Privacy Policy

1. Who we are and what this covers

This Privacy Policy explains how Younan Holdings LLC ("we," "us") collects, uses, shares, and protects personal information when you use MTG Deal Sniper, including https://mtgdealsniper.com, our web app, and our emails (the "Service"). It does not cover third-party sites you visit from our links; their own policies apply.

2. Information you give us

- Account information: your email address; a password, which we store only as a salted, one-way hash and never in readable form; and, if you use Google Sign-In, the Google account identifier and email address Google shares with us. We also record whether you have verified your email.

- Two-factor authentication: if you turn on two-factor authentication, we store your authenticator secret in encrypted form and your recovery codes only as one-way hashes.

- Plan and billing information: your plan, and the customer and subscription identifiers that Stripe gives us. Stripe collects your payment card details directly; we do not receive or store your full card number, card brand, last four digits, or billing address. We store subscription status that Stripe sends us (such as active or canceled) so we know which plan to apply.

- Your content and settings: watchlists, collection entries and their history, and alert and email preferences (including whether you opted out of the daily digest).

- Legal acceptances: the version of the Terms and Privacy Policy you accepted, when you accepted them, how you accepted them (for example, at sign-up or at checkout), any arbitration opt-out, and your confirmation that you are 18 or older.

- Messages to us: if you use our contact form or email us, we receive your email address, subject, and message. Contact-form messages are sent through our email provider, Resend, to hello@mtgdealsniper.com, which our domain provider, Porkbun, forwards to our mailbox. They are not stored in our app's database.

- Waitlist emails: if you join the waitlist, we store your email address only to tell you about launch and updates, and only after you confirm it via a link we email you. Unconfirmed signups may be deleted after 30 days. We keep confirmed addresses until launch plus 90 days, or until you ask us to remove them by emailing hello@mtgdealsniper.com.

3. Information we collect automatically

- IP address and request information: when you use the Service, our hosting provider (Railway) and our app receive your IP address, browser type, and request details (such as the page or endpoint requested, the time, and the response code). Railway keeps these in server logs for up to 30 days. Our app does not write request logs or a sign-in history to its own database. To slow down abuse of sign-in, sign-up, password-reset, two-factor, and contact features, the app keeps recent IP addresses and email addresses in temporary memory; this is cleared whenever the app restarts and is never written to the database.

- Security tokens: password-reset, email-verification, and sign-in codes are stored only as single-use tokens that expire.

- Email: we have not turned on open or click tracking with our email provider, Resend, so our emails don't contain tracking pixels or tracked links. Resend keeps a record of each email we send (such as recipient, subject, content, and delivery status) for up to 30 days.

- We do not use third-party analytics, advertising, or session-recording tools on the Service.

4. Cookies and similar technologies

- Strictly necessary session cookie: a cookie named mds_session keeps you signed in and protects your session. The Service cannot work without it.

- Browser storage: we store your theme choice (light/dark) in your browser's local storage and may temporarily store a pending-checkout marker in session storage so you return to the right page after paying. These stay on your device.

- Third-party content loaded by the page: our pages load card images from Scryfall's image servers. Fonts are files we host ourselves. When your browser fetches card images, Scryfall receives your IP address and standard request information under its privacy policy.

- Sign-in and payment pages: if you use Google Sign-In or Stripe's checkout or billing pages, Google or Stripe may set its own cookies on its pages.

- Affiliate links: if you click an affiliate link to TCGplayer (through the Impact affiliate network) or Mana Pool, that store or network may set cookies on its site to credit the referral. We do not place advertising cookies on our site.

- We do not currently respond to "Do Not Track" browser signals because we do not track you across other sites. We do not sell or share personal information.

- Global Privacy Control: if your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of the sale or sharing of your personal information. We don't sell or share personal information, so there is nothing more to turn off; if that ever changes, we will honor GPC signals automatically.

