Privacy Policy

What we collect

When you create an account or sign in with Google or Discord, we receive your email address and display name from that provider. We store this alongside any decks, card lists, primers, deck versions, agent usage records, and suggestion feedback you create within idlebrew.

When you use Explore or card suggestions, we may store how you interact with recommended cards — including thumbs-up, thumbs-down, skips, adds to a deck or stack, and (when we ship it) how long a card was on screen. Signed-in feedback is stored with your account. Guests keep that history in the browser until they sign in; if you sign in after browsing as a guest, we may associate that local session with your account so recommendations can continue.

We do not collect payment information, physical addresses, or any data beyond what is necessary to operate the service.

How we use your data

Your data is used to provide the idlebrew service — authenticating your sessions, storing your deck lists, powering AI-assisted deck edits, personalizing card suggestions, improving recommendation models, and protecting usage limits. We do not sell or rent your personal information to data brokers. Where we show third-party advertising on the free tier, ad partners such as Google may use cookies or similar technologies subject to their own policies; idlebrew Pro is offered without on-site display ads. Final wording for personalized ads, regional consent, and related choices may be updated after legal review.

Decks are public by default so you can share and host them on idlebrew. Public deck pages may include deck names, descriptions, card lists, primers, and deck history. You can change a deck's visibility in its settings.

Third-party services

idlebrew relies on the following services, each with their own privacy policies:

• Supabase — database and authentication (supabase.com/privacy)
• Vercel — hosting and deployment (vercel.com/legal/privacy-policy)
• Scryfall — Magic: The Gathering card data (scryfall.com/docs/privacy)
• EDHREC — commander average deck and recommendation data used during brew creation (edhrec.com/privacy)
• Vercel AI Gateway and model providers — AI-assisted deck-building requests and responses
• Vercel Analytics and Speed Insights — aggregate product analytics and performance measurement
• Google — optional sign-in and, on the free tier, optional display advertising via Google AdSense (policies.google.com/privacy)
• Discord — optional sign-in (discord.com/privacy)

Data retention

Your account, deck data, deck versions, suggestion feedback, Explore session history (when stored), and API-key audit metadata are retained for as long as your account is active. If you request deletion, personal data and content associated with your account will be permanently removed within 30 days. Copies already exported into training datasets, and models already trained from them, are not retroactively untrained. We stop using deleted accounts for new training.

Your rights

You may request access to, correction of, or deletion of your personal data at any time. See our data deletion page for instructions.

Contact

For privacy-related questions, email us at privacy@idlebrew.app.