Privacy notice — Wizards’ Club
Updated: 2026-09-16

1. Who is responsible

Brackets V.O.F. is the controller for personal data we process through Wizards’ Club. Our address is Klaas van Reeuwijkstraat 9, 2132 ZP Hoofddorp, the Netherlands. Our Dutch Chamber of Commerce number is 70294194. For privacy questions and requests, email raymond@dockyard.app.

This notice covers visitors, account holders and players whose details are entered by someone else. You do not need to accept it. Accepting our terms is not consent to marketing or other separate processing.

Wizards’ Club is not aimed at children. We do not ask for a date of birth and process account data on the basis of the agreement, not consent. If you are under 16, talk to a parent or guardian before creating an account. A parent or guardian can email us to access, correct or erase a child’s data; we handle such requests with priority.

2. What we receive and from whom

At registration you provide your display name, email address, password and language preference. We store your password as a hash. We also process your account ID, login tokens, browser/device description at login, optional username, profile preferences, linking code, and the version, language and time of your acceptance of the terms.

When games are recorded, we process player and guest names, contacts and links, decks and deck notes, game nights, groups, seasons, results, game events, timestamps, confirmations and personal match notes. These details come from you, a host or another player. You can therefore appear in shared history without having an account. We have no contact details for players without an account, so we cannot inform you directly; doing so would involve disproportionate effort (GDPR Article 14(5)(b)). We therefore ask the host who adds you to point you to this public notice, and we keep it available on the website at all times.

When you visit or use the service, our infrastructure receives technical data such as IP address, requested URL, timestamp, browser information and errors. If you email us, we process your contact details, message and information needed to handle your question. Administrative actions may be recorded in an audit log.

Do not enter sensitive personal data, such as health information, a national identification number or other unnecessary details in names or notes.

3. Purposes and legal bases

Accounts, login, password recovery, synchronisation and the features you use: necessary to perform our agreement with you (GDPR Article 6(1)(b)). We cannot create an account without a name, email address and password; you may use a pseudonym as your display name. A username and additional profile details are optional. The counter remains available without an account.

Details about guests and contacts without accounts, and preserving shared results: our legitimate interests and those of the players involved in recording their game nights and history (Article 6(1)(f)). We limit this to relevant game information and weigh your privacy interests. You may object to this processing.

Security, preventing abuse, resolving faults and auditing administrative actions: our legitimate interest in protecting the service and user data (Article 6(1)(f)). We retain evidence of acceptance of the terms to establish and defend agreements on the same basis.

Handling questions and complaints: performance of the agreement where your question relates to it; otherwise our legitimate interest in handling correspondence properly. Complying with legal information duties, privacy requests and any tax records: a legal obligation (Article 6(1)(c)).

If a new use requires consent, we ask for it separately in advance. You may then withdraw consent without affecting the lawfulness of earlier processing. We do not treat current account registration as consent to advertising.

4. Who can see your data

Other users see data to the extent permitted by the feature and their involvement, such as hosts, match participants and relevant group members. Names, decks, results and standings are therefore not always visible only to you. Within user features, personal match notes are available only to their author; deck notes may be shared with the deck.

If you set a username and enable discoverability, signed-in users can find your username and display name through search. You can disable discoverability in your profile. Sharing a linking, claim or joining code may give someone access to the associated feature. Linking a contact can also associate earlier history and decks with an account.

Authorised administrators may process data where needed for support, security or administration. Hosting, email and any payment providers receive data relevant to their tasks. We do not sell personal data. We may disclose data to competent authorities when legally required.

5. Storage on your device and camera

We use localStorage, IndexedDB and the installed web app cache to keep counter settings, your login session, local game data, the synchronisation queue and retrieved history available. This functional storage is necessary for your chosen features and offline use. The app contains no advertising trackers or analytics software.

Local data may remain until you clear it through the app or browser, or the browser removes it. Logging out is not the same as clearing all website data or closing your server account. Clearing browser data can lose games that have not synchronised. Use your own browser profile on a shared device.

The QR scanner requests camera access through your browser. Images are processed on your device, not sent to our server or retained as recordings. The decoded code is used, for example, to open a game night or link a contact; that action may send the code to our API. You can also enter a code manually and revoke camera access in your browser.

6. Card searches and any payments

When you search for a commander, our server sends the entered card search term to Scryfall when necessary. We do not include your account name or email address; Scryfall sees a request from our server. Do not put personal data in a card search. If you open an external link yourself, that website also receives data from your browser and its own privacy notice applies.

