Privacy Policy.

Disclaimer — Unofficial Third-Party Tool

VaultMTG is an independent, unofficial companion tool for Magic: The Gathering Arena (MTGA). VaultMTG is NOT affiliated with, endorsed by, or sponsored by Wizards of the Coast LLC or Hasbro, Inc. “Magic: The Gathering,” “Magic: The Gathering Arena,” and all associated card names, game mechanics, set names, and artwork are the intellectual property of Wizards of the Coast LLC.

VaultMTG reads MTGA game log files stored on your local device to provide analytics. The VaultMTG desktop application does not modify the MTGA game client, inject code, or interact with MTGA’s network traffic.

1. Introduction

VaultMTG (“we,” “us,” “our,” or “Company”) is a service operated by Ray Hamilton Engineering, LLC, a Georgia limited liability company. We operate the VaultMTG platform: a desktop companion application, a web-based analytics application, and a marketing website for Magic: The Gathering Arena (MTGA) players.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use:

• The VaultMTG web application at app.vaultmtg.app
• The VaultMTG marketing/waitlist site at vaultmtg.app
• The VaultMTG desktop application (available for macOS and Windows)
• All related services (collectively, the “Service”)

Closed Beta Notice. The Service is currently in closed beta and is available by invitation only to a limited group of testers, including testers located in the European Economic Area and the United Kingdom. The data-subject rights described in Section 9 apply to all beta users in those regions from the start of the beta.

Please read this Privacy Policy carefully. If you do not agree with our practices, do not use the Service.

2. Information We Collect

2.1 Account and Authentication Data (Clerk)

When you sign up or sign in, we collect:

• Email address — used as your primary account identifier.
• Name (optional) — if provided during sign-up.
• Authentication method — email/password, Google, Apple, or Facebook (via Clerk OAuth flows).
• Opaque Clerk user ID — a non-reversible identifier assigned by our authentication provider; used internally as account_id; never stored in plain form in analytics systems (see Section 2.5).
• Session tokens and login event timestamps — managed by Clerk; stored in Clerk’s infrastructure.

This data is collected via Clerk Identity Platform. We do not roll custom JWT logic.

2.2 MTGA Gameplay Data (Desktop Application — User’s Own Data)

The VaultMTG desktop application reads MTGA log files stored on your local device. These are the same log files that MTGA writes as you play — we do not access any files outside your MTGA installation directory, and we do not modify any game files.

The application parses and transmits the following to our servers:

Match data:

• Match results (win/loss/draw) per game and per match
• Deck composition used in each match (card IDs and quantities)
• Game decisions and play-by-play at a structural level (card plays, turns, actions — as recorded in MTGA’s GRE message log)
• Opponent deck archetype information (as visible in your own MTGA log)
• Event/format information (e.g., Standard, Draft, Premier Draft)

Draft data:

• Draft event ID and event name
• Cards offered in each draft pack (as logged by MTGA)
• Cards you selected (picks)
• Deck built from the draft

Collection and inventory data:

• Your MTGA card collection (card IDs and quantities, derived from GetPlayerCardsResp log events)
• Wildcard counts (Common, Uncommon, Rare, Mythic)
• Gold and gem balances
• Booster pack inventory
• Player rank (Constructed and Limited: class, level, percentile)
• Player screen name and MTGA client ID (as recorded in the log)
• Daily and weekly win progress

This log data belongs to you and reflects your own MTGA gameplay. We transmit it from your device to our servers for storage and to power the Service’s analytics, recommendations, and history features. We do not sell this data. We do not share it with any party other than the sub-processors listed in Section 5.

Device and application metadata:

• Device identifier (UUID): a stable per-installation identifier derived from device characteristics. Used to associate events across sessions and to support multi-device pairing. The device ID is not a hardware serial number.
• Operating system type (macOS/Windows) and version
• Application version (semver)
• Pairing event timestamp and status (whether your installation successfully connected to your account)

2.3 Waitlist Signup (Marketing Site)

If you submit your email address on the vaultmtg.app waitlist form, we collect:

• Email address — stored in our database and added to our Mailchimp mailing-list audience.
• UTM attribution fields — utm_source, utm_medium, utm_campaign (where present in the URL) to understand which marketing channels drove your signup.
• Referrer URL (where present).

This data is collected via a public POST /api/v1/waitlist endpoint (no authentication required). The email is used only to notify you about VaultMTG availability and updates. We will not send marketing or promotional emails unrelated to VaultMTG without your explicit opt-in.

2.4 Error and Observability Data (Sentry)

The BFF server and the React web application send error and exception data to Sentry, including:

• Error messages and stack traces
• Request URL paths (no query strings or request bodies are included in Sentry payloads)
• Browser/OS/runtime metadata
• Application release version

Sentry events are used solely for diagnosing and resolving bugs. We do not intentionally include personally identifiable information in Sentry payloads, but stack traces may incidentally include data visible at the error boundary. Sentry data is retained for 30 days by default.