5. How we use information

We use personal information to: (a) create and run your account and verify your email; (b) provide price estimates, watchlists, collections, charts, and alerts; (b-1) show you suggested deals: on your Watchlist we show a short "Suggested for you" row. To choose it, we estimate a typical price range for you from the estimated values of cards in your collection and the prices on your watchlist, and we leave out cards you already own or watch. This estimate stays inside the Service. We do not share it, use it for ads on other sites, or use it to make decisions with legal or similarly significant effects; (c) send the emails you ask for (alerts and digests) and service emails (verification, password resets, security notices, receipts, renewal reminders, and changes to our Terms or this policy); (d) process subscriptions, prevent fraud, and handle billing questions; (e) secure the Service, rate-limit abuse, and enforce our Terms; (f) respond to your messages; (g) understand how the Service is used so we can improve it, using counts and summaries we calculate from our own systems (for example, how many watchlist items we checked or how many alerts we sent), and publish aggregated statistics as described in Section 6A. We do not use third-party analytics tools for this; and (h) comply with law and protect our rights.

6. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose it only as follows:

- Service providers that work for us under contract: Railway (hosting, database, backups, and server logs), Stripe (payments and billing), Resend (sending our emails, including contact-form messages to our inbox), and Porkbun (forwarding mail sent to hello@mtgdealsniper.com to our mailbox). They may use your information only to provide their services to us.

- Sentry (error monitoring): receives technical error reports, such as error messages, code traces, browser or device type, and app version, with email addresses, names, IP addresses, and request contents removed. It keeps them for up to 90 days.

- Companies your browser connects to directly, or that act on their own: these companies handle information under their own privacy policies, not as our service providers.

- Google: if you choose Google Sign-In.

- Scryfall: your browser loads card images and set symbols from Scryfall's servers, which receive your IP address and standard request information.

- Stripe: on Stripe's checkout and billing pages, Stripe also uses some information for its own purposes, such as preventing fraud.

- Stores and affiliate networks: if you click a link to a store (TCGplayer through the Impact network, Mana Pool, or Card Kingdom), that site receives your visit and may set its own cookies (see Section 7).

- For legal reasons: to comply with law or valid legal process, to enforce our Terms, or to protect the rights, safety, and security of our users, the public, or us.

- In a business transfer: if Younan Holdings LLC is involved in a merger, acquisition, financing, or sale of assets, subject to this policy's protections, with notice to you.

- With your consent or at your direction.

Aggregated statistics: see Section 6A.

6A. Aggregated statistics

We may publish statistics built from many users' watchlists and collections, such as the most-watched cards this week, on the Service and in articles on our site. We build them from distinct-account counts across many accounts. They never include names, email addresses, handles, account numbers, or scrambled versions of them. We don't publish a watchlist figure based on fewer than 5 accounts, or a collection figure based on fewer than 10 accounts. We also round or hold back figures, including with a weekly lag when needed, so that comparing two releases or using published totals can't reveal one person's activity or recover a hidden count. The nightly analytics copy we keep for this purpose holds only these aggregated figures, not individual users' records. We commit to keeping these statistics in aggregated, de-identified form and will not try to re-identify anyone from them, except to test that our process works. If we ever give these statistics to another company, we will require it by contract to follow the same rules.

7. Affiliate links and other websites

Some links to stores are affiliate links. When you click one, we may pass the store or affiliate network a referral identifier for MTG Deal Sniper, not your name or email address. What the store or network then collects is governed by its own privacy policy.

8. How long we keep information

When you delete your account, in the Service or by email, we delete your account and the information tied to it, including your email address, sign-in details, watchlists, collections, wishlists, and alert and email settings, except:

- Legal-acceptance records: which Terms and Privacy Policy versions you accepted, when and how, and your confirmation that you are 18 or older. We keep these for 6 years after deletion, linked only to a scrambled one-way code made from your email address, not your email address itself, so we can show what was agreed if a dispute comes up. Then we delete them.

- Billing records: your plan, charges, refunds, and payment-processor reference numbers, kept for 7 years after deletion for tax, accounting, and chargeback purposes, linked the same way. Stripe keeps its own records under its own policy.

- Messages to us: contact-form messages are delivered by email to our inbox and are not stored in our app database. We keep correspondence as long as needed to respond and for our records, or longer if needed for a dispute.

- Logs and backups: this application does not store request logs in its database. Our hosting provider's server logs, which include IP addresses, are normally kept for up to 30 days, and database backups for up to 90 days. Copies in them expire on that schedule, and we do not restore deleted accounts from them.

- Email records: our email provider keeps a record of each email we send (the address, subject, time, and delivery status) for up to 30 days.

We send one email to confirm the deletion.

We may keep information longer if the law requires it or to resolve a dispute.