Only when you use an offered paid subscription or its management features do we process payment and subscription data through Stripe. This may include your name, email address, billing address, customer ID, subscription status and payment information. You enter payment details at Stripe. Our app may receive the payment method type and last four digits; we do not store the full card number or security code on our server.

Stripe processes data for payments and also for its own legal responsibilities, including fraud prevention. Processing for a paid subscription is based on performance of the agreement; mandatory records are based on a legal obligation. Free registration alone does not initiate payment.

7. Providers and transfers outside the EEA

Production data is hosted by DigitalOcean in the European Union. We use Mailgun’s EU region for password recovery emails. Mailgun processes the recipient address, recovery email content and delivery information to send the message. Your own email provider also processes the received email.

An EU storage location does not mean every processing operation takes place exclusively within the EU. These international providers may use affiliates or subprocessors outside the European Economic Area, including in the United States. This can also apply to Stripe when you use a payment service.

Transfers outside the EEA require a valid GDPR transfer mechanism. The providers describe safeguards in their data protection terms, including European Standard Contractual Clauses and, where applicable, an adequacy decision. Their information is linked below. You may ask us which safeguards apply to your data and how to obtain a copy.

8. How long we retain data

Account and game data remain available while your account and associated history are used. We do not automatically delete an account merely because you have not signed in for some time. On termination or a privacy request, we assess what can be removed and what is still necessary for shared history, legal duties or a specific dispute.

For correspondence, acceptance evidence and administrative logs, the criterion is whether the information is still needed to handle the question, agreement or administrative action and any complaints or legal claims. A legal retention duty or ongoing dispute may justify longer retention, limited to the necessary data.

Technical server logs have no general statutory retention period such as seven years. We retain them for investigating faults, security and identifying and handling abuse. The retention criterion is whether they are still needed for those investigations and verification of the remedy. Once that need ends, they must be deleted or anonymised.

Backups allow recovery of the service and data after faults or loss. There is no general fixed statutory retention period for them either. The criterion is whether a copy is still needed as a usable recovery point; older copies must be removed when that need ends. Removal from the active system is not always immediately reflected in every backup. When restoring data, previously granted erasure requests must be reapplied.

No uniform number of days has yet been established for logs and backups. This notice therefore does not promise automatic deletion after a fixed number of days. You may ask us which data about you is still present and on what basis it is retained.

If you take out a paid subscription, we generally retain legally required basic tax records for seven years. This does not mean that all your game data must be kept for seven years. For local storage on your own device, see the explanation above.

9. Security and decisions

We use measures including encrypted connections, hashed passwords, access controls and user permissions. No system can guarantee complete security. Report suspected data breaches or unauthorised access to our contact address.

We do not make solely automated decisions about you with legal or similarly significant effects. Game statistics and standings are calculated automatically from game data; they are not used to assess you for such purposes.

10. Your rights and how to use them

You can request access and a copy, correction, erasure, restriction and, where applicable, portability in a commonly used digital format. You may object to processing based on legitimate interests. We assess requests under the GDPR; rights may be limited by legal obligations and the rights of others.

Email raymond@dockyard.app, preferably from your account email address. You may also request action about data entered by another player if you have no account. Give enough information to locate it, such as the game night or host involved. Do not send a copy of an identity document without being asked. If we have reasonable doubts, we request only additional information needed to verify your identity.

We normally respond within one month. For complex or multiple requests, this may be extended by up to two further months; we tell you within the first month and explain why. Requests are normally free of charge. The app has no self-service button for complete account erasure or data export; you can exercise these rights by email.

A shared result does not always need to be removed entirely following an erasure request. We assess whether data can be deleted or anonymised and which data is still needed for a lawful purpose. Technical storage choices, such as retaining game events, do not remove your statutory rights.

You can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the competent supervisory authority where you live or work. You may contact us first, but this is not a requirement.

11. Changes to this notice

The date of this notice appears at the top. We update it when our processing changes. For a material change, we inform affected users appropriately. Publishing a new notice does not replace consent where the law requires it.

Autoriteit Persoonsgegevens: https://www.autoriteitpersoonsgegevens.nl/een-tip-of-klacht-indienen-bij-de-ap
DigitalOcean — Data Processing Agreement: https://www.digitalocean.com/legal/data-processing-agreement
Mailgun — Privacy Policy: https://www.mailgun.com/legal/privacy-policy/
Stripe — Privacy: https://stripe.com/privacy