Privacy Policy
Effective April 25, 2026 · Last updated April 25, 2026
Tome of Legends (“the app”, “we”, “us”) is a Magic: The Gathering game tracker for iOS. This policy explains what data we collect, why we collect it, and what you can do about it. We aim to keep this short and readable. If something is unclear, email us at support@tomeoflegends.co.
What we collect
When you sign up and use Tome of Legends, we collect:
• Account data — email address and a password (passwords are hashed by our auth provider; we never see your plaintext password).
• Profile data — display name, optional avatar (an image you upload, or one generated by the app), and your commander/deck preferences.
• Game data — game records you create or participate in, including life totals, dates, decks used, who played, and game outcomes.
• Deck data — deck lists you import (from Archidekt or Moxfield) or create manually, and the cards and commanders associated with them.
• Friend and playgroup data — friend connections, playgroup membership, and aggregate stats about opponents you’ve played with inside the app.
• OAuth identifiers (optional) — if you sign in with Apple or Google, we receive the identifier those services share with us. We don’t receive your password.
• Push notification token (optional) — if you allow notifications, your device’s push token so we can deliver game invites and friend requests.
We do not collect: location, contacts, photos beyond avatars you choose to upload, advertising IDs, or device fingerprinting data.
Why we collect it
• Account data — to create and secure your account.
• Profile, game, and deck data — to make the app work: tracking your stats, showing your history, and rendering decks and commanders.
• Friend and playgroup data — to power the social features (friend lists, playgroup stats, shared games).
• OAuth identifiers — to let you sign in without a password.
• Push tokens — to send you notifications you’ve opted into.
How “Ask a Judge” works
Ask a Judge is an AI rules assistant. When you ask a question, the question text — and any minimal game context you’ve explicitly attached — is sent through our backend to OpenAI (currently GPT-4o mini) to generate an answer. We don’t send your full game history, friend list, or any data unrelated to the question. OpenAI processes the request under their API terms and does not use API content to train their models by default.
Where your data lives
Your data is stored in Supabase, a managed PostgreSQL service. The database, authentication, file storage (avatars), and serverless backend functions all run on Supabase infrastructure. Supabase data centers are located in the US and EU.
Third parties we share data with
We use a small number of vetted services to operate the app. We don’t sell your data, share it with advertisers, or run third-party analytics or tracking SDKs.
Supabase
Database, auth, storage, and backend. Sees all your account, profile, game, and deck data.
Apple Sign In / Google Sign In
Optional sign-in. Sees your provider-issued identifier and email only.
OpenAI
Powers Ask a Judge. Sees the text of your rules question and any context you attach.
Scryfall
Magic card data. Anonymous card lookup queries only — no account info attached.
Your rights
• Delete your account — open the app, go to Settings → Delete Account. This removes your profile, games, decks, and friend connections.
• Export your data — available on request. Email support@tomeoflegends.co and we’ll send your data within 30 days.
• Correct your data — you can edit your profile, decks, and game records directly in the app.
• EU/UK users — under GDPR, you also have the right to object to processing, restrict processing, and lodge a complaint with your data protection authority.
• California users — under CCPA, you have the right to know what we collect and to request deletion. We don’t sell personal information.
Children
Tome of Legends is not directed at children under 13 (or under 16 in the EU and UK). We don’t knowingly collect data from children below those ages. If you believe a child has signed up, email us and we’ll delete the account.
Cookies and tracking
The iOS app does not use web cookies. We do not embed third-party advertising or analytics SDKs. The only tracking we do is operational: logging what’s needed to run your account, sync your games, and deliver push notifications you’ve opted into.
Security
Passwords are hashed by Supabase Auth. Connections between the app and our backend use HTTPS/TLS. We follow standard practices for storing credentials and tokens. No system is perfectly secure — if you suspect your account has been compromised, change your password and contact us.
Changes to this policy
If we make material changes, we’ll update this page and the “Last updated” date above. For significant changes (new data categories, new third parties), we’ll notify you in the app before the change takes effect.
Contact
Questions, requests, or complaints: support@tomeoflegends.co