Privacy Policy

1. Introduction

Spellweave is operated by 3Dec Studios LLC, a Florida limited liability company ("Spellweave," "we," "our," or "us"). 3Dec Studios LLC is the controller of the personal information described in this policy, which means we decide how and why it is used. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Magic: The Gathering deck building application and related services (collectively, the "Service"). You can contact us at the email address in section 14.

By using Spellweave, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Name (if provided through Google OAuth or account settings)
• Authentication credentials (securely managed by our authentication provider)

2.2 User-Generated Content

We store the content you create and upload, including:

• Card collections (imported or manually created)
• Decks and deck configurations
• Deck names and descriptions
• Import data from third-party collection managers

2.3 AI-Generated Content

When you use our AI features, we may store:

• AI-generated deck explanations and strategy text
• AI-generated strategy visualizations
• Prompts and parameters used to generate content

2.4 Usage Information

We automatically collect certain information when you use our Service:

• Log data (IP address, browser type, access times). When you accept our terms, we also save to your account the country your IP address indicates, unless a country is already saved.
• Feature usage patterns
• Device information

2.5 Payment Information

If you subscribe to a paid plan or purchase mana, payment processing is handled by third-party payment processors. We do not store complete credit card numbers or banking details. We may store:

• Subscription plan type and status
• Mana balance for visualization generation
• Transaction history (dates and amounts)

2.6 Session Recordings

If you choose "Accept All" in the cookie banner, we may record how you use the Service so we can see where people get stuck. A recording captures:

• The pages you open and the order you move through them
• Where you click, scroll and hover
• The content displayed on the page, with text you type into form fields masked

We do not record your account settings, your billing and payment pages, your saved collection, password reset pages, or our administration area. If you choose "Essential Only", we do not create session recordings at all. Recordings are deleted after 30 days.

We use an automated tool provided by our analytics provider to review these recordings and flag places where people run into problems. That review is performed by an AI model operated by Google on our analytics provider's behalf.

2.7 Advertising and Campaign Information

If you choose "Accept All" in the cookie banner and arrive at Spellweave from a link that carries an ad click identifier or campaign tags (the "utm" codes that some links include), we store the following in your browser's local storage and send it to our servers. This applies to any such link, not only our own ads: a link with campaign tags shared on another website counts, and so does an ordinary link shared on Facebook, because Facebook adds its click identifier to those links too:

• The ad click identifier that Google or Facebook adds to the link, if there is one
• Campaign details from the link: its campaign tags (source, medium, campaign, content and term) and, for our Google ads, the ad group, the keyword the ad matched, the match type and the device type
• The page you arrived on, the time of your visit, and a random identifier for your browser

We use that random identifier to record your arrival from the link and your steps on our free bracket checker: running a check, seeing the result, reaching a limit, and clicking a sign-up link. If you sign up or sign in on that browser, we link the campaign information from the last 90 days to your account once you have accepted our terms, so we can tell which campaigns bring people to Spellweave. Nothing is linked after you withdraw your consent. The checker steps stay stored with the random identifier, which lets us connect them to your account. If you choose "Essential Only", we do not store or collect any of this, and we do not create that random identifier. The anonymous telemetry described in section 10.5 may still count bracket check results and sign-up clicks without identifying you.

When you sign up, start using Spellweave (building, importing or tuning your first deck), make a purchase, or start a subscription after clicking one of our Google ads, we send that conversion to Google Ads so Google can report how our ads perform, but only while your choice is "Accept All". For each conversion, Google receives only the Google click identifier, the time of the conversion, a random transaction identifier, and for purchases and subscriptions the amount and currency. We never send your name, email address or account identifier for this, and we tell Google that you have agreed to this measurement but not to ad personalization. If you withdraw your consent, we stop sending conversions for your account once your browser tells our servers, which it does whenever you use Spellweave while signed in.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Service
• Process your deck building requests and optimizations
• Generate AI-powered deck explanations and strategy visualizations
• Manage your account and subscription
• Communicate with you about updates, support, and promotions
• Analyze usage patterns to improve user experience
• Detect, prevent, and address technical issues or abuse
• Comply with legal obligations
• Measure how well our advertising works and which campaigns bring people to Spellweave, where you have given consent

Where the law requires a legal basis for using personal information (for example in the European Economic Area, the United Kingdom and Brazil), we rely on: our contract with you, for your account, the Service and payments; your consent, for the analytics, session recordings and advertising measurement you allow by choosing "Accept All" (sections 2.6, 2.7 and 10), which you can withdraw at any time (section 10.4); our legitimate interests, for keeping the Service secure and working (including security and error logs), preventing abuse (including counters keyed to your IP address in hashed form), measuring sign-ups and purchases on our servers, and knowing which countries our users come from (the country saved to your account, section 2.4); and legal obligations, where the law requires us to keep or disclose information.

