Privacy Notice
Draft effective September 1, 2026
What this notice covers
This notice describes information Spellrelay processes to provide accounts, private browser tables, game recovery, and service security. Spellrelay does not sell personal information or build advertising profiles.
Data you provide
If you create an account, Spellrelay stores the display name and email you provide, a one way password hash, and legal acceptance timestamps. Deck records and game choices are stored when you ask the service to save or run them.
Game and table data
Spellrelay may store table membership, game results, ordered game events, and recovery snapshots. These records support private player views, reconnection, match restoration, and requested game history.
Necessary technical data
Authentication uses a secure session cookie. Hosting, database, and security providers may process an IP address, request time, browser details, and error logs as necessary to deliver and protect the service.
Card catalog separation
Imported card facts are stored separately from account and game records. Player records reference stable card identifiers rather than being inserted into the imported catalog.
Retention and control
Game records remain available for history and recovery until they are removed under Spellrelay retention controls. Guest decks are connected to a private browser credential and may be removed after six months without activity. Account deletion and data export controls must be available before public registration opens.
Security
Passwords are stored as Argon2 hashes rather than readable passwords. No service can promise absolute security. Use a password you do not reuse elsewhere.
Questions and requests
A private contact method for privacy requests will be published before public registration opens. Do not place personal information in a public repository issue.