CardForge

Privacy Policy

Last updated: October 6, 2026

This Privacy Policy explains what information CardForge (“we”, “us”) collects when you use the Service, why we collect it, and how you can control it. By using the Service you agree to the practices described below.

CardForge is operated by Dan Ryan Chan, a sole proprietor based in British Columbia, Canada, who is responsible for the personal information described in this policy.

1. Information we collect

Account information

  • Name (display name)
  • Email address
  • Username
  • Hashed password (only if you sign up with email + password)
  • OAuth provider id and avatar URL (only if you sign in with Google or Discord)
  • Optional profile bio and avatar image

Service data

  • Decks you create (cards, names, descriptions, visibility flags) and their saved versions
  • Battle Journal entries you log (deck, opponent archetype, result, event type, and any notes you add)
  • Comments on public decks, favourites, and friend connections
  • In-app notifications
  • Feedback you submit through the in-app widget, and reports you file about other users’ content
  • Stripe customer id and subscription status if you upgrade to Pro (we never store full card numbers; Stripe handles that directly)

Technical data

  • IP address and approximate region (used for rate limiting and abuse prevention)
  • Browser user-agent string (used for feedback diagnostics)
  • Cloudflare Turnstile challenge results (passed when you create an account or request a password reset)
  • Aggregated, cookieless page-view counts and page-load performance via Vercel Analytics and Vercel Speed Insights
  • Usage analytics via Google Analytics 4 (pages viewed, approximate location, device/browser type), only if you accept analytics cookies. If you decline, Google Analytics runs in a cookieless, consent-denied mode and we receive only aggregated, modelled estimates
  • Error reports (stack traces, request paths) via Sentry when something breaks; we do not intentionally include your personal data in these reports

2. How we use your information

  • To create and operate your account
  • To provide, maintain, and improve the Service
  • To process subscription payments (via Stripe)
  • To send essential transactional email via Resend (account verification, password resets, welcome, Pro trial and subscription notices, failed-payment alerts). Payment receipts come from Stripe
  • If you signed in with Discord, to give you the Pro role on the CardForge Discord server while your subscription is active
  • To detect, investigate, and prevent abuse, fraud, and security incidents
  • To respond to your support requests

We do not sell your personal information. CardForge shows third-party advertising to users who are not Pro subscribers; section 3 explains how advertising cookies are handled. Pro subscribers see no advertising.

3. Cookies and similar technologies

Strictly necessary. CardForge uses a first-party session cookie (authjs.session-token or its __Secure- prefixed variant in production) to keep you signed in, and a small cf_consent cookie to remember your cookie choice. These are required to operate the Service and are always set.

Analytics. Google Analytics 4 sets first-party analytics cookies (e.g. _ga) only after you click “Accept” on our cookie banner. We use Google Consent Mode v2, so until you accept, analytics storage is denied and no analytics cookies are set. Vercel Analytics remains cookieless and aggregated.

Advertising.CardForge uses Google AdSense to show ads to users who are not Pro subscribers. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this site and other websites. Google’s use of advertising cookies lets it and its partners serve ads to you based on those visits. Under Google Consent Mode v2, advertising storage is denied by default, and we will ask for your consent before any personalised advertising cookies are set. You can opt out of personalised advertising in Google’s Ads Settings, or opt out of some third-party vendors’ use of cookies for personalised advertising at aboutads.info. Pro subscribers are not shown ads.

You can change your choice at any time via the Cookie settings link in the site footer.

4. Sub-processors

We share limited information with the following third-party providers so that they can perform services on our behalf:

  • Neon: managed PostgreSQL database (your account, decks, Battle Journal, comments, favourites, friendships, feedback)
  • Vercel: web hosting, serverless functions, image delivery, cookieless analytics and performance monitoring
  • Stripe: payment processing for Pro subscriptions
  • Railway: hosts the CardForge AI service that sends AI feature requests on to Anthropic
  • Anthropic: Claude API for AI deck features (we send deck lists, card data, aggregated Battle Journal results, and the request; we do not send your name or email)
  • Resend: transactional email delivery
  • Upstash: Redis used for rate limiting and short-lived caching (rate-limit counters are keyed by IP address or account id and expire automatically)
  • Cloudflare: Turnstile captcha on registration and password reset
  • Google and Discord: sign-in, if you choose either one. Discord also receives your Pro status as a server role if you signed in with Discord
  • Sentry: error and performance monitoring
  • Google Analytics: usage analytics (only with your consent)
  • Google AdSense: advertising delivery and measurement for users who are not Pro subscribers

Each provider is contractually bound to handle your information in accordance with applicable data-protection law.

5. Retention and deletion

We retain your account information for as long as your account is active. You can delete your account at any time from Settings → Danger Zone; deletion immediately removes your decks, Battle Journal, favourites, friendships, sessions, and OAuth links. Your Stripe subscription is cancelled as part of the same flow.

Feedback you previously submitted may be retained in anonymized form (with your user reference removed) so that we can continue to improve the Service. Backup copies of database state are retained for up to 30 days for disaster recovery and then expire automatically.

6. Security

We use HTTPS everywhere, hash passwords with industry-standard algorithms, keep the database reachable only from our own servers, and rate-limit sensitive endpoints. No system is perfectly secure; if you suspect your account has been compromised, contact us immediately.

7. International transfers

Our infrastructure is hosted in the United States. If you access the Service from outside the US your information will be transferred to, and processed in, the United States.

8. Your rights

Depending on your jurisdiction you may have the right to access, correct, delete, or export your personal information, or to object to certain processing. You can exercise most of these rights directly from the settings page; for anything else, contact us at the address below and we will respond within a reasonable timeframe.

Data export. You can download a JSON copy of your CardForge data (your profile, decks, Battle Journal, comments, favourites, friendships, notifications, feedback, and reports) from Settings → Profile → Your data → Download my data. Exports are rate-limited to one download per hour. For any other PIPEDA or GDPR data request, email support@cardforgeapp.gg.

9. Children

The Service is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child has provided us with information, please contact us so that we can delete it.

10. Changes

We may update this policy from time to time. Material changes will be announced via in-app notice or email.

11. Contact

Questions or requests? Email support@cardforgeapp.gg.