4. Third-Party Services

We use third-party service providers to help operate our Service. These providers process your data on our behalf under contractual obligations to protect your information. Google and Meta also act as independent controllers when they use the advertising data they receive for their own purposes (item 7 below and section 6):

• Cloud infrastructure and hosting providers: for storing your account data, collections, decks, and generated content
• Authentication services: for secure sign-in, including social login options like Google
• AI and machine learning services: for generating deck explanations and strategy visualizations
• Security and bot protection services: for protecting against automated abuse
• Card data providers: for Magic: The Gathering card information and images (no personal data is shared with these providers)
• Analytics and error-monitoring providers: PostHog and Google Analytics, for measuring product usage and performance, and Sentry, for detecting and diagnosing errors and crashes (used only when you have chosen "Accept All"), so we can improve the Service
• Advertising and conversion-measurement partners: Google (Google Ads, linked to Google Analytics) and Meta (the Meta Pixel and Conversions API), to measure how well our marketing works, only when you have chosen "Accept All". Meta may use cookies and similar technologies to collect or receive information from Spellweave and elsewhere on the internet, and use that information to provide measurement services and to target and deliver ads. You can opt out of interest-based advertising at https://www.aboutads.info/choices or https://www.youronlinechoices.eu, and you can stop Spellweave from sharing this data at any time by choosing "Essential Only".

When you use social login (e.g., Google), we receive only basic profile information (name and email). We do not access your contacts, calendar, or other external account data.

5. AI Services and Automated Processing

We use third-party artificial intelligence services to generate analyses, recommendations, and media content based on your inputs. When you use AI-powered features:

• Data Processing: Your deck data, card selections, and related inputs may be temporarily processed by AI service providers to generate results. This processing is performed solely for the purpose of delivering the requested features.
• No Training on User Data: We do not use your personal data, decks, or collections to train AI models. AI services are used strictly for inference and content generation.
• AI-Generated Videos: Strategy visualization videos are generated using AI image and video generation services. These visualizations are fictional fantasy content inspired by gameplay strategy and do not depict any copyrighted characters or artwork from third parties.
• Prompt Data: Prompts used to generate AI content may be logged for quality assurance and debugging purposes. These logs do not contain personally identifiable information beyond what is necessary for service operation.

By using AI-powered features, you acknowledge that your inputs will be processed by these services as described above.

6. Data Sharing and Disclosure

We do not sell your personal information for money. When you choose "Accept All", we share advertising measurement data with Google and Meta. Google receives, through Google Analytics (which is linked to our Google Ads account), the pages you view on Spellweave and events such as sign-ups and purchases, with your account identifier when you are signed in, and, through Google Ads, the conversions described in section 2.7. Meta receives, through the Meta Pixel and Conversions API, the pages you view and events such as sign-ups and purchases, together with a hashed email address, a hashed account identifier, your IP address, browser and device information, and Meta's advertising cookie identifiers, which can include a Facebook click identifier. Some US state privacy laws may treat this as "sharing" personal information or as targeted advertising. You can opt out at any time by choosing "Essential Only" in the cookie banner or with "Cookie settings" (section 10.4). We may also share your information in the following circumstances:

• Service Providers: With third-party vendors who assist in operating our Service (as described in Section 4)
• Public Content: Deck videos shared via public links are accessible to anyone with the link
• Legal Requirements: When required by law, legal process, or to protect our rights and safety
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly authorize us to share your information

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. Specifically:

• Account data: Retained until you delete your account
• Collections and decks: Retained until you delete them or your account
• Generated visualizations: Retained until you delete them or your account
• Usage logs: Retained for up to 90 days for operational purposes
• Advertising and campaign information: For the information in section 2.7 that Spellweave stores: campaign information not linked to an account, and all bracket checker steps, are deleted 90 days after the visit or step. On campaign information linked to your account, the ad click identifier is deleted 90 days after the visit, while the other campaign details are kept until you delete your account. Our record of conversions for Google, which contains no click identifier, is kept until you delete your account. The country saved to your account (section 2.4) is also kept until you delete your account. Counters we use to limit abuse, keyed to IP addresses in hashed form, are deleted after two days. This schedule applies even if you later withdraw your consent. Data we send to PostHog, Google, Meta and Stripe is kept under those services' own retention periods.

After account deletion, we may retain certain information as required by law or for legitimate business purposes (e.g., fraud prevention).

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (TLS/SSL)
• Encryption of data at rest
• Secure authentication mechanisms
• Regular security assessments
• Access controls and authentication for internal systems

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

9. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data
• Export: Export your collections and decks in standard formats
• Opt-out: Unsubscribe from marketing communications

To exercise these rights, please contact us at [email protected].

10. Cookies and Similar Technologies

Cookies are small text files stored on your device when you visit a website. We use cookies and similar technologies to operate our Service and improve your experience.

