Last updated: July 13, 2026
Will of Deck is operated by Los Necios LLC, a South Dakota limited liability company. In this Privacy Policy, "Will of Deck," "Los Necios," "we," "us," and "our" refer to Los Necios LLC.
Contact Information:
We are committed to protecting your privacy and ensuring you have a positive experience while using our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.
When you sign up using email/password with Supabase Auth, we (via our infrastructure providers) collect and maintain:
We intentionally collect only what is needed to operate the Site. Today that includes data from:
We do not run additional first-party behavioural analytics dashboards beyond the items above unless we update this Privacy Policy accordingly.
We persist the playable content you expressly save inside the cloud database, currently including:
ui_preferences so they carry across sessions and devicesTo show estimated card and collection values, we maintain catalogue-wide market price records in our database (for example, latest market or mid prices keyed to cards in our catalogue). These rows are not sold to third parties and are not a list of what you personally own; they are reference data used to multiply against your saved collection quantities.
When you use collection value features while signed in, we compute display totals on our servers from your saved collection plus those reference prices. If we enable historical charts, we may store per-account snapshots (such as a weekly total) so you can see trends. We do not collect bank accounts, credit cards, or investment profiles for this feature.
Market figures originate from third-party market data feeds (see Third-Party Services). Coverage may be incomplete; unpriced cards are excluded from totals where no reference price exists.
Portions of your experience use browser storage (typically localStorage or sessionStorage) for draft recovery (for example unfinished decks), presentation preferences (theme and background style), optional play-style selection, optional proxy-creator payloads, or short-lived UX flags.
When you are not signed in, those preferences stay on your device only. When you are signed in, theme, background style, and play style additionally sync to your profile in Supabase (see Saved content above). Other local-only artefacts—such as unfinished deck drafts or proxy-creator payloads—still do not sync unless you explicitly save the corresponding data inside your logged-in workspace. Clearing site data from your browser will remove local copies; signed-in UI preferences remain in your profile until you change or delete your account.
We use the information we collect for the following purposes:
If you are located in the United Kingdom or European Economic Area, we process your personal information based on the following lawful bases under GDPR and UK GDPR:
| Purpose | Lawful Basis |
|---|---|
| Create and maintain your account | Performance of contract |
| Authenticate and log you in | Performance of contract; Legitimate interests |
| Save decks, collections, binders, and preferences | Performance of contract |
| Process subscriptions and payments | Performance of contract |
| Maintain invoices and tax records | Legal obligation |
| Prevent fraud and abuse | Legitimate interests; Legal obligation |
| Secure the service and protect accounts | Legitimate interests |
| Respond to support requests | Contract; Legitimate interests |
| Send required account notices | Contract; Legitimate interests |
| Send promotional communications | Consent (where required) |
| Operate analytics (essential) | Legitimate interests |
| Operate analytics (non-essential) | Consent (where required) |
| Establish or defend legal claims | Legitimate interests |
Where we rely on legitimate interests, we have conducted balancing assessments to ensure our interests do not override your rights and freedoms. Where we rely on consent, you have the right to withdraw consent at any time.
Supabase powers authentication, PostgreSQL-backed application data for features you sync to your account (with Row Level Security), automated backups handled by Supabase, and HTTPS transport encryption for API calls routed through Supabase-hosted endpoints. Operational detail is described in Supabase's own privacy policies and Trust Center publications.
The public Will Of D. Eck frontend is deployed on Vercel, which terminates TLS, serves static bundles, emits edge logs (including originating IP/port metadata Vercel needs to mitigate abuse), and powers the Web Analytics instrumentation identified elsewhere in this policy.
Stripe, Inc. processes all subscription payments and billing for Pro memberships. When you subscribe to Pro, Stripe may collect and process:
What Los Necios LLC receives from Stripe:
Important: We do NOT store full credit card numbers, CVV/CVC security codes, or complete payment credentials. Stripe handles all sensitive payment data on PCI DSS compliant infrastructure. We have configured our integration to ensure payment credentials never touch our servers.
Stripe's Role
Stripe's role depends on the activity. Stripe processes information:
Los Necios LLC remains responsible for lawful processing bases, vendor due diligence, checkout disclosures, data minimization, access controls, retention policies, responding to your rights requests, and secure technical integration.
Stripe's infrastructure is US-based with international compliance certifications. Data transfers are protected by Stripe's Data Processing Agreement and Standard Contractual Clauses. For details on how Stripe processes and protects payment data, review Stripe's Privacy Policy.
