Deck Box Privacy Policy

Last updated: September 26, 2026.

This policy explains how Deck Box, including Deck Box Pro and the related Deck Box Arena services at deckboxarena.com (collectively, the “Services”), handles personal information. “We,” “us,” and “our” refer to Decked Out Development LLC, the operator of these Services. Our privacy contact is cardboardcommander@deckboxarena.com.

Business mailing address: Decked Out Development LLC, 8 Ridley Ln Unit A, Palm Coast, FL 32164, United States

Privacy telephone number: +1 (386) 405-7649

We are the contact for questions about our information practices and the providers listed below.

1. Information we handle

Account information. When you register or sign in, we process your email address, account identifier, sign-in provider, verification status, and authentication information. Google or Apple may provide information authorized through their sign-in service, including an email address or Apple relay address. Firebase Authentication handles email/password authentication. Do not send your password or verification codes to support.

Player profiles. We store the profile information you provide, such as your name, country, date of birth, and trading-card-game player identifiers. Date of birth and game identifiers may be needed for particular tournament forms or eligibility requirements. Provide only information needed for the features and events you use.

Decks and card information. We process deck names, selected games, card names and identifiers, quantities, formats, player details attached to decks, revisions, and save times to organize, synchronize, analyze, and export your decks.

Camera and selected photos. Card images are processed on your device for text recognition. The app does not upload card-scanning photos to our servers. Recognized card information becomes part of a deck if you save it. Online card lookups may send card identifiers or search terms to card-data services. Those services receive ordinary network information such as your IP address. Device photo libraries, temporary files, and any copies you export remain subject to your device settings.

Tournament activity. When you register, submit a deck, or participate in an event, we process the information needed for that event, including player details, game identifiers, deck lists, registration status, match results, standings, and tournament history. Organizers may also supply participant information and results.

Location and discovery. If you choose a location-based search and grant permission, we use your device’s reported location to find nearby stores or events. Coordinates may be sent to our discovery service; the location supplied by your device may be precise. Searches can also use a location you enter. The current discovery feature does not require continuous background location tracking.

Notifications and preferences. We process selected games, followed stores or events, alert preferences, and notification delivery identifiers to provide requested alerts. The app also stores preferences on your device, such as tutorial and deck-box selections.

Subscriptions. For optional Pro purchases, we process your account identifier, product and transaction identifiers, purchase status, expiration and renewal information, and entitlement status. Apple or Google processes payment credentials; we do not receive your full payment card number. RevenueCat helps verify purchases and associate Pro access with your Deck Box account. It may also process technical and diagnostic information associated with its service.

Support requests. We collect the name, reply email, product, topic, subject, message, and optional device details submitted through support. We record a ticket reference, submission time, ticket status, and email delivery status. Please do not include payment card numbers, passwords, private keys, or unnecessary personal information about other people.

Parent verification and consent. The planned child-account process described in section 7 handles a parent or guardian’s email address, a reference linking the request to the child, verification status and transaction references, consent choices, notice version, and relevant timestamps. Epic Kids Web Services (KWS) and its verification providers process the information required by the method the parent selects. Parents provide verification evidence directly through that provider’s flow; our integration receives a verification result rather than copies of identity documents or full payment-card details. Verification and affirmative consent are separate steps, as explained in section 7.

Operational information. Our hosting, authentication, database, messaging, and other service providers may process IP addresses, request times, device or browser information, errors, and security logs to operate and protect their services. Support spam controls use keyed digests derived from an email address and network address rather than storing the raw network address in the rate-limit table.

2. How we use information

We use information to provide accounts and private deck storage; identify cards; generate deck lists and tournament forms; manage registration and results; display competitive records; find stores and events; deliver requested notifications; verify optional subscriptions; answer support requests; and detect abuse, resolve errors, and meet applicable legal obligations.

Pro is optional. Using the free features does not require a subscription. Support requests do not enroll you in marketing.

We do not sell personal information or use it for targeted advertising across other companies’ apps and websites. The current app does not display advertising. If we introduce materially different uses of personal information, we will update this policy and obtain consent where required before those uses begin.

3. When information is shared

Service providers. We use Google Firebase for authentication, database services, and push notifications; Supabase for backend and tournament services; RevenueCat for subscription management; Resend for support email delivery; Epic Kids Web Services for parent verification; and hosting providers to operate the Services. Apple and Google also handle their respective sign-in, payment, and distribution services. These providers receive information needed for their functions and may process additional operational information under their own terms and privacy policies.

Tournament organizers. Registering for a tournament or submitting a deck makes the relevant player and deck information available to the host and authorized event staff. Tournament forms may contain your real name, player identifier, and, where applicable, date of birth or other eligibility details. Review your submission before sending it. Organizers may have separate obligations and privacy practices, including rules governing official tournament records and publication of results.

Competitive records. Leaderboard aliases and competitive records are visible to eligible signed-in Pro users through the current leaderboard feature. An alias does not make participation anonymous. Choose an alias that does not disclose information you want to keep private. Tournament results may also be visible to people with access to the relevant event.

Exports and sharing. Deck PDFs remain on your device until you print, share, or submit them. Recipients can retain copies. We cannot control copies you or an organizer distribute outside the Services.

Support email. Support notifications containing your submitted details are sent through Resend to cardboardcommander@deckboxarena.com. Your supplied email is used as the reply address. Tickets are not publicly posted.

Legal and protective purposes. We may disclose information when required by law or when reasonably necessary to protect accounts, investigate abuse, or protect legal rights. If ownership of the Services changes, information may transfer as part of that transaction, subject to applicable law and notice requirements.

4. Permissions and choices

You can change camera, photo, location, and notification permissions through your device settings. Declining a permission can limit the related feature. You can manually enter card information and use an entered location where those options are available.

You can edit available profile information, manage saved decks, change supported notification preferences, and manage subscriptions through the store where you subscribed. Removing the app or deleting a Deck Box account does not automatically cancel an Apple or Google subscription.

Local preferences and sign-in information support normal operation. Clearing browser or app storage may remove local settings but does not by itself delete server-side records.

5. Retention and deletion

We retain account and deck information to provide the Services while your account remains active, unless you delete it sooner. We retain other information only for the purpose for which it is needed, including event administration, support follow-up, subscription verification, fraud prevention, resolving disputes, or compliance with law. Retention depends on the category and purpose; this policy does not promise immediate removal from every provider’s backup or operational log.

You can initiate account deletion in the app through Account → Delete account and decks. You may need to sign in again to confirm your identity. For assistance or requests concerning tournament records, support tickets, or other associated information, email cardboardcommander@deckboxarena.com. We may request proportionate information to verify that the request concerns your account.

Deleting a private deck does not automatically remove an earlier tournament submission, a printed or shared copy, or records held independently by an organizer. We will assess requests concerning retained personal information and remove or de-identify it where appropriate and required by law. When a legal or other applicable exception requires retention, we will explain the relevant limitation in our response.

Support rate-limit counters are eligible for cleanup after two days; cleanup occurs on later submissions. This does not delete support tickets or provider security logs. Backup copies and provider-managed records follow their applicable retention and deletion processes and should not be treated as immediately erased.

6. Security

We use authenticated account access, access restrictions, and encrypted network connections to help protect information. Private account data and support tickets are intended to be accessible only through authorized service functions and users. No system is completely secure. Protect your account credentials and contact us if you suspect unauthorized access. The Services are not represented as end-to-end encrypted.

7. Children and younger players

Rollout notice: Epic KWS parent verification is being integrated. The account protections described in this section are the launch policy and are not yet confirmed active in the released app. Verification alone does not activate a child account. Contact us before creating an account for a child under 13. We will update this notice when the complete process is operating.

Who needs parental permission. Children under 13 need permission from a parent or legal guardian before activating a child account. If local law requires parental permission at an older age, that requirement also applies. We use age and country information to determine the appropriate process. We do not ask a child to supply more information than reasonably necessary for an activity.

Before permission. We limit information collected before consent to what applicable law permits for age screening, contacting a parent to request consent, and essential security or operational purposes. A child cannot bypass this process by signing in through Google or Apple. Until approval is complete, we do not enable the child’s ordinary account, tournament entries, profile publication, or optional data collection requiring parental consent. Uncompleted requests are deleted according to the retention schedule below.

How the parent approves. We send the parent a notice explaining the child’s proposed account, information collected, purposes, recipients, parental rights, and how to approve or decline. The parent completes adult verification through Epic KWS and affirmatively confirms that they are the child’s parent or legal guardian and consent to the stated practices. A successful adult-verification result alone is not permission to activate a child’s account. An email link, typed signature, or entered date of birth alone does not replace this process.

KWS offers verification methods according to location and configuration. Depending on the available method, its providers may request identity, payment, or other verification information. The verification screen explains the method and links to the applicable privacy notice. Do not email identity documents or payment details to Deck Box support. KWS handles its own verification records under its privacy notice; deleting a Deck Box account does not automatically delete a separate KWS verification record. For KWS privacy information and assistance, visit https://support.kidswebservices.com/.

Information after approval. An approved child account may process account identifiers and sign-in information; player name, age or date of birth, country and game identifiers; decks and card selections; tournament entries and results; preferences and notification identifiers; and necessary support and security records. These categories serve the purposes described in sections 1–3. We do not sell children’s information or use it for targeted advertising. The Services do not offer direct messaging between players.

One-time tournament permission. Initial parental approval includes clearly disclosed, ongoing permission to enter tournaments and submit the information reasonably necessary to administer those entries. Deck Box does not require another parental approval for each event while this permission remains valid. Hosts and authorized event staff receive necessary player identifiers, eligibility information, deck submissions and results. This is permission for the described online data processing, not a waiver of an organizer’s separate attendance, age, travel, safety, or guardian requirements. Parents can withdraw this ongoing permission by contacting us.

Optional disclosure and features. Where a disclosure is not integral to the requested service, we obtain a separate parental choice before disclosing a child’s information. Account approval is not blanket permission to publish a child’s identity or leaderboard profile. Refusing an optional disclosure does not prevent use of unrelated free features. Precise-location features and other optional collection remain unavailable to a child unless covered by the required parental permission and applicable device permissions; an entered search location can be used instead. Pro purchases are optional and remain subject to Apple or Google payment and parental purchase controls. Verifying a parent does not authorize a subscription charge.

Parents’ ongoing rights. A parent may ask to review or receive the child’s information, correct it, withdraw permission, stop further collection or use, or delete the child’s account and associated information. Email cardboardcommander@deckboxarena.com with the subject Child privacy request and the account or request reference if available. Do not include an identity document or a password. We use proportionate checks to confirm the requester’s authority before disclosing or changing a child’s information.

Withdrawal stops the affected future activity. If information is necessary to provide the account or a particular feature, withdrawal may require closing that account or disabling the feature. We explain any legally required retention and assist with requests concerning organizer-held records; prior exports or independent organizer records are not automatically erased by an account deletion command.

Child-data retention at launch. Before enabling the child-account process, we will publish the specific retention and deletion periods for pending parent requests, child accounts, consent evidence, tournament records, support records and backups. Those periods are not yet finalized. Child information must not be retained indefinitely. Contact us now to request review or deletion of any child information already provided.

Changes or unapproved collection. If we learn that we collected a child’s information without required permission, we restrict affected processing and arrange deletion or a legally permitted consent process. Material changes outside the permission already given require a new notice and renewed consent where required. Turning 13 does not automatically authorize a new use or disclosure that still requires consent under applicable law.

8. International processing and privacy rights

Our providers may process information in the United States and other countries, whose privacy laws may differ from those where you live. Applicable legal requirements govern any required protections for these transfers.

Depending on your location and the law that applies, you may have rights to access, correct, delete, or obtain a copy of your information; object to or restrict certain processing; or withdraw consent where processing depends on it. You may also have the right to complain to your local privacy regulator. To make a request, contact cardboardcommander@deckboxarena.com. We will assess and respond within the period required by applicable law. Some information may be necessary to maintain an account or provide a requested feature.

Where applicable law requires a legal basis, we process information to provide requested services, comply with legal obligations, pursue legitimate interests such as security and support, or rely on consent for processing that requires it. Withdrawal of consent does not affect the lawfulness of earlier processing.

9. Changes and contact

We will update the effective date when this policy changes and provide additional notice of material changes where required. Questions, privacy requests, and concerns can be sent to cardboardcommander@deckboxarena.com or submitted through https://deckboxarena.com/support/. You may also call +1 (386) 405-7649 or write to Decked Out Development LLC, 8 Ridley Ln Unit A, Palm Coast, FL 32164, United States.