Privacy Policy
Last updated August 18, 2026
Grimoire is operated by KAL Technologies LLC, doing business as mrKaltech, as a personal, non-commercial showcase project. This policy describes what data the service handles and where it goes. The short version: we collect only what the app needs to work, we run no analytics, advertising, or tracking of any kind, and we never sell or share your data.
What we collect
When you create and use an account, we store:
- Account details — your email address and display name. Your password is stored only as a salted PBKDF2 hash; we never store or see the plaintext.
- Session tokens — a random sign-in token, stored hashed, kept in an HttpOnly cookie for up to 30 days.
- Your content — everything you add to the app: collection entries (including any locations, purchase prices, tags, and notes you enter), decks and deck notes, wishlists, and the raw text of any files you upload to the importer.
- An audit log — a record of changes made to your account's data, including whether each change came from your browser or from an AI assistant you connected.
- Rate-limiting records — to protect sign-in and registration, we briefly record a salted hash of your IP address (never the raw address). These records are deleted within 24 hours.
Cookies and local storage
Grimoire sets exactly one cookie: the session cookie that keeps you signed in. Your light/dark theme preference is kept in your browser's local storage and never leaves your device. There are no analytics, advertising, or third-party tracking cookies.
Third-party services
Grimoire relies on a small set of services to function:
| Service | What it does | What it receives |
|---|---|---|
| Scryfall | Card catalog, printings, and price estimates | Card search queries, sent from our server |
| Scryfall image CDN | Card artwork and mana symbols | Images load directly in your browser, so your IP address and browser details reach Scryfall |
| Commander Spellbook | Combo detection for decks | The card names in the deck being analyzed |
The application and its data are hosted on standard cloud infrastructure providers, and the account-verification email is delivered through a transactional email service. These providers process data solely on our behalf to run the service.
AI assistants and API access
Nothing is shared with any AI service unless you create an API token in Settings and connect an assistant yourself. Tokens are read-and-propose only by default; granting write access is a separate, explicit opt-in, and you can revoke any token at any time.
Public share links
Sharing is off by default. When you create a share link for a deck or a variation, that one build — its name, format, strategy note, and full decklist — becomes readable by anyone holding the link, without signing in, and is offered as a plain-text decklist so other sites can import it. The shared page shows the same card list the vault does: printings, card images, Oracle text, and each card's public market price from Scryfall. The link uses an unguessable token and asks search engines not to index it, and you can revoke or replace it at any time from the deck's Share dialog. Nothing else is published: not your notes, budget, maybeboard, collections, ownership, or the other builds in the same deck family. Each build needs its own link, so sharing a deck never publishes its variations and sharing a variation never publishes its primary.
Data retention and backups
Your data is kept for as long as your account exists. Routine encrypted database backups are made for disaster recovery and are retained for up to 30 days. Expired sessions, stale verification links, and rate-limit records are purged automatically by a daily cleanup job.
Your data
- Export — you can download your complete collection, decks, and deck entries as portable JSON at any time from Settings → Own your data.
- Deletion — to delete your account and its data, email us at the address below and we will remove it manually. (As a small showcase project, there is no self-serve deletion button yet.)
What we don't do
We do not sell your data, share it with advertisers, build profiles, or use your content for anything other than running the service for you.
Children
Grimoire is not intended for children and is not directed at anyone under the age of 18. We do not knowingly collect information from children, and we do not monitor, review, or verify the age of users or the content submitted through the service or its API. If you believe a child has provided information to the service, contact us and we will delete it.
Changes to this policy
We may update this policy from time to time; the "Last updated" date above reflects the current version.
Contact
Privacy questions or deletion requests: lala@mrkaltech.com