Estimated card and collection values rely on third-party trading-card market catalogues and price feeds (for example, data aggregated via TCGCSV-style product and price APIs). We ingest reference prices into our database; we do not send your account email, password, or full collection export to those providers as part of routine price display. Their own terms and privacy policies govern how they collect and license source market data.
Card artwork may be loaded from our catalogue storage or, in some cases, retrieved through our application servers from third-party image URLs solely to render the interface. That processing is for display convenience; we do not use it to build a separate commercial image library.
Features such as ticketing, storefronts, or marketing automation may introduce additional subprocessors later. Whenever we materially expand processing, we will update this Privacy Policy and, when required by law or contract, notify you beforehand.
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:
However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.
You have the following rights regarding your personal information:
To exercise these rights, please contact us using the information provided in the Contact Us section below.
We retain your personal information according to the following schedule:
| Data Type | Retention Period |
|---|---|
| Active account data (profile, decks, collections) | Duration of active account |
| Deleted account data | 30-90 days, then deleted or anonymized |
| Backups containing deleted data | Overwritten within 90 days |
| Security and access logs | 90-365 days |
| Support correspondence | 2 years after case closure |
| Subscription and invoice records | 7 years (tax/accounting requirements) |
| Payment dispute and chargeback records | Duration of dispute plus 6 years |
| Fraud prevention records | Duration of applicable limitation period |
| Policy acceptance records | Account lifetime plus legal defense period |
| Tournament, match, and trade records | Account lifetime plus 90 days post-deletion |
| Analytics data | 12-24 months maximum |
| Browser local storage (offline drafts, preferences) | Until you clear browser data or app expiration |
When You Delete Your Account
When you delete your account, we will delete or anonymize your personal information within 30-90 days, except where we are legally required to retain it for:
Some information in automated backups may persist for up to 90 days until backups are overwritten in the normal course of operations.
To use Will of Deck:
We do not knowingly collect personal information from children under 13 without parental authorization. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us immediately at privacy@willofdeck.com. If we discover that we have collected information from a child under 13 without verified parental consent, we will delete that information promptly.
If a parent or guardian purchases a Pro subscription for a minor, the parent/guardian is responsible for:
If we introduce community features such as messaging, public chat, enhanced public profiles, or user-generated content areas beyond our current tournament and trade features, we will conduct a separate child-safety assessment and may implement additional age restrictions, parental controls, and content moderation.
Given that trading card games attract minors, we may assess compliance with the UK Age Appropriate Design Code before materially expanding features accessible to children.
Los Necios LLC operates from the United States (South Dakota). Your information may be processed by us and our service providers in the United States and other countries where our vendors operate.
When your information is transferred outside your country, we protect it through:
These transfers are necessary to provide the Service and fulfill our contract with you. You may request more information about the safeguards we use for international transfers by contacting us at privacy@willofdeck.com.
If you are a California resident, you have specific rights regarding your personal information under the California Consumer Privacy Act (CCPA):
To exercise these rights, please contact us at privacy@willofdeck.com. We will verify your identity before processing your request.
If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) and UK GDPR:
To exercise any of these rights, please contact us at privacy@willofdeck.com with:
We will verify your identity before processing your request to ensure we are disclosing or modifying information only to the authorized account holder.
We will respond to your request within 30 days. In complex cases, we may extend this period by an additional 60 days and will notify you of any delay and the reasons for it.
In some cases, we may be unable to fully comply with your request where:
We will explain any limitations or reasons for denial in our response.
If you are not satisfied with how we handle your request or our data practices, you have the right to lodge a complaint with your data protection supervisory authority:
EEA Residents:
Contact your national data protection supervisory authority
Find your authority: EDPB Member List
We process your data based on: (1) your consent, (2) performance of our contract with you, (3) compliance with legal obligations, or (4) our legitimate interests. See the "Lawful Basis for Processing" section above for details. Data transfers comply with UK adequacy decisions, Standard Contractual Clauses, and UK International Data Transfer Addenda where applicable.
We use cookies, browser storage, and similar technologies to provide and improve our Service. This section explains what technologies we use and your choices.
These are essential for the Service to function and cannot be disabled:
These enhance your experience and help us improve the Service:
UK and EEA Users:
For non-essential cookies and technologies, we will ask for your consent through a cookie banner. You can:
All Users:
You can also manage cookies through your browser settings. Note that disabling necessary cookies will affect your ability to use certain features of the Service. Browser controls alone do not constitute valid consent for non-essential cookies under UK/EU law.
Detailed Cookie Information: For a complete list of cookies, their purposes, duration, and third-party cookies, see our separate Cookie Policy.
We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
We will respond to your inquiries within a reasonable timeframe, typically within 30 days.