Privacy Policy

Last updated: 2026-08-26

TK-Hub is a non-commercial fan project. We collect as little personal data as possible: there are no analytics or advertising services, no tracking cookies, and a user account does not even require an email address. This policy describes which data is processed when you use TK-Hub, on which legal basis, and which rights you have (Art. 13 GDPR).

1. Controller

The controller responsible for data processing on this website is:

Tristan Külpmann
Bessemerweg 20
22761 Hamburg
Deutschland

For any privacy questions or to exercise your rights, you can reach us by email: mythodea-kartenspiel@gmx.de

2. Hosting & Server Log Files

When you visit the website, our server automatically processes technically necessary connection data: IP address, date and time of access, requested page, transferred data volume, browser type and operating system. This data is stored in server log files, used solely to keep the site running, analyze errors and fend off attacks, and is not combined with other data sources. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Log files are deleted on a regular schedule.

3. Cookies & Local Storage

TK-Hub only sets technically necessary cookies (§ 25(2) no. 2 of the German TDDDG), which is why there is no cookie banner: a session cookie (valid for up to 7 days) that carries your login, cross-site request forgery protection and settings such as your language and game selection; only if you tick "Keep me signed in" at login, a login cookie with a lifetime of 30 days; and a cookie that records your decision about loading Scryfall images (see section 6).

Some features store data directly in your browser (localStorage), for example the anonymous access token of the game tracker or layout settings of the deck editor. This data never leaves your browser, serves only the feature you are using and can be deleted at any time via your browser settings.

No analytics, statistics or advertising services are used. Your usage behavior is not tracked.

4. User Account

A user account only requires a freely chosen username and a password — no email address and no real name. The password is stored exclusively as a cryptographic hash. In addition, we store account-related settings (language, active games) and the content you create (e.g. decks). The legal basis is the performance of the usage agreement (Art. 6(1)(b) GDPR). You can request the deletion of your account at any time by contacting us.

5. Card Submissions, Uploads & Bug Reports

When you submit a card, we store the email address you provide together with the submission. It is used exclusively to associate the submission with you (e.g. to recover your edit link) and to contact you about your submission, as described in the Terms of Service (sections 4 and 9). The legal basis is Art. 6(1)(b) GDPR. You can request the deletion of your submission and its data at any time.

Uploaded images (card images, reference images, artworks) are stored on our server. Reference images are shown publicly in the artwork gallery once your submission is approved; artwork uploads are deliberately possible without providing any contact data. Uploads that are no longer referenced are deleted automatically.

Bug reports submitted via the bug report form store the details you enter and, if you are logged in, a link to your account (Art. 6(1)(f) GDPR — our legitimate interest in fixing errors).

6. External Content: Scryfall

Card images for Magic: The Gathering come from the external service Scryfall (Scryfall LLC, USA). These images are only loaded after you have agreed to it once: on your first contact with card images, the site asks you whether images may be loaded from Scryfall. Only with your consent does your browser connect to Scryfall, transferring your IP address to Scryfall — including to the USA, where there is no level of data protection equivalent to the EU. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). If you decline, you see all card information as text with a link to the card instead of the images. Your decision is stored in your browser and can be changed at any time in the settings menu (cog icon).

When you actively use features that fetch Scryfall data (e.g. the card search during deck import), your browser connects to api.scryfall.com at your request; this also transfers your IP address to Scryfall. The legal basis is the provision of the feature you explicitly requested (Art. 6(1)(b) GDPR, § 25(2) no. 2 TDDDG).

You can find more information in Scryfall's privacy policy: scryfall.com/docs/privacy

7. Data Sharing

We do not pass your personal data on to third parties and we do not sell it. Processing takes place on our own server; our hosting provider processes data exclusively on our behalf. The only transfer to an external service is the Scryfall connection described in section 6, which you control.

8. Retention

We store personal data only for as long as necessary for the respective purpose: account data until you delete your account, submission data until the submission is deleted, log files until their scheduled deletion. After a deletion request, data is kept only as long as technically necessary.

9. Your Rights

You have the right to access the data we store about you (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). Simply contact us at the email address given above.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (datenschutz-hamburg.de).

10. Changes to this Policy

We update this privacy policy when the website or the legal situation changes. The version published here applies.