Privacy Policy

Last updated October 23, 2026

This explains what Commander Nexus stores about you, why, and how to get rid of it. It is written to be read, not to be skipped. If anything here is unclear, ask us at contact@commandernexus.com and we will fix the wording.

Who Runs This Site

Commander Nexus is run by one person as a hobby project, not by a company. Questions about your data go to contact@commandernexus.com, and a real person reads that address.

You Can Use Most of the Site Without an Account

Browsing cards, commanders, precons and other people's public decks needs no account and stores nothing about you beyond the basic server logs described below. An account is only needed to save something of your own.

What We Store If You Make an Account

• Your sign-in: your email address, and a password that is stored scrambled (hashed) by our login provider. We never see your password. If you sign in with Google, Discord or Twitch instead, we receive your email address and an account identifier from that service, and never your password for it.
• Your display name and avatar: the name other players see, and an avatar you pick from the art on a Magic card. You cannot upload your own image, so we never hold a photograph you supplied.
• What you build: your decks and the cards in them, the folders you sort them into, the version history of each deck, and any notes or settings attached to them.
• Your collection: the cards you tell us you own, how many, in which printing and condition, and the folders and places you file them under.
• Your edits: a change log for your decks and your collection, so the undo and version history buttons have something to undo. It records what changed and when.
• Your card tag corrections: if you disagree with how we have tagged a card and override it, we store that override against your account so the site keeps showing you your version.
• Searches that found nothing: when a search returns no result, we record the search text alongside your account id. This is how we find gaps in the card data and fix them. It is the one thing here that exists for our benefit rather than yours, which is why it is called out on its own line. Ask us and we will delete yours. When a search finds nothing, we also count what was typed, with no account attached. We use those counts only to spot broken searches and make the site better, never to sell or share, and we delete them after 90 days.
• Things you send us on purpose, like feedback or a report that our word filter got it wrong.
• Which days you visit while signed in, so we know when to ask for feedback.

What We Do Not Do

No payment details, because the site takes no payments. No postal address, no phone number, no date of birth. No ads and no advertising trackers. The site measures four things: Cloudflare Web Analytics counts page visits and how fast pages load, we count clicks on the shop links when you open a card, we count how far each visit gets (see "How we count visits" below), and Google Analytics (see "Google Analytics" below). The first three set no cookies and do not identify you, and Google Analytics sets cookies only if you say yes. We do not sell your data, we do not share it for advertising, and we do not build a profile of you to target anything at you.

Companies That Handle Data for Us

• Supabase: the database, the login system and file storage. Everything in the list above lives there.
• Cloudflare: serves the website, runs the domain and forwards our email. Cloudflare also provides the "are you human" check on the sign-in form, which sees your IP address and browser in order to decide, and the visit counts described above.
• Resend: sends account emails such as your verification code. It receives your email address for that purpose. Resend also tells us whether each of those emails arrived, bounced or was marked as spam. We keep that for 30 days so we can fix sign-up problems.
• OpenAI: checks the text you type into the site (your display name, deck names, descriptions, guides, notes and feedback) for hate speech and threats, using its moderation service. It receives that text only, never your email address.
• Google: Google Analytics, which sets cookies only if you allow it.

These companies process data on our behalf and are not permitted to use it for their own purposes. Their servers are in the United States, so if you are elsewhere your data is stored there.

Card Pictures and Card Data

Card images and symbols are loaded directly from Scryfall as you browse, which means your browser contacts Scryfall and Scryfall can see that request. We do not send them anything about who you are. Nothing about your decks or your collection is shared with them.

What Is Kept in Your Browser

We store a login token so you are not asked to sign in on every visit, and a few display preferences: how you last sorted your decks, which view you had open, the picture on your own avatar so pages outside the app can show it. We also keep a random visit number and your answer to the cookie bar, plus Google Analytics' cookies if you allowed them. These stay on your device. Clearing your browser data signs you out and forgets them.

How We Count Visits

To learn which sites and links bring people here, and where they get stuck, each visit gets a random number kept in your browser. It is forgotten after 30 minutes without opening a page. With it we note the page you arrived on, the site that sent you (only its name, such as google.com, never the page you were on), any campaign tags in the link you followed, and whether you were on a phone or a computer. We also note whether that visit opened another page, searched, signed in, made an account, made a deck or opened a shop link. The number is not tied to your account, your email or your IP address. This count never records what you type, where you move or click on a page, or a replay of your visit, and we delete these notes after 90 days.

Google Analytics

Google Analytics counts the pages people open and a few things they do: making an account, making a deck, sharing or exporting a deck, and opening a shop link. Until you click Allow on the cookie bar it sets no cookies, so each page reaches Google with only things like the time, your browser type and a number made up for that page. If you allow it, it saves two cookies, lasting up to two years, so we can tell new visitors from returning ones. Its advertising features are off, and Google keeps the records for up to 14 months. To change your answer, use the Cookie choices button at the bottom of any page. More from Google: How Google uses information from sites or apps that use our services.

Server Logs

Our hosting providers keep ordinary technical logs (IP address, browser type, which page was requested and when) for a short period, to keep the site running and to stop abuse. We do not use them to track individual people.

When Something Breaks

If a page breaks in your browser, it sends us a short error report: what broke, on which page, your browser type, whether you were signed in, and which buttons, links or menus you used just before it broke (never what you typed). It never includes your account, email or IP address, and we delete it after 30 days.

What Other People Can See

Your decks are private until you make one public or share a link to it. A public deck shows your display name and avatar alongside it. Your collection, your folders and your email address are never shown to anyone else.

Getting Your Data, and Deleting It

We keep your data for as long as your account exists. Account → Download my data gives you a single file containing every deck and your whole collection. Account → Delete account removes your decks, your collection, your folders, your change history, your profile and your sign-in, straight away and for good. If you would rather we did it, email contact@commandernexus.com and we will delete your account and its contents within 30 days. You can also ask us to correct anything we hold, or to tell you exactly what that is.

Children

Magic is played by all ages, but this site is not intended for children under 13 and they may not create an account. If you believe a child under 13 has made one, email us and we will remove it.

Changes to This Policy

If this policy changes in a way that matters, the date at the top changes and we say so on the site. We will not quietly start collecting something new and leave it to you to notice.