Privacy

Leylines is a small fan project. This page says what it keeps, who else sees it, and how to remove it. There are no ads, no analytics and no tracking cookies.

Without an account

Your deck, saved deck list and recent searches stay in your browser's local storage. They never reach the server unless you search or ask for stats or suggestions, and the server doesn't keep them afterwards.

To answer a new search, its text is sent to Anthropic's Claude API, along with your commander's name and your previous search when they matter. Nothing that identifies you is sent. The result is cached under that search text, and searches the app couldn't understand are kept, without any link to who made them, so the vocabulary can improve.

For rate limits, the server holds your IP address in memory for up to a day. It is never written to disk.

With an account

You sign in with Discord or Google. From them we keep your name, email address and avatar link, and encrypted sign-in tokens. We don't ask for anything else. While you're signed in, a session cookie keeps you signed in, and the session records the IP address and browser it was started from.

We also keep what you save: your username, your decks with their edit history, which decks you have made public, and the decks you have liked. A public deck and your username can be seen by anyone.

Feedback

When you send feedback, we keep your message, the address of the page you sent it from, and the email address you gave for a reply, if any. If you're signed in, it is linked to your account. The reply email is deleted once we've dealt with your message; the message itself is kept to help improve the site.

When you report a tag or a suggestion as wrong, we keep which card and tag or suggestion it was, the reason you picked and any note you wrote, linked to your account, so we can fix our data.

Deleting and exporting

You can export a deck as a text list from the deck page. Deleting your account on the account page removes your account, sessions, sign-in links, decks, history, likes, reports and the feedback you sent while signed in at once. Copies can stay in the database's backups until those expire, and then they are gone.

Services we use

• Railway runs the app, and Neon hosts the database.
• Discord and Google handle sign-in. Your avatar loads from their servers.
• Anthropic reads the text of new searches, as described above.
• Scryfall provides the card data. Card images load straight from Scryfall's servers, so they see your IP address.
• Archidekt is asked for a deck when you import one by its link. The request comes from our server, not your browser.
• Sentry receives reports of errors in the app and in your browser: what went wrong, the page and your browser type. Before anything is sent, account details, email addresses, cookies, sign-in tokens, searches and deck contents are removed, and Sentry is set not to store IP addresses.