browser. Similar technologies include local storage, session storage, IndexedDB, pixels, SDKs, and other tools that help websites remember information, keep users signed in, support features, or measure performance.

In this Cookie Policy, we use "cookies" as a shorthand for cookies and similar technologies unless we say otherwise.

2. Cookies we set

Spellbinder sets a small number of first-party cookies. None of them are used for advertising or cross-site tracking.

Essential authentication and security

These cookies are necessary for account features and core site security. Server-side abuse prevention and rate limiting use your IP address in short-lived server memory and do not set a cookie.

The cookie lifetimes above are browser storage limits, not guarantees of how long a login or sign-in code stays valid. Authentication tokens and codes have separate expiration and revocation rules. Your browser may remove cookies sooner.

Functional preferences

These cookies support the layout controls and saved preferences on the relevant pages. They may also be updated when a page loads to reflect the layout currently available to your account.

3. Browser storage we use

Spellbinder also stores information in your browser's local storage, session storage, and IndexedDB. This information stays on your device and is not sent to us except as part of using the feature it supports.

Interface preferences (local storage)

Theme choice; docs navigation state; table column visibility; deck builder preferences such as the default add-from source and the collection ownership overlay; card detail behavior; collection dashboard settings such as location, widget lenses, and trend windows; playtest layout and game preferences.

Working state and cached data

• Deck search filters (local storage): the card filters you have applied to a deck search.
• Archetype names (local storage): a cache of archetype labels to speed up search.
• Scanner session (local storage): the in-progress list of cards you have scanned but not yet saved, including any quantities, prices, and notes you entered, and the camera you selected. It is cleared when you finish or clear the session.
• Scanner models (IndexedDB): the card recognition models and card catalog the scanner runs on your device. These are large files cached so the scanner does not have to download them each time.
• Import leftovers (session storage): decklist lines that could not be matched during a paste import, kept until you close the tab.
• Sign-out redirect and billing notice state (session storage): where to send you after signing out, and whether you dismissed a past-due payment notice.

Unless a feature clears it sooner, local storage and IndexedDB have no automatic time-based expiry and may remain until you clear site data or your browser removes it. Session storage normally lasts for the tab's session, although restoring a browser session can restore that data. Signing out or deleting your account does not necessarily clear these stores. On a shared device, clear Spellbinder's site data after saving any work you want to keep.

4. Analytics and error reporting

Spellbinder does not use advertising cookies, third-party analytics cookies, or cross-site behavioral advertising profiles. We currently do not display a cookie consent banner. The descriptions below explain what our analytics and diagnostic services collect; cookieless collection can still involve personal information.

We do use three services that do not set cookies:

• Vercel Web Analytics provides aggregate visitor and page-view statistics. It receives page addresses, referrer information, browser and device characteristics, and approximate location derived from the incoming request. It distinguishes visitors using a request-derived hash discarded after 24 hours, without setting an analytics cookie. See Vercel's analytics privacy information.
• Vercel Speed Insights measures how quickly pages load and respond (Core Web Vitals) so we can find slow pages. It receives the page address, browser and device characteristics, network connection type, and timing measurements, and does not set a cookie or identify individual visitors. See Vercel's Speed Insights privacy information.
• Sentry receives error reports and a sample of performance measurements so we can fix bugs. We disable default personal information collection and session replay, and restrict server-side request data. Reports may still include personal information in page addresses, error messages, or other technical context. Sending them through our own domain does not prevent Sentry from receiving them.

Public deck view counts use a short-lived hash computed on our servers, described in our Privacy Policy, and do not store anything in your browser.

Where applicable law requires consent for a technology or purpose, we must obtain it before using that technology or purpose. If we introduce such uses, we will update this policy and provide the required controls before enabling them.

5. Third-party cookies and similar technologies

Some third parties may set or read their own cookies or similar technologies when you interact with their services through Spellbinder or after you leave Spellbinder, including:

• Supabase, which provides our authentication and session infrastructure. The authentication cookies above are set by Supabase's software on our domain. See the Supabase Privacy Policy;
• Google and Discord, during third-party sign-in or account-linking flows, and when a page shows a profile avatar that is served from Google or Discord;
• Stripe, on Stripe's own checkout and billing pages when you start or manage a paid plan. Spellbinder does not load Stripe scripts on its own pages;
• Cloudflare, which serves our card images, avatars, and other assets and may set its own security cookies on those asset domains;
• external websites you visit after clicking outbound links, including retailer or marketplace links.

Some providers we use for hosting, email delivery, infrastructure, or security process IP addresses, request metadata, or similar technical information without placing browser cookies on your device. Their policies explain their practices; our Privacy Policy describes the information we disclose to them and our use of their services.

6. Managing cookies

You can usually control cookies and similar technologies through your browser or device settings. Depending on your browser, you may be able to:

• block or delete cookies;
• clear local storage, IndexedDB, or site data;
• set preferences for individual sites;
• receive alerts before certain cookies are stored.

Blocking essential cookies or clearing related storage may prevent parts of Spellbinder from working correctly, especially sign-in, account management, and saved preferences. Clearing site data can permanently remove unsaved scan lists and import work. Clearing IndexedDB makes the scanner re-download its models the next time you use it. Cookie controls alone may not stop cookieless analytics or diagnostic requests, and clearing browser data does not delete information already stored on our servers.

7. Browser privacy signals

Some browsers send "Do Not Track" or Global Privacy Control signals. Spellbinder does not sell personal information or use it for targeted or cross-context behavioral advertising, so Global Privacy Control does not change those practices. We do not otherwise change the Service in response to "Do Not Track" signals. These signals are different from blocking cookies and do not automatically disable the analytics and diagnostics described above. This does not limit any opt-out rights or duties to honor browser signals under applicable law.

8. Updates to this policy

We may update this Cookie Policy from time to time. If we make material changes, we will update the date above and may provide additional notice where appropriate.

9. Contact us

If you have questions about this Cookie Policy, contact us at support@spellbinder.gg.