Privacy Policy
Effective date: 20 August 2026. This policy explains what Esper Forge collects, why it is needed and which choices are available to you.
1. Who operates Esper Forge
Esper Forge is operated by Lucas Wychodil-Lubi, Am Arlandgrund 3, 8045 Graz, Austria. For privacy questions or requests, contact support@esperforge.com.
2. Information you provide
When you create or use an account, we process the name, handle, email address, password hash and profile information you choose to provide. We also process the decks, card lists, folders, collection entries, wishlists, follows, likes and other content you save or publish through Esper Forge.
If you contact support or report a bug, we process your message, subject and reply address. Payment details are handled by Stripe; Esper Forge receives the checkout and entitlement information needed to provide Forgecoins and related features, not your full card number.
3. Information collected through use
We receive technical information needed to operate and secure the service, such as request metadata, device and browser details, approximate location derived from network information, timestamps and error information. Necessary cookies and browser storage keep sessions and consent choices working. Optional analytics and advertising services are not enabled unless you choose them.
4. Why we use information
We use information to create and secure accounts, provide deckbuilding and community features, display public content, generate proxy sheets, process purchases, answer support requests, prevent abuse, troubleshoot failures, measure reliability and meet legal obligations. Depending on the context, the legal basis is contract performance, legitimate interests, consent or compliance with a legal obligation.
5. Public content and service providers
Decks and profile details marked public can be viewed by other visitors. Please do not publish information you want to keep private. We use carefully selected providers for hosting, database storage, transactional email, payments, monitoring, advertising and card data. These may include Vercel, Neon, Resend, Stripe, Sentry, Google AdSense, Anthropic and Scryfall where the relevant feature is enabled. Advertising is consent-gated and disabled for accounts with an ad-free entitlement. Providers receive only the information needed for their service and operate under their own terms and privacy notices.
6. Card data and third-party links
Card names, printings and images are obtained from Scryfall and linked card-image infrastructure. Esper Forge does not claim ownership of Magic: The Gathering intellectual property. Links to external services are governed by those services' own policies; Esper Forge cannot control their practices.
When you scan a card in Oracle, text recognition first runs locally in your browser. If no card name can be identified, your browser creates a reduced copy of the card image and sends it to Esper Forge's privately operated recognition worker for a temporary artwork comparison. The uploaded image is processed in memory, is not written to the artwork index or account history, and is discarded after the request.
7. Retention and deletion
We keep account and content information while your account is active or as needed to provide the service. Transaction, security and delivery records may be retained longer where required for accounting, fraud prevention or legal obligations. You can request account deletion through Settings or contact support. Deletion may not remove information that we must retain by law or that has already been irreversibly aggregated.
8. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction or portability of your personal data, object to certain processing, or withdraw consent where processing relies on consent. You may also complain to the competent data-protection authority. Contact support@esperforge.com first so we can identify and handle the request.
9. Security and changes
We use reasonable technical and organisational safeguards, but no online service can promise absolute security. We may update this policy when the service or legal requirements change. The current version and its effective date will always be posted here.