Privacy Policy

Last updated: July 13, 2026

Who we are

Divining Top (diviningtop.gg) is an independent, unofficial deckbuilding and card-discovery tool for Magic: The Gathering's Commander format. For anything privacy-related, contact [email protected].

What we collect

Without an account

• Decks you build are stored in your browser's local storage, on your device. They are not sent to or stored on our servers.
• Server logs. Like nearly every website, our servers record standard request logs (IP address, browser user-agent, requested URL, timestamp), used only for security, debugging, and abuse prevention. Logs rotate automatically and are kept for no more than 30 days.
• Rate-limit counters keyed to your IP address, held briefly in memory to keep the service healthy for everyone.

With an account (sign in with Google or Apple)

• Your email address, as provided by your sign-in provider. Apple's "Hide My Email" relay addresses are fully supported.
• A provider identifier — the opaque ID Google or Apple uses to identify your account to us. We never see your password.
• Your saved decks, with their timestamps.

That is the full list. We don't collect names, birthdays, locations, or payment information — the site is free.

How we use it

• Signing you in and keeping you signed in.
• Storing and showing your saved decks.
• Preventing abuse of the service.
• If we later offer an email digest, it will be strictly opt-in. We will not email you otherwise, and never on anyone else's behalf.

Cookies

When you sign in, we set a single first-party session cookie (HttpOnly, Secure, SameSite=Lax) so you stay signed in. There are no advertising cookies, no cross-site tracking, and no third-party analytics scripts anywhere on the site.

Search queries and AI providers

Natural-language search (for example, "cards that untap my artifacts") is interpreted with the help of third-party AI APIs (currently Anthropic and OpenAI). Only the query text and the deck context needed to answer it (such as your commander's name) are sent — never your email, account identifier, or IP address. We use these providers under their API terms, which do not permit training on this data. We may cache interpreted queries (keyed to the query text, not to you) so repeated searches skip the AI call entirely.

Card data and images

Card data and images come from Scryfall. Card images load in your browser directly from Scryfall's servers, so Scryfall receives standard web-request information (such as your IP address) when images load — see Scryfall's privacy policy.

Affiliate links

Outbound links to card retailers may include an affiliate code, meaning the retailer knows the visit came from Divining Top and may pay us a commission on purchases. Retailers do not share any personal information about you or your order with us.

Infrastructure

The service runs on a server rented from Vultr, behind Cloudflare (which provides DNS, TLS, and denial-of-service protection, and therefore processes site traffic in transit). Encrypted database backups are stored off-site and age out on a rolling schedule of at most about six months.

Data retention and deletion

Account data is kept until you delete your account. You can delete your account and everything tied to it (email, sign-in identifiers, saved decks) yourself on the account page — deletion takes effect immediately. You can also email [email protected] from that account's address and we will complete the deletion within 30 days. Deleted data may persist in encrypted backups until they age out (at most about six months); backups are used only for disaster recovery, never to restore deleted accounts.

You can also ask us for a copy of the data tied to your account, or ask us to correct it.

Children

The service is not directed at children under 13, and we do not knowingly collect personal information from them.

Changes

If this policy changes, we will update this page and its "last updated" date. For material changes affecting account holders, we will also note it prominently on the site.