Privacy Policy

This policy explains what Rhystic Tavern collects, why we collect it, who can see it, and the choices you have. It covers the Rhystic Tavern app for iPhone and the website at rhystictavern.com. In this policy, "we", "us" and "our" mean Rhystic Tavern, [ADDRESS] [CONFIRM]. "You" means the person using Rhystic Tavern. Please also read our Terms of Service.

1. Your account

When you create an account, we collect:

Email address. You sign in with it. We send codes to it to verify your account, reset your password, or change your email. Codes expire after 15 minutes.

Password. We store a one-way scrambled version (a hash), not the password itself.

Username and profile. Your username, the short bio on your profile, the avatar and banner you pick from the app's built-in images, and whether your profile is public or private.

Two-factor sign-in. If you turn it on, we store your authenticator secret in encrypted form and your recovery codes.

Sign in with Apple. If you use Sign in with Apple, Apple gives us a user ID and an email address. If you choose to hide your email, Apple gives us a relay address instead. If the email Apple confirms matches an account you already have, we link the two. Your password still works after linking.

2. What you add to the app

Your Vault, decks, brews and collections. The cards you own and the details you add to each copy, such as condition, foil, location, source, acquired date, price paid and notes. Your decks, brews and collections, and the history of how a deck changed.

Imports and exports. When you import a CSV file or text list, we read it to match each line to a card. [CONFIRM: whether the file itself is kept after import]

Games and game history. Games you play or log: who played, seats, results, life and counter changes, commander damage and the game log. When you move a game to another phone, we create a one-time code that works for 10 minutes.

Playgroups. The playgroups you create or join, members, standings, seasons, game nights, RSVPs, and results you log, confirm or dispute.

Social features. Who you follow, follow requests, friends, and people you block. Likes, comments, card suggestions and notes on decks and brews. Things you share to a playgroup.

Messages. Messages you send in playgroup chat and direct messages to friends, including cards, decks, brews or profiles you share in them, and people you @mention.

Reports. When you report a profile, deck, brew, comment or message, we store what you reported, the reason, and any details you write (up to 500 characters).

Support email. If you write to us, we keep your email and our reply so we can help you.

3. What we collect automatically

Signed-in devices. For each device you sign in on, we store the device name, the IP address, and when you signed in. You can see these devices in Account Security and sign them out. A sign-in lasts up to 60 days unless you sign out sooner.

Activity and status. The last time you opened the app or were online, and whether you are online or in a game. You can choose Online, Do Not Disturb or Invisible in Settings, then Privacy, then Your status. When you are Invisible, others see you as offline.

Views. We count views on public decks and brews. [CONFIRM: whether we store who viewed]

Website cookies. The website uses cookies to keep you signed in and to finish Sign in with Apple. [CONFIRM: whether ads appear on the website, and whether the ad provider sets cookies there]

Server logs. Our servers keep technical logs, such as errors and requests. [CONFIRM: what the logs contain and how long they are kept]

4. Camera and the card scanner

The app asks for your camera only to scan cards and QR codes. You can turn camera access off at any time in your iPhone Settings. When you scan a card, your iPhone reads the card's name and printing details on the device. The app then sends the matched card to our servers to add it to your Vault, a deck, a brew or a collection. Camera images are not sent to us. The QR scanner reads join codes for game rooms and game transfers.

5. Push notifications and email

[CONFIRM: push notifications ship at launch]

If you allow notifications, your iPhone gives the app a device token. We store that token, whether it is a test or live build, and your phone's time zone (so reminders show the right time). We keep up to 10 devices per account and remove tokens that stop working. Signing out removes that phone. We use push notifications for things like friend and follow requests, playgroup invites, game nights and reminders, results to confirm, comments, @mentions and direct messages. You can turn each kind on or off in the app, and Do Not Disturb mutes them. You can also turn notifications off in your iPhone Settings. We do not send you notifications from people you have blocked. We send account emails (codes, and notices if we rename a username or suspend an account) through an email delivery service.

6. Card data, prices and store links

Card data, prices and rulings come from Scryfall. Our servers download this data from Scryfall. We do not send your account information to Scryfall. [CONFIRM: card images load directly from Scryfall's servers, so Scryfall can see your device's IP address when an image loads]

Prices are estimates. When you tap a store link, you leave Rhystic Tavern and that store's own privacy policy applies.

7. Mythic subscriptions and payments

Mythic is billed by Apple through your Apple ID. We never see your payment card. We use RevenueCat, a subscription service, to manage Mythic. RevenueCat receives your purchase and subscription status from Apple so we can tell whether Mythic is active. We store your Mythic status and end date so the app knows what to unlock. If your Mythic subscription ends, items over the free limits stay read-only for 90 days so you have time to export them.

8. Aether

Aether is the AI feature in Mythic. When you ask Aether for help, we send a summary of the deck, brew or Vault to an outside AI service [CONFIRM: name of the service]. The summary includes deck stats, card names and short tags for what each card does. [CONFIRM: no email address, username or messages are sent]

Pod insights use only the games your playgroup already logs. Private decks are left out, and only members of that playgroup see the results. We save Aether results on our servers with your account and the deck version, so you can open them again. We also count the sparks you use each month.

[CONFIRM: how long the AI service keeps what we send, and whether it uses it to train its models]

[CONFIRM: how long we keep saved Aether results]

9. Analytics and ads

Analytics. We use first-party analytics only. That means we measure how people use our own app ourselves, with our own tools, instead of using an outside analytics company. For example, we record when you last opened the app so we can count how many people use it. [CONFIRM: the exact list of events we record]

Ads. The app shows ads to free accounts. Mythic removes them. Ads come from an outside ad provider [CONFIRM: name of the ad provider]. The ad provider receives some information to show ads [CONFIRM: what data the ad provider receives, such as device identifiers, IP address or general location].

Personalized ads: [CONFIRM: whether ads are personalized based on your activity]

Tracking permission: [CONFIRM: whether the app asks your permission to track you across other companies' apps and websites (Apple's App Tracking Transparency prompt). If you say no, the app does not track you that way.]

Age: Rhystic Tavern is for people 16 and older, and ads are shown to free accounts only. [CONFIRM: any ads settings tied to age]

10. Mailing list

If you join our mailing list on the website, your email goes to our mailing list service. We use it for big updates and to ask for feedback. Every email has an unsubscribe link.

11. How we use your information

We use your information to:

Run your account and keep you signed in on iPhone and the web.

Save your Vault, decks, brews, collections and games, and show them on your devices.

Show your profile, public decks and public brews to others, based on your settings.

Deliver messages, comments, notifications and game invites.

Run Mythic and Aether.

Keep the community safe: check names, bios, comments and messages for banned words when they are saved, review reports, and act on accounts that break the rules.

Protect accounts, limit abuse, and fix bugs.

[CONFIRM: We do not sell your personal information.]

12. Who can see your information

Everyone. Your username, avatar and banner. Anyone can find you by username.

Public profile. Your bio, public decks and public brews. If your profile is private, people need your approval to follow you and see your full profile.

Private by default. Your Vault and collections are always private. Decks stay private until you share them. You choose who can see each brew.

Playgroup members. Your playgroup's chat, standings, games and game nights. Members of your playgroups can see if you are online or in a game, unless you choose Invisible. [CONFIRM: whether friends see your status too]

Direct messages. You and the friend you are talking to. If either of you blocks the other, the conversation is hidden. When you remove a message, others see that it was removed.

Our team. Messages are stored on our servers. Our team does not read messages as a routine. We look only at content someone reports to us. [CONFIRM: whether a report shows us the text of the reported message]

Service providers. Companies that host our servers and database, send email, run our mailing list, take payments (Apple), manage subscriptions (RevenueCat, which receives your purchase and subscription status), run Aether, and show ads to free accounts [CONFIRM: ad provider]. They use your information only to provide their service to us. [CONFIRM: list provider names]

The law. We may share information if the law requires it, or to protect people from harm.

13. How long we keep it

We keep your account information while your account is open.

When you delete your account, you have 30 days to restore it. [CONFIRM: after 30 days we erase your account and the data tied to it, and list anything we keep and why]

Removed messages and comments. [CONFIRM: how long removed text is kept]

Reports and moderation records. [CONFIRM: how long they are kept]

Game history. Free accounts see the last 90 days. Mythic shows the last year. [CONFIRM: whether older games are kept or deleted]

Backups. [CONFIRM: how long backups keep deleted data]

14. Delete your account

Open Account Security.

Choose Delete account and enter your password.

To change your mind, sign in within 30 days and choose Restore account.

[CONFIRM: how accounts that use only Sign in with Apple delete their account]

You can also write to warden@support.rhystictavern.com and ask us to delete your account.

15. Your choices and rights

Edit your profile, make it private, or block people.

Choose which notifications you get, or turn them off.

Set your status to Invisible.

Turn off camera or notification access in your iPhone Settings.

Export your cards.

Unsubscribe from the mailing list.

Delete your account. You can ask us for a copy of your information, or ask us to correct or delete it. Write to warden@support.rhystictavern.com. [CONFIRM: response time, and any extra rights for people in certain states or countries]

16. Children

Rhystic Tavern is not for children under 16. We do not knowingly collect information from children under that age. Ads are shown to free accounts only. [CONFIRM: any ads settings tied to age] If you think a child has given us information, write to warden@support.rhystictavern.com and we will delete it.

17. Security

We store passwords as hashes, store sign-in tokens in hashed form, encrypt two-factor secrets, and limit repeated sign-in attempts. [CONFIRM: data is encrypted in transit, and where it is stored] No system is perfectly secure, so we cannot promise your information will never be accessed without permission.

18. Changes to this policy

If we change this policy, we will update the effective date and version at the top. If a change is important, we will tell you in the app or by email before it takes effect. [CONFIRM: notice method]

19. Contact

Questions about this policy or your information: warden@support.rhystictavern.com

Rhystic Tavern

[ADDRESS] [CONFIRM]

Wizards of the Coast, Magic: The Gathering, and their logos are trademarks of Wizards of the Coast LLC in the United States and other countries. © 1993–2026 Wizards. All Rights Reserved. Rhystic Tavern is unofficial Fan Content permitted under the Fan Content Policy. Not approved/endorsed by Wizards. Portions of the materials used are property of Wizards of the Coast. ©Wizards of the Coast LLC. MAGIC: THE GATHERING® is a trademark of Wizards of the Coast. For more information: https://company.wizards.com/

Some card prices and other card data are provided by Scryfall. Scryfall makes no guarantee about its price information and recommends you see stores for final prices and details. Rhystic Tavern is not affiliated with or endorsed by Scryfall.