mtgsimon is a personal project. Keep a JSON backup of ratings you want to retain. Last updated: 4 November 2026.
Each grade you submit automatically contributes to aggregate community statistics. Without sign-in, your full ratings and notes stay in your browser. The server receives grades, set/card identifiers, submission times and a random browser identifier, stored as a hash. No private notes are sent in guest community submissions.
With Google sign-in, your ratings and notes are saved privately in the application database so you can access them from another browser. Only grades contribute to public statistics; notes and individual accounts are not published. Public averages appear from one submitted grade, including yours once accepted. Early averages may reflect very few ratings. Contributor totals are not displayed; percentage distributions are available. Hiding totals does not guarantee anonymity against outside knowledge; accounts and browsers are not verified unique people.
We use Google only to verify your identity and request only the OpenID identity scope. We retain Google's stable account identifier and an internal account ID, not your Google email, name, photo, access tokens or refresh tokens. New-account creation asks you to enter a private contact email and explicitly choose account with updates or account only. This entered email is encrypted separately using a purpose-specific account key and is accessible only to your authenticated account; it is not verified mailbox ownership, a login/recovery identity or a reason to merge accounts. Existing accounts can complete or edit their email without changing a separate subscription. Account deletion removes the private profile too. Login alone never subscribes or reverses an unsubscribe. We do not request access to Gmail, Drive, contacts or other Google content. The app uses its own secure session cookie, with only its token hash stored on the server.
First-party cookies support sessions, temporary sign-in state, anonymous contributions and minimal usage counts. Browser storage holds guest ratings, filters, last-viewed positions, card caches, queued grade-only contributions and recoverable private drafts isolated by set and account/browser identity. Account drafts can remain locally after logout for recovery when that same account signs in again; they are not shown to another account. Clearing site data removes local drafts. The guest invitation still uses 30 stored distinct set/card grades, including imported grades. Its browser dismissal persists locally. Aggregate measurement now also records invitation shown/dismissed/continued, without exporting your ratings to prove eligibility. We do not add advertising trackers or browser fingerprinting. Cloudflare hosts the application and receives ordinary hosting requests; card images are loaded from Scryfall. Google receives sign-in requests when you choose Google login. Those providers may maintain operational logs under their own policies.
The owner sees aggregate Usage, Growth and Health, never an individual activity-history or subscriber directory. We reuse the random first-party browser cookie and verified internal account identity; browser estimates are not verified people, and account and browser totals are never added together. We measure app views, explicit card-detail openings, prospective manual-rating milestones and return cohorts, account/onboarding outcomes, subscription state transitions and safe coarse save/authentication/subscription problems. A client-reported local save, confirmed account transaction and community acknowledgement are separate signals. Existing/imported/restored grades can contribute to observed coverage and invitation eligibility, not retroactive manual practice.
Analytics contains no emails, private notes, confidence text, grade values, OAuth tokens, full URLs, unrestricted error/request contents, referrers, traffic sources, campaign/search terms or email-open pixels. No external analytics service, fingerprinting or session recording is used. Minimal pseudonymous state includes prospective set/card membership for distinct-card counting, first/last manual-rating UTC day, milestone/return flags, coarse daily deduplication and short operation acknowledgements. Current subscription baseline/exclusion tags use only the existing opaque subscription ID, not the address; other-baseline and unclassified pre-v1 records are separated from public acquisition and active-audience headlines. Tags follow active subscription records and are removed on unsubscribe or bounded orphan maintenance. The existing private revision row also keeps only the latest committed intent/time to distinguish a lost acknowledgement from a new conflict; it is replaced on the next write or removed with account deletion, not exposed as an activity history. Hashed identifiers are still pseudonymous, not fully anonymous. Known verified-owner activity and its recognized browser are excluded prospectively where reliable; anonymous prior visits and every test cannot be identified.
Aggregate counters, date/month/year/lifetime cardinality sketches and metric-version definitions have no automatic expiry or twelve-month cutoff. Sketches retain aggregate register extrema, not visitor lists; range uniques are estimated by merging them rather than summing daily uniques. Browser progress expires after 90 inactive days; operation acknowledgements after seven days; daily deduplication expires after two days and recognized-owner browser exclusions after 90 days. Bounded cleanup runs during subsequent measurement requests or explicitly invoked maintenance; physical deletion can lag during inactivity. Account deletion removes linked account and current-browser measurement/dedup state; other unlinked browser aliases expire independently. Clearing cookies breaks a browser association rather than erasing prior aggregate statistics. Genuinely aggregate history cannot be separated back into one person's contribution and remains. Beta/test and future public baselines are separate; we do not invent missing historical funnels. Measurement delivery is best-effort and cannot block product actions.
Sessions expire after 30 days. Guest contributions expire after 90 days without another contribution and are excluded from results after expiry. Physical cleanup of expired records occurs during maintenance; it is not the same as instant erasure at expiry. Account ratings remain until you delete them.
Reset removes the selected set from active storage and its community contributions after successful server sync. Delete account removes that account's identity, sessions, private ratings and contributions across all sets. Separate guest copies, exported backups and hosting-provider backups are not deleted by that action. Offline guest deletion requests remain queued until they sync. Clearing a browser's cookies before deletion can lose its anonymous deletion credential.
Use Account → Your data to export your data, reset ratings or delete your account. For other privacy questions, use the application's support contact shown on Google's consent screen. Email signup is disabled unless a sender is configured. The new signup button requests occasional emails about new sets, newly available 17Lands comparisons and important app updates. It is separate from Google and your ratings. Clicking the clearly labelled button is single opt-in: no checkbox, verification email or welcome email is required. We record that consent version, method and server time, not a claim that the address owner was verified. Someone else could enter an address; unsubscribe links in every update stop future updates. There is one ongoing subscription list. Active existing subscribers are approved for migration into this combined scope under Simon’s authorization, recorded separately from original signup/import method and time. Scope migration is an explicit owner operation, separate from signup. Original provenance, capabilities and opt-outs are preserved; no fabricated new click or ownership verification. Duplicate addresses are merged and existing opt-outs are preserved. Email addresses and queued message content are encrypted with a dedicated secret; lookup hashes are keyed. A configured Resend sender receives the address and message for delivery. Link tokens use URL fragments rather than server request URLs. Unsubscribe pages require a deliberate button click instead of acting on email previews or scanner visits. Deletion links remove the request and queued content, not emails already in transit. Short-lived keyed anti-abuse counters may remain until maintenance cleanup. Account deletion does not cancel these separate subscriptions; use the unsubscribe link in any new update email. Old verification and cancellation routes are retired. The unsubscribe stops all future new-set, 17Lands and important app-update notifications for that subscription, whether imported or newly requested. Ongoing subscriptions remain until unsubscribed; one update does not end the subscription. Legacy beta rows are an inactive import source/archive, not a separate delivery system; after import, unsubscribing also removes matching beta archive rows. A keyed email-lookup hash and opt-out time remain to prevent an old import from subscribing you again; they do not contain a plaintext address. A later explicit opt-in request is distinguished from new acquisition, but a retained suppression continues to prevent delivery in the current system; analytics does not implement reactivation. A stale legacy opt-out does not delete a later explicit signup record. Recipient-linked event receipts are retained while subscribed to prevent duplicate announcements; unsubscribing deletes the ongoing request and its queued messages/receipts. Public event metadata without email addresses remains to prevent re-announcing the same event. Newly subscribing or re-subscribing does not replay past events. No cleanup scheduler is configured.
Back to the rater · Google privacy policy · Cloudflare privacy policy · Scryfall privacy