Timewalked
Sign in

Legal

Privacy Policy

Last updated: September 30, 2026

Timewalked ("we," "us," "this site") is a tool for building and evaluating Magic: The Gathering Commander decks. This policy explains what information we collect, why, and what you can do about it.

What we collect

If you never create an account: nothing. Decks you build are stored only in your own browser (localStorage) and never sent to us. We don't know you were here.

If you create an account, we (via Supabase, our authentication and database provider) store:

  • Your email address (if you sign in with Google, the email address of your Google account, which Google shares with us)
  • Your password, hashed — we never see or store your actual password; Supabase's authentication service handles that
  • The decks you build while signed in, so they follow you across devices
  • Nothing else. No name, no address, no payment information (this site doesn't charge for anything), no phone number

If you play the card gut-check game (Rate a card), whether or not you have an account, we store an anonymous player identity (a random ID in a cookie, not tied to your email unless you're also signed in) along with your votes on cards, your points, and your streak. If you set a display name for the leaderboard, that name is public to other players. If you add a note to a vote, that note may be shown publicly on the Insights page.

We do not use advertising or tracking cookies. The only cookie this site sets is a functional session cookie, used to keep you signed in (or to remember your anonymous game identity) — nothing that follows you across other sites, nothing sold to anyone.

Who else sees it

  • Supabase (our database and authentication provider) stores your account and deck data on our behalf, under their own security practices. Supabase's privacy policy covers their handling of it.
  • Google, only if you choose "Continue with Google." Google handles that sign-in and tells us your email address; we never see your Google password. Google's privacy policy covers their side, including that they know you signed in to Timewalked.
  • Resend (our email provider) sends the emails this site generates — account confirmation and password reset — so it sees your email address and the content of those messages.
  • Sentry (error monitoring) receives technical details when something breaks on our servers, such as which page failed and what the error was. We've configured it not to send personal data like your email or cookies.
  • Render (hosting) and Cloudflare (domain and DNS) handle the traffic that reaches the site, as any host does.
  • Scryfall is queried live when you search for a card or build a deck, to get card data. Commander Spellbook's public combo database is kept as a copy on our servers and refreshed weekly, and occasionally queried live to settle a combo that depends on a generic card. In both cases we send card names and quantities — never your email, your account, or anything that identifies you.
  • We do not sell, rent, or share your data with anyone else. No advertisers, no data brokers, no "partners."

How long we keep it

Account and deck data is kept as long as your account exists. Game and leaderboard data (anonymous unless you've also signed in) is kept indefinitely as the crowdsourced dataset this project is partly built on, but nothing in it identifies you personally unless you've chosen a public display name.

Your choices

  • Delete your account: while signed in, open Account in the site header and choose "Delete my account." Your account and every deck saved to it are deleted immediately and can't be recovered. Copies of decks already saved in your own browser stay on that device until you clear your browser's site data, but they no longer sync anywhere. If you can't sign in, email us (see Contact below) and we'll do it for you.
  • Export your decks: anything in your account can be viewed and copied from the deck builder at any time. There's no separate export tool, but nothing is locked away from you either.
  • Anonymous use: you can use the deck builder and classifier without ever creating an account. Nothing about this site requires signing up.

Children's privacy

This site isn't directed at children and we don't knowingly collect information from anyone under 13. If you believe a child has created an account, contact us and we'll remove it.

Changes to this policy

If this policy changes in a way that matters (what we collect, who we share it with), we'll update the date above and, for signed-in users, make a reasonable effort to let you know.

Contact

Questions about this policy or your data: privacy@timewalked.com