Privacy policy
Last updated October 10, 2026
Who runs Cardmoor
Cardmoor (cardmoor.com) is run by Krzysztof Tarnowski. For anything about your data, write to chris@cardmoor.com.
What Cardmoor stores about you
- Your account. Your name, e-mail address, username, the city where you play, and a hashed password. A phone number is stored only if you add one to a request or to your binder QR code.
- Your cards. The cards, albums, tags, decks and want lists you add, and which cards you offer for trade, sale or loan.
- Your activity with other members. Messages, trade and loan requests, and the cards in your cart.
- Newsletter. Your e-mail address, if you subscribe to development updates.
- Technical data. The IP address and browser of each request, kept in server logs for security, abuse prevention and rate limiting.
Why it is stored
- To run the service you signed up for: showing you your collection, matching want lists with other members' offers, and delivering messages and requests between members.
- To keep the service safe: preventing abuse, limiting automated traffic and fixing errors.
- To send you the newsletter, only when you have asked for it. You can unsubscribe at any time with the link in every e-mail.
What other members can see
Your username, city and the cards you put on offer are visible to logged-in members and to anyone you hand a binder QR code to. Your name and e-mail address can be shown to the other side of a request once you send or accept one, so you can arrange the handover. Nothing else is shared.
Services that process data for Cardmoor
- Postmark delivers transactional e-mail such as verification codes and request notifications.
- MailerLite keeps the newsletter list.
- Sentry collects error reports, which can include the request that failed.
- Cloudflare stores uploaded files.
- The hosting provider that runs the Cardmoor servers.
Card data and images are loaded from Scryfall. Your browser requests those images directly from Scryfall's servers.
Cookies
Cardmoor sets only the cookies it needs to work: one that keeps you logged in and one that remembers when you dismissed an announcement. There are no advertising or tracking cookies.
How long data is kept
Your account data and cards are kept for as long as your account exists. Server logs are kept for a limited time and then discarded. When you ask for your account to be deleted, your data is removed, except for records that must be kept for the other side of a completed trade or loan.
Your rights
You can ask to see the data Cardmoor holds about you, to have it corrected, exported or deleted, and to object to how it is used. Write to chris@cardmoor.com. You can also complain to the data protection authority in your country.
Changes
When this policy changes, the date at the top is updated. Significant changes are announced on Cardmoor.