Privacy Policy

1. Who is responsible

Mulligan Deck Builder is a free, fan-made app. It is published by OgamLabs, the project of Óscar Cantón García, who is the controller of the data described here. For any privacy question, write to [email protected].

2. What data we handle

If you use the app without an account

Everything you create in Mulligan (decks, folders, favorites, collection and settings) is stored on your device. We do not send it to any server.

To show you cards and decks, the app connects to:

• MarvelCDB, to download the public card catalog, card images, card FAQs and the decklists you choose to import.
• Our server (mulligan-api.ogamlabs.com), to show you community decks.

As with any internet connection, these servers receive your device's IP address so they can answer. Our server only keeps it in memory, for one minute, to limit abuse. Its technical logs record only the type of request and its path, without your IP address, device identifiers or the filters you use.

If you create a community account

You only need an account to like decks. Browsing and importing decks never require one. You sign in with Sign in with Apple without sharing your name or email, and we keep:

• Your Apple user identifier. A code Apple assigns to your account for our apps only. It does not reveal who you are.
• Your likes: which decks you liked and when. Others only see each deck's total, never who gave it.
• Your session. We store a hash of the session code, not the code itself, along with its expiry date. On your device, the session is kept in the iOS Keychain and never leaves it.
• An Apple code used to revoke access. We keep it encrypted and only use it to tell Apple that your account was deleted.

Community decks

Community decks come from decklists published on MarvelCDB. We keep their composition (hero, aspects and cards), their publication date, the title and the public name its author published it under on MarvelCDB, its MarvelCDB like count and a link to the original. We do not keep descriptions, comments or tags. If you are an author and do not want your name or decks shown, write to us and we will remove them.

Reports and emails to support

If you report a deck or write to us, we receive your email address and what you write. A report also includes the deck’s number, title, author and link, and the app version. We use this only to answer you and review the content. The authors you hide and the decks you report are stored only on your device.

Firebase usage analytics

Analytics is enabled by default to understand sessions, retention, the categories of screens visited and the use of searches and filters, collection, deck creation, import, editing and export, and onboarding. We record action categories and outcomes, without selected values or content. Firebase receives a random installation identifier and technical metadata, such as the app version, operating system and language, and may derive approximate location from the connection. This data is pseudonymous; we do not claim it is anonymous.

We do not send Analytics your Apple identifier, credentials, deck names or contents, notes, search text or card identifiers. Advertising identifiers (IDFA) and vendor identifiers (IDFV) are not collected, and advertising features are disabled.

You can disable analytics in Settings → Privacy. Collection stops and the SDK’s local data is reset. Your choice is preserved when you reopen the app. Disabling does not itself delete events already received by Google; contact us about your privacy rights.

Firebase Crashlytics reports

While “Analytics and crash reports” is enabled, Crashlytics can send technical reports to identify and fix crashes: stack traces, app version, operating system, and technical device and installation data. We do not add account identifiers, deck contents, searches, notification tokens or credentials to reports. The usage categories described above may accompany the diagnosis.

Automatic uploading is disabled. Pending reports are sent when the app starts with the control enabled, or deleted when disabled. The SDK may store crash diagnostics locally until the next launch. Disabling does not revoke an upload already authorized or delete reports already received by Google.

Push notifications

If you enable notifications in Settings → Privacy and grant the iOS permission, Firebase Cloud Messaging and Apple APNs use an installation identifier, a delivery token and technical data to send you Mulligan notifications. This permission is independent of analytics and crash reports. We do not link those identifiers to your Community account or send them to its server.

You can change or revoke the permission in iOS notification settings. When you return to the app we check that permission and remove the delivery registration if revoked; if there is no connection, we retry removal when you reopen the app.

Reports from Apple

If you turn on sharing analytics with app developers in your iOS settings, Apple may send us anonymous crash reports. Apple handles this under its own privacy policy, independently of Firebase analytics.

3. Why, and on what legal basis

• To provide your account and likes, because you ask for them when you create it (performance of the terms of use you accept, Article 6(1)(b) GDPR).
• To keep the service secure and prevent abuse, with usage limits and minimal technical logs (legitimate interest, Article 6(1)(f) GDPR).
• To answer your emails and review reports (legitimate interest in helping you and keeping the community free of unacceptable content, Article 6(1)(f) GDPR).

Analytics is used to understand feature usage and improve Mulligan. You can disable it in Settings → Privacy and contact us to exercise your rights.

We do not use your data for advertising, build advertising profiles, track your activity across other apps or websites, or make automated decisions about you.

4. How long we keep it

• While you have an account. Each session expires after 365 days, and you will need to sign in again.
• When you delete your account from Settings → Community account → Delete account, we immediately delete your identifier, your sessions and your likes, and subtract your likes from the totals. We also ask Apple to revoke access. If Apple does not answer at that moment, we keep the revocation code encrypted only to retry it: we delete it as soon as the revocation completes or, at most, after ten attempts.
• Emails and reports: as long as needed to resolve them and one year at most.
• Backups. Server backups are renewed automatically, and deleted data disappears from them within five weeks at most.
• If you stop using Sign in with Apple from your Apple ID settings, we end your sessions. Your likes are kept until you sign in again and delete the account, or ask us by email to delete it. If you delete your Apple ID, Apple notifies us and we delete your account.

5. Who we share it with

We do not sell your data. These providers are involved for the purposes described:

• Google / Firebase Analytics, Crashlytics and Cloud Messaging, which receive analytics and crash reports according to your choice, and technical delivery data when you allow notifications. See Firebase’s privacy information and Google’s privacy policy.
• Apple, which runs Sign in with Apple under its own privacy policy.
• Hetzner Online GmbH, which hosts our server, its database and part of its backups in Germany.
• Cloudflare, Inc., which protects the server and delivers its responses. It also stores backups in data centers in the European Union. Its network is global: if it processes connection data outside the EU, it does so with the safeguards required by the GDPR, such as standard contractual clauses.
• MarvelCDB, an independent service the app connects to directly to load public cards and decks. It receives your IP address and applies its own policy.

6. Security

All connections use HTTPS. Session codes are stored as hashes, and Apple's revocation code is encrypted with AES-256-GCM. Access to the server is restricted and protected by a firewall.

7. Your rights

You can access, correct, delete or take away your data, restrict its processing or object to it. The fastest way to delete everything is to delete the account from the app. For anything else, write to [email protected] and we will answer within one month at most.

If you believe we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency at aepd.es, or with the data protection authority where you live.

8. Changes to this policy

If what we do with your data changes, we will update this page and its date. If the change is significant, we will also announce it in the app before it takes effect.