2.5 Product Analytics (PostHog)

We use PostHog for product telemetry on both the desktop SPA (app.vaultmtg.app) and the marketing site (vaultmtg.app).

PII protections in place:

• The BFF uses SHA-256 (hex, first 16 characters) to hash the Clerk account_id before sending it as a PostHog distinct_id. Raw Clerk user IDs are never sent to PostHog.
• When the SPA identifies a user in PostHog, the email address is SHA-256 hashed (hex, first 16 characters) before being stored as the hashed_email person property. The raw email address is never sent to PostHog.
• PostHog autocapture is disabled. We fire only typed, named events from our taxonomy.
• Session recording is disabled by default. It may be enabled in a future release only after explicit user opt-in with appropriate disclosure.

Events collected on the SPA (app.vaultmtg.app):

Events collected on the marketing site (vaultmtg.app):

Server-side events emitted by the BFF:

2.6 Marketing Site Analytics (Google Analytics 4)

The VaultMTG marketing site (vaultmtg.app) includes Google Analytics 4 (GA4, measurement ID G-Y4YSVZF8ZD). GA4 collects:

• Page views and session data
• Traffic source and attribution (UTM parameters, referrer)
• Approximate geographic location (country/region, derived from IP; IP itself is not retained by GA4 under default settings)
• Device and browser metadata

GA4 data is processed by Google LLC under its standard terms. For users in the European Economic Area, United Kingdom, and Switzerland, GA4 is loaded only after consent via our cookie-consent banner (see Section 6.6). You can also opt out via the Google Analytics opt-out browser add-on.

2.7 Customer Support

We do not run a third-party support chat widget on the marketing site. To request support, contact us at the address in Section 10.

3. How We Use Your Information

3.1 Core Service Delivery

• Authenticate users and maintain secure sessions (Clerk)
• Receive, parse, and store MTGA match, draft, collection, and inventory data transmitted by the desktop application
• Display match history, analytics, deck statistics, collection, and personalized recommendations
• Maintain your deck lists and user preferences

3.2 Service Improvement and Machine-Learning Models

• Understand feature adoption and user engagement (PostHog)
• Identify and resolve bugs and stability issues (Sentry)
• Measure activation and retention metrics
• Train and improve machine-learning recommendation models (draft advisor, wildcard crafting suggestions, archetype insights) from de-identified gameplay events.

How ML training data is de-identified. At the moment your data enters the ML training store, all identifiers that link a record back to you are stripped at the boundary: your Clerk user ID, our internal account identifier, your email, your device identifier, your IP address, and fine-grained timestamps are not written to the ML training store. The resulting records — match outcomes, per-turn action sequences, draft picks and pick numbers, and life-total arcs — are held in a dedicated store with no account linkage and no per-row identifier whose preimage we retain. We do not keep a mapping or hash that could re-link these records to you. On this basis we treat the ML training data as anonymous information (it is not personal data within the meaning of GDPR Art. 4(1) / Recital 26 or analogous UK GDPR provisions, because we do not retain the means to re-identify it). See Section 4 for what this means for retention, and Section 6.3 for what this means when you delete your account.

3.3 Marketing and Waitlist Communications

• Notify waitlist registrants about VaultMTG availability, beta access, and relevant updates (Mailchimp)
• We do not send unsolicited promotional emails. Marketing communications beyond waitlist status updates require explicit opt-in.

3.4 Security and Legal

• Detect and prevent fraud, abuse, and unauthorized access
• Enforce the Terms of Service
• Comply with applicable laws and regulations

3.5 Legal Bases for Processing (GDPR / UK GDPR)

Where GDPR or UK GDPR applies, we rely on the following legal bases:

Legitimate Interests Assessments (LIAs) supporting the (f) bases above are maintained internally by VaultMTG and are available to supervisory authorities on request.

4. Data Retention

5. Data Sharing and Third-Party Sub-Processors

We do not sell, rent, or lease your personal information to third parties.

We share data with the following sub-processors to operate the Service:

We maintain Data Processing Agreements (DPAs) with each of the sub-processors above where required by GDPR Art. 28 or analogous UK GDPR provisions. Where data is transferred from the EEA/UK/Switzerland to the United States, transfers are made under the EU-US Data Privacy Framework (where the sub-processor is certified) or under Standard Contractual Clauses.

5.1 Legal Disclosure

We may disclose your information if required by law, court order, or government request (subpoena, regulatory investigation). Where legally permitted, we will notify you of such requests.

5.2 Business Transitions

If VaultMTG (or Ray Hamilton Engineering, LLC) is acquired, merged, or undergoes a bankruptcy proceeding, your data may be transferred as part of that transaction. Affected users will be notified of any material change to this Policy.

6. Your Rights and Choices

6.1 Access and Portability

You may request a copy of the personal data we hold about you by contacting us at the email in Section 10. We will provide the data in a portable, structured, machine-readable format within 30 days.