9. Security

We use reasonable safeguards, including encrypted connections (HTTPS), password hashing, encrypted storage of two-factor secrets, hashed recovery codes, single-use expiring password-reset tokens, rate limiting, and restricted access to production systems. No system is perfectly secure, so please use a strong, unique password and two-factor authentication. If a breach affects your personal information, we will notify you as required by law.

10. Your choices and rights

- Emails: You choose which optional emails you get in your account settings. The optional types, depending on your plan, are Deal alerts, Big moves, Buy List Alert, Daily summary, and Product news. Product news is off unless you turn it on. You can also turn off all optional emails at once, or pause them for 1 day, 1 week, 1 month, or until you turn them back on. Every optional email has an unsubscribe link; unsubscribing takes one confirming click, and if your email app shows its own "Unsubscribe" button, using it takes effect right away. We still send necessary account emails that you can't turn off, such as security and sign-in notices, receipts and billing notices, renewal reminders, and important changes to our Terms or this Privacy Policy. These necessary emails don't contain advertising.

- Access, correction, export, and deletion: you can view and edit much of your information in the Service. You can also email hello@mtgdealsniper.com from your account email to ask us to (a) confirm whether we process your personal information and give you a copy, (b) correct it, (c) delete it, or (d) give you a portable copy in a common format. We will respond within 45 days (we may extend once by 45 days if reasonably necessary and will tell you if we do). We will confirm your request before acting on it, normally by sending a link or code to your account email or by asking you to confirm while signed in.

- Deletion: you can delete your account yourself in your account settings, or email hello@mtgdealsniper.com from your account email. Before deleting, we confirm it's you with your password, a Google sign-in, or a code sent to your email. Section 8 explains what we keep.

- Opt-out rights: we do not sell personal information, share it for targeted advertising, or use it for profiling that produces legal or similarly significant effects, so there is nothing to opt out of. If that ever changes, we will update this policy first and give you a way to opt out.

- Appeals: if we decline your request, you may appeal by replying to our decision or emailing hello@mtgdealsniper.com with the subject "Privacy appeal." We will respond within 45 days and explain our decision. If you are not satisfied, you may contact your state attorney general.

- No discrimination: we will not deny service, charge different prices, or provide a different quality of service because you exercised a privacy right.

- Authorized agents: where the law allows, you may use an authorized agent; we may ask for proof of the agent's authority and verify your identity directly.

11. Adults only; children's privacy

The Service is only for people 18 and older, and we do not knowingly collect personal information from anyone under 18, including children under 13. We ask every user to confirm they are 18 or older when they create an account. If we learn that we have collected personal information from someone under 18, we will close the account, cancel any subscription with a refund for the current billing period, and delete the information, except for: the records we need to process the refund; the legal-acceptance record showing the 18+ confirmation that was given, kept as described in Section 8; and a scrambled, one-way copy of the email address, used only to stop it being used to sign up again. If you believe a person under 18 has given us information, please email hello@mtgdealsniper.com.

12. Notice to residents of U.S. states with privacy laws (including California)

In the past 12 months, we have collected these categories of personal information, for the purposes and with the recipients described in Sections 2–6: identifiers (such as email address, account identifiers, and IP address); customer records and commercial information (such as plan and subscription history, and the cards on your watchlists and in your collection); internet or electronic network activity (such as server log entries kept by our hosting provider, and in-app activity like watchlists and alerts); and inferences, limited to the estimated price range we use to choose the suggested deals described in Section 5. We do not collect sensitive personal information as defined by those laws, except account log-in credentials (email address and password) used only to let you sign in. We do not sell or share personal information, and we have no actual knowledge of selling or sharing personal information of anyone under 16. Residents of states with consumer privacy laws may exercise the rights in Section 10. California residents may also ask us about disclosures of personal information to third parties for their direct marketing; we make none.

13. Where the Service is offered

The Service is offered only to people in the United States, and our providers store information in the United States. We don't offer the Service in the European Union, the United Kingdom, or other countries. If that changes, we will update this policy before we do.

14. Changes to this policy

If we make material changes, we will notify you by email and/or in the Service before they take effect and update the version and effective date above. We keep earlier versions on file and will provide them on request.

15. Contact

Questions or requests: hello@mtgdealsniper.com · Younan Holdings LLC (MTG Deal Sniper)