grimorio

Privacy

Last updated 12 October 2026

grimorio keeps track of the Magic: The Gathering cards you own and how you arrange them. To do that it needs to know who you are and what is in your collection, and nothing more. This page says exactly what that means.

Who is responsible

grimorio is run by Luiz Henrique, an individual in Brazil, who is the controller of the personal data described here under Brazil's General Data Protection Law (LGPD).

What is kept

• Your account. When you sign in with Google, Google tells grimorio your email address, your name and the address of your profile picture. These are stored with your sign-in so the app knows it is you. Your Google password never reaches grimorio.
• Your collection. The binders you make, their names, colours and layouts, the sets and sections in them, the cards you have placed or removed, the cards you own with their finish and quantity, and when each of these was added.
• Shared links. If you share a binder, a random link to it. Anyone with that link can see the binder's name, its cards and which of them you own. They cannot see your email or anything else in your account.
• Ordinary technical records. Like any website, the services that run grimorio see your IP address and browser when your device connects, and keep short-lived logs of requests to keep the service running and secure.

What is not

No payment details, no location, no contacts. grimorio shows no ads, does not sell or rent your data, and does not use it to profile you or to train anything.

Why

Your account and collection are kept because they are the service: without them there is nothing to show you. That is the legal basis — performing the service you asked for. Technical records and visit statistics are kept on the basis of a legitimate interest in keeping grimorio working, secure and worth improving.

Cookies, storage and statistics

grimorio sets no tracking cookies. Your browser stores your sign-in session so you stay signed in, and keeps a cache of card images so pages load quickly; both stay on your device. Visits are counted with Vercel Web Analytics, which uses no cookies, does not follow you to other sites and reports only totals, such as how many people opened a page.

Who else handles it

grimorio relies on these services, each of which processes data only to provide its part:

• Supabase — the database and sign-in. Your account and collection are stored in its São Paulo, Brazil region.
• Vercel — hosting and visit statistics. Requests may be served from outside Brazil.
• Google — signing in with your Google account, and the typeface the pages use (Google Fonts).
• Scryfall — card images, which your browser loads directly from Scryfall's servers.
• jsDelivr — delivers the sign-in library to your browser.
• Apple iCloud — stores the daily backups described below.

Some of these process data outside Brazil. Where they do, it is under their own data protection commitments, as the LGPD allows for international transfers.

How long

Your account and collection are kept for as long as you have an account. A backup of all collections is made every day and kept for 15 days, so after you delete your account, copies of your collection disappear from the backups within 15 days. Backups are used only to recover from accidents, never to bring back an account its owner deleted.

Your rights, and how to use them

You can see, correct, take and delete your data yourself, at any time, from the account menu — the round button with your initial at the top of the app:

• Download my data gives you a file with everything grimorio holds about you, in a format other software can read.
• Delete account removes your account and your whole collection at once. Shared links stop working immediately. It cannot be undone.
• Binder names, contents and what you own can be changed in the app as you go.

The LGPD also gives you the right to know who your data is shared with (listed above) and to complain to Brazil's National Data Protection Authority (ANPD).

Security

Connections are encrypted. Each person's collection can be read only with their own signed-in session, and this is tested automatically. No system is perfectly secure; if something went wrong that put your data at risk, it would be announced in the app.

Children

grimorio is not meant for children under 13, and does not knowingly keep their data.

Changes

If this policy changes, the date at the top changes with it. A change that affects what is done with your data will be announced in the app before it applies.