10.1 Essential Cookies

These cookies are necessary for the Service to function and cannot be disabled. They do not require your consent.

• Authentication: We use session cookies to keep you signed in securely. These are set by our authentication provider and expire when your session ends or after a short period of inactivity.
• Payment processing: When you visit a checkout or payment page, our payment processor (Stripe) may set cookies for fraud prevention and to complete your transaction securely. These are necessary for payment functionality.

10.2 Analytics Cookies

We use analytics services, PostHog and Google Analytics, to understand how visitors interact with Spellweave so we can improve the experience. These cookies track usage data such as pages visited and session duration. Analytics cookies are only set if you give your consent by choosing "Accept All" through our cookie banner. To learn how Google uses information from sites that use Google Analytics, see "How Google uses information from sites or apps that use our services" at https://policies.google.com/technologies/partner-sites.

10.3 Local Storage

We also use browser local storage (which is not a cookie) to remember a small number of preferences on your device, such as your theme preference (light or dark mode) and your cookie consent choice. These preferences do not track you across sites. Your theme preference stays on your device. Your consent choice is also saved in a cookie and sent to our servers so we can respect it: when you are signed in and we hold campaign information for your account (section 2.7), we store it with that information, and we record it with any checkout, including with our payment processor (Stripe). If you choose "Accept All", we also use local storage for the campaign information described in section 2.7, which is sent to our servers.

10.4 Managing Your Preferences

When you first visit Spellweave, a banner lets you choose between "Accept All" (enables analytics and advertising cookies, session recordings, and the campaign measurement described in section 2.7) and "Essential Only" (blocks analytics and advertising cookies but allows the anonymous product telemetry described in section 10.5). You can change your choice at any time with "Cookie settings", in the footer of the site and the app or as the button below, which shows the consent banner again. You can also block or delete cookies through your browser settings. Spellweave's own measurement of account events, such as sign-ups and purchases, which we record on our servers and with our analytics provider without cookies, is not affected by your choice. Sharing advertising measurement with Google and Meta requires "Accept All". If you withdraw your consent, by choosing "Essential Only" or through "Cookie settings", we stop collecting the information described in section 2.7, clear it from your browser together with the analytics and advertising cookies, and, if you are signed in, tell our servers, so we stop sending conversions for your account to Google. Information we have already stored is kept until it is deleted on the schedule in section 7.

10.5 Anonymous Product Telemetry

When you choose "Essential Only", Spellweave collects anonymous, aggregate product telemetry through PostHog to help us understand feature usage and error rates. This telemetry includes page views and page exits that record only that a page was viewed, never which page (no address, page title, previous page or campaign details), generic event names (such as "deck built" or "import failed"), broad categories (such as card tier or billing type), and error codes. It never includes your identity, email, deck IDs, commander names, card names, or any data that could identify you. No cookies are used for this telemetry. The only thing it stores on your device is a technical setting in local storage that records whether telemetry is switched on. The random identifier used to send these events is kept in memory only and discarded when you reload or close the page, so it does not connect one visit to the next. Your IP address is not passed on to PostHog for this telemetry, and no location is attached to these events. You can disable all telemetry by blocking requests to our analytics endpoint via a browser extension or network-level ad blocker.

10.6 Community design study

Tally stores survey answers and optional giveaway email, country or region and eligibility confirmation together. These submissions are not anonymous. Research exports exclude contact details and giveaway fields. Prize selection does not use answer text. Raw Tally responses and identifiable research exports are deleted 90 days after the survey closes; only de-identified findings are retained afterward. Prize records are kept only as needed for fulfillment and applicable recordkeeping. Entry does not subscribe you to marketing. Any records from the retired verification test remain subject to their existing expiry, 30 days after its verification deadline.

10.7 Email preferences

Newsletters and product updates have separate optional subscriptions in your account settings. Email unsubscribe links let you stop the selected category or all optional emails without signing in. These preference pages exclude product analytics, advertising tracking and session recordings. We keep operational records of preference changes and mailbox verification to honor your choices and prevent someone else from re-enrolling an unsubscribed address. Account, security, billing and requested activity emails retain their existing delivery rules.

10.8 Deck review panel

If you apply to join our Brawl deck review panel, the sign-up form, hosted by Tally, collects your Discord and Arena usernames, the email of your Spellweave account, your country or time zone, your answers about your playing experience and any evidence you choose to share, such as a screenshot or a tracker link. These submissions are not anonymous. We use them only to select and contact panel members. If you are selected, your reviews are stored in Spellweave with your account, and we keep the records needed to issue and account for your reward. Applications from people who are not selected are deleted 90 days after recruitment closes. You can ask us to delete your application at any time.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy.

12. Children's Privacy

Our Service is not directed to children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete it.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes, we may also notify you via email.

Your continued use of the Service after any changes indicates your acceptance of the updated Privacy Policy.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: [email protected]