Privacy Policy

EDH Leagues is operated by abworks, the data controller for the personal data described here. For any privacy question or request, contact us at abworks.pt@gmail.com.

• Account data: your email address, display name, password (stored only as a secure hash, never in plain text), optional nationality and the card artwork you pick as your avatar.
• Google sign-in: if you choose “Continue with Google”, we receive your email address, name and whether Google has verified your email. We do not receive your Google password or access your Google account.
• Sign in with Apple: on iPhone, if you choose it, we receive the email address Apple shares with us (which can be a private relay address if you hide your email) and, the first time only, the name you allow. We do not receive your Apple ID password.
• Game and league activity: league games you take part in, scoring actions recorded during play, points, leagues you own or belong to, invitations and join requests, and action proposals and votes you submit.
• Push notifications: if you allow notifications in the mobile app, we store your device's Expo push token with your account, together with the device platform (Android or iOS), language and time zone, so we can send you game and league notifications. You can turn notifications off in the app settings or on your phone. The token is deleted when you sign out or delete your account.
• Verification codes: one-time codes for email verification and password reset, stored hashed and deleted once used or expired.
• Technical data: your IP address is used to limit abusive request rates. After a failed sign-in we keep a one-way hash of the IP address and of the email for up to 24 hours, so that repeated wrong passwords can be blocked; the IP address itself is not stored in our database. Our hosting provider may keep standard server logs for security and operation.

You can play a casual game in the app without an account. Player names typed into a casual table are only used for that game, and casual games are deleted when they are closed.

• To provide the service you ask for: your account, games, scores, leagues, standings and history (performance of a contract).
• To send emails you need, such as verification and password reset codes. We do not send marketing email.
• To keep the service secure and working, for example rate limiting and error logs without personal data (legitimate interest).

We do not sell your data, show ads, or build advertising profiles.

Your display name, avatar and nationality may be shown to other users, for example in league member lists, game results and standings. Public leagues, including their standings and results, can be viewed by anyone, even without an account. Your email address is not shown publicly.

If a league owner connects the league to a Discord channel, each approved league game is posted to that channel with the league name, the game, and the players' display names and points, along with the season standings. Anyone with access to that Discord channel can see these posts.

• Session cookie: keeps you signed in on the website. Strictly necessary.
• Language cookie: remembers the interface language you choose.
• Mobile app: your sign-in token is kept in your device’s secure storage.

We do not use analytics, advertising or third-party tracking cookies.

We rely on these providers to run EDH Leagues. They process data only on our behalf:

• Vercel: website and API hosting.
• Neon: database hosting, located in the European Union (Frankfurt).
• Resend: delivery of verification and password reset emails.
• Google: sign-in, only if you choose to use it.
• Apple: sign-in on iPhone, only if you choose to use it.
• Expo (650 Industries): delivery of push notifications to the mobile app, through Apple Push Notification service on iPhone and Firebase Cloud Messaging (Google) on Android. Only if you allow notifications.
• Discord (Discord Inc.): receives league results, only for leagues whose owner connects a Discord channel.
• Scryfall: card images are loaded from Scryfall’s servers, so your device requests them directly from Scryfall.

Some of these providers may process data outside the European Economic Area. Where that happens, transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

We keep your account and activity data for as long as your account exists. When your account is deleted, your personal data is removed. Games you played with other people stay in their history, with your seat shown as "Deleted player". Leagues you own pass to another member, or are deleted if no one else is in them. Verification codes expire within minutes.

Under the GDPR you can ask to access, correct, delete or receive a copy of your personal data, and you can object to or ask us to restrict its use. You can update your name and avatar directly in your profile.

To delete your account, go to Profile, Delete account in the app or on the website. The deletion is immediate. You can also email abworks.pt@gmail.com from the address linked to your account and we will complete it within 30 days.

If you think we have not handled your data properly, you can also complain to your data protection authority. In Portugal: the Comissão Nacional de Proteção de Dados (CNPD).

EDH Leagues is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will delete it.

If we change this policy we will update the date at the top of this page. For significant changes we will also let you know in the app.