Privacy Policy

1. Who we are

myEDHLeague (the "Service") is operated by MyEDHLeague, LLC ("we," "us," or "our"). This policy explains what information we collect when you use the Service, how we use and share it, and the choices you have. It's part of our Terms and Conditions.

The short version: we collect what we need to run your leagues. We don't sell your information, show ads, or use advertising or analytics trackers.

2. Information you give us

• Account information: your name (shown as your display name), email address, and password. Passwords are stored in hashed form, so we can't read them.
• Profile picture: an image you upload, or your Discord avatar if you choose to use it.
• League activity: the decks you submit (card lists and commanders), match results, scores, bonus points, notes you enter on scorecards, and your league memberships.
• League manager information: if you run a league, the details you enter about it, such as its name, description, rules, schedule, and any location, store, or address information you choose to post.
• Sign-up requests: the name and email address you enter when you ask to join a league.
• Messages to us: anything you send when you email us or use our contact form, including the name and email address you give so we can reply.

3. Information from Discord

Linking Discord is optional. When you link your account, Discord shares your Discord user ID, username, and avatar with us. That's the only permission we ask for. We can't read your messages, your friends list, or which servers you're in, and we don't keep the access key Discord gives us after the link is complete.

If a league manager connects their league to a Discord server, our bot posts league updates there and responds to its commands. The bot only uses what it needs to do that, such as the server's channels and the Discord IDs of linked league members, so it can mention them in match threads.

4. Information collected automatically

• Cookies: we use cookies that are essential to keep you logged in and to secure your session, plus your browser's local storage to remember small display preferences, such as which sections you've collapsed. We don't use advertising or analytics cookies.
• IP address: we use your IP address briefly, in scrambled (hashed) form, to limit repeated sign-up, registration, and contact-form attempts and prevent abuse.
• Server logs: like most websites, our hosting provider automatically records basic request information, such as IP address, browser type, the pages requested, and the time of the request, for security and troubleshooting.

5. How we use information

We use information to:

• create and secure your account and log you in;
• run leagues: schedules, standings, scoring, deck checks against league rules, statistics, playoff brackets, and league exports;
• send emails you need, such as invitations, sign-up decisions, password resets, and notifications about your leagues;
• if you opt in, send optional emails such as blog posts, newsletters, and announcements, which you can unsubscribe from at any time;
• post updates to a league's connected Discord server;
• investigate bugs, prevent abuse, and keep the Service secure; and
• meet legal obligations and enforce our Terms.

We don't sell your personal information, and we don't share it for targeted advertising.

6. Who can see your information

• Other members of your leagues can see your display name, profile picture, decks, match results, standings, and league statistics.
• League managers can see what's needed to run their league, including your sign-up request. When you ask to join a league, its managers can also see your player record from other leagues (matches played, win rate, and similar statistics), to help them decide on sign-ups.
• Discord server members can see what our bot posts in a league's connected server, such as match pairings and results that mention linked players.
• Anyone with a league's public sign-up link can see that league's name, description, and any location details the manager posted. Players' information isn't shown there.
• Legal and safety: we may disclose information if the law requires it, or if it's reasonably necessary to protect the rights, property, or safety of our users, the public, or us.
• Business transfers: if the Service is ever sold or merged, user information may transfer to the new owner, who would remain bound by this policy for information collected under it.

7. Service providers

We use a small number of providers to run the Service. They only handle your information to provide their service to us:

• IONOS hosts the website, the database, and the Discord bot.
• Google Workspace sends our emails.
• Discord provides account linking and delivers our bot's posts, under Discord's Privacy Policy.

Card data and prices come from Scryfall. We download that data to our own servers, and we don't send Scryfall any of your personal information.

If we add paid features, payments will be handled by a payment processor. It will receive your payment details directly, and we won't store full card numbers. We'll update this policy to name that processor first.

8. How long we keep information

• We keep your account information for as long as your account exists.
• When you delete your account from your profile page, your login and account profile are deleted. Records that are part of a league's history, such as your display name in that league, match results, and standings, may stay with that league so its records stay accurate for the other players. You can email us to ask us to remove or anonymize what remains.
• Sign-up requests and invitations are kept as part of the league they relate to.
• Messages to us are kept until we no longer need them to answer you. Hashed IP addresses used for rate limiting expire automatically within an hour. Server logs and backups are kept for a limited period and then overwritten.

9. Your choices and rights

• Update: you can change your name, email, password, profile picture, and email notification settings on your profile page.
• Optional emails: if you've opted in to optional emails, you can unsubscribe at any time using the link in any of them.
• Discord: you can unlink your Discord account at any time from your profile.
• Delete: you can delete your account from your profile page.
• Access, correction, and deletion requests: you can email us to ask for a copy of your information, or to have it corrected or deleted. Depending on where you live, you may have these rights under law. We'll respond within 60 days, or sooner if the law that applies to you requires it. We may need to verify that the request comes from you, and we won't treat you differently for making one.

10. Children

The Service isn't for children under 13, and we don't knowingly collect personal information from them. Users aged 13 to 17 need a parent's or guardian's permission. If you think a child under 13 has given us information, email us and we'll delete it.

11. Security

We take reasonable measures to protect your information. For example, we store passwords in hashed form, sign inactive sessions out automatically, limit repeated sign-up and registration attempts, and restrict league data to the people who need it. No system is perfectly secure, though, so we can't guarantee absolute security. If we learn of a breach affecting your information, we'll notify you as required by law.

12. Where information is stored

The Service is operated from the United States, and information is stored and processed there. If you use it from elsewhere, your information will be transferred to the United States.

13. Changes to this policy

If we change this policy, we'll update the effective date at the top. For significant changes, such as starting to collect a new kind of information or share it in a new way, we'll make reasonable efforts to notify you, for example by email or a notice on the site, before the change takes effect.

14. Contact

Questions or requests about your privacy? Email us at matt@myedhleague.com.