6.2 Correction

You may update your account name and email preferences at any time in the application Settings page. Email changes go through Clerk’s account-update flow. You may also request correction of any inaccurate personal data by contacting us.

6.3 Deletion (Right to Erasure)

You may request deletion of your account and associated personal data by contacting us, or by using the in-app account-deletion control where available. We will delete your account and personal data within 30 days of a verified request, except where we are legally required to retain specific records (for example, narrow tax, fraud-prevention, or regulatory records).

What is and is not deleted on account deletion. When you delete your account, we delete: your account profile (email, name, Clerk identifiers), your match history and aggregated statistics tied to your account, your collection and inventory snapshots, your deck lists, your device pairing records, and your waitlist record (if any). We also delete or sever the hashed identifiers used in our analytics systems (PostHog, Sentry) so that prospective analytics events cannot be attributed to your former account.

ML training data is not deleted on account deletion. As described in Section 3.2, gameplay events used for ML training are stripped of all identifiers that link a record to you (Clerk user ID, account identifier, email, device identifier, IP, fine-grained timestamps) at the boundary of the ML training store, and we do not retain a mapping or hash that could re-link those records to you. On that basis those records are anonymous information and are not personal data within the meaning of GDPR Art. 4(1) / Recital 26. They survive account deletion. If you have a specific concern about this, contact us at the email in Section 10 and we will discuss it directly.

6.4 Restriction and Objection

Where GDPR or UK GDPR applies, you may request that we restrict processing of your personal data, or object to processing that relies on legitimate interests (including product analytics). Contact us at the email in Section 10.

6.5 Opt-Out of Analytics

• You can disable PostHog analytics in the application via the analytics opt-out toggle in your account Settings (when available; until then you may contact us to request opt-out).
• You can opt out of Google Analytics on vaultmtg.app via the cookie-consent banner (EEA/UK/Swiss visitors — see Section 6.6) or via the Google Analytics opt-out browser add-on.

6.6 Cookies and Consent

The vaultmtg.appmarketing site uses a cookie-consent banner for visitors located in the European Economic Area, United Kingdom, and Switzerland. Non-strictly-necessary cookies and tags (including GA4) are loaded only after you provide consent. You may change your consent at any time via the “Cookie Preferences” control in the site footer.

The app.vaultmtg.app application uses only strictly-necessary cookies (session and authentication state). Product analytics (PostHog) in the authenticated application is governed by the analytics opt-out in Section 6.5.

6.7 Waitlist Unsubscribe

You may unsubscribe from waitlist communications at any time by clicking the unsubscribe link in any email we send, or by contacting us directly.

6.8 Right to Lodge a Complaint (GDPR / UK GDPR)

If you are in the EEA, UK, or Switzerland and believe our processing of your personal data infringes applicable data-protection law, you have the right to lodge a complaint with your national data-protection supervisory authority. For UK users, this is the Information Commissioner’s Office (ico.org.uk). For EEA users, it is the supervisory authority in your country of residence.

7. Security Measures

We implement the following technical and organizational measures to protect your information:

• Encryption in transit. All communication between your device and our servers uses TLS. The BFF API endpoint is HTTPS-only.
• Encryption at rest. Sensitive configuration values (API keys, database credentials, secrets) are stored in AWS Systems Manager Parameter Store (SSM) using KMS-encrypted SecureString parameters. They are never stored in environment variables in source code or source control.
• Authentication gating. All routes serving user-specific data on the BFF are protected by ClerkAuthMiddleware (Clerk JWT verification). No user data routes are publicly accessible.
• Least-privilege database access. The BFF connects to PostgreSQL using a dedicated application role with SELECT/INSERT/UPDATE/DELETE scoped only to the tables it requires. It does not run with superuser or DDL privileges in production.
• PII minimization in analytics. Clerk user IDs and email addresses are SHA-256 hashed before being sent to PostHog. Raw PII is never included in PostHog events.
• No raw log storage. The desktop application processes MTGA log files locally on your device and transmits only structured, parsed events. Raw log content is not uploaded or stored.
• Access control. Production infrastructure access is restricted to authorized personnel only. Database access from the internet is not permitted; the RDS instance is not publicly accessible.

Limitation. No method of transmission over the internet or method of electronic storage is 100% secure. While we apply industry-standard measures, we cannot guarantee absolute security.

8. Children’s Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from anyone under 13. If you believe we have inadvertently collected data from a child under 13, please contact us and we will delete it promptly.

Users must represent that they are at least 13 years old to register for an account. The signup flow includes an age representation as part of accepting the Terms of Service.

Wizards of the Coast independently requires MTGA users to be 13+. Your use of MTGA is governed by your own agreement with Wizards of the Coast; that obligation is separate from your relationship with us.

9. International Users — GDPR and UK GDPR

The closed beta cohort includes users located in the European Economic Area, United Kingdom, and Switzerland. If you are in one of those regions, the following apply to you in addition to the rights described in Section 6:

• Data controller. Ray Hamilton Engineering, LLC (Georgia, USA) is the data controