Privacy Policy

Last updated 11 September 2026

This explains what Commander Nexus stores about you, why, and how to get rid of it. It is written to be read, not to be skipped. If anything here is unclear, ask us at contact@commandernexus.com and we will fix the wording.

Who runs this site

Commander Nexus is run by one person as a hobby project, not by a company. Questions about your data go to contact@commandernexus.com, and a real person reads that address.

You can use most of the site without an account

Browsing cards, commanders, precons and other people's public decks needs no account and stores nothing about you beyond the basic server logs described below. An account is only needed to save something of your own.

What we store if you make an account

• Your sign-in: your email address, and a password that is stored scrambled (hashed) by our login provider. We never see your password. If you sign in with Google, Discord or Twitch instead, we receive your email address and an account identifier from that service, and never your password for it.
• Your display name and avatar: the name other players see, and an avatar you pick from the art on a Magic card. You cannot upload your own image, so we never hold a photograph you supplied.
• A real name, only if you type one in: this field is optional and empty by default. It is never shown to anyone else and is never used for anything except showing it back to you on your own account page. You can clear it at any time and lose nothing by leaving it blank.
• What you build: your decks and the cards in them, the folders you sort them into, the version history of each deck, and any notes or settings attached to them.
• Your collection: the cards you tell us you own, how many, in which printing and condition, and the folders and places you file them under.
• Your edits: a change log for your decks and your collection, so the undo and version history buttons have something to undo. It records what changed and when.
• Your card tag corrections: if you disagree with how we have tagged a card and override it, we store that override against your account so the site keeps showing you your version.
• Searches that found nothing: when a search returns no result, we record the search text alongside your account id. This is how we find gaps in the card data and fix them. It is the one thing here that exists for our benefit rather than yours, which is why it is called out on its own line. Ask us and we will delete yours.

What we do not do

No payment details, because the site takes no payments. No postal address, no phone number, no date of birth. No ads, no advertising trackers, and no third-party cookies. The one measurement the site runs is Cloudflare Web Analytics, which counts page visits and how fast pages load. It sets no cookies and does not identify you. We do not sell your data, we do not share it for advertising, and we do not build a profile of you to target anything at you.

Companies that handle data for us

• Supabase — the database, the login system and file storage. Everything in the list above lives there.
• Cloudflare — serves the website, runs the domain and forwards our email. Cloudflare also provides the "are you human" check on the sign-in form, which sees your IP address and browser in order to decide, and the visit counts described above.
• Resend — sends account emails such as your verification code. It receives your email address for that purpose.

These companies process data on our behalf and are not permitted to use it for their own purposes. Their servers are in the United States, so if you are elsewhere your data is stored there.

Card pictures and card data

Card images and symbols are loaded directly from Scryfall as you browse, which means your browser contacts Scryfall and Scryfall can see that request. We do not send them anything about who you are. Nothing about your decks or your collection is shared with them.

What is kept in your browser

We store a login token so you are not asked to sign in on every visit, and a few display preferences — how you last sorted your decks, which view you had open, the picture on your own avatar so pages outside the app can show it. These stay on your device. Clearing your browser data signs you out and forgets them.

Server logs

Our hosting providers keep ordinary technical logs — IP address, browser type, which page was requested and when — for a short period, to keep the site running and to stop abuse. We do not use them to track individual people.

What other people can see

Your decks are private until you make one public or share a link to it. A public deck shows your display name and avatar alongside it. Your collection, your folders, your email address and your optional real name are never shown to anyone else.

Getting your data, and deleting it

We keep your data for as long as your account exists. Account → Download my data gives you a single file containing every deck and your whole collection. Account → Delete account removes your decks, your collection, your folders, your change history, your profile and your sign-in — straight away and for good. If you would rather we did it, email contact@commandernexus.com and we will delete your account and its contents within 30 days. You can also ask us to correct anything we hold, or to tell you exactly what that is.

Children

Magic is played by all ages, but this site is not intended for children under 13 and they may not create an account. If you believe a child under 13 has made one, email us and we will remove it.

Changes to this policy

If this policy changes in a way that matters, the date at the top changes and we say so on the site. We will not quietly start collecting something new and leave it to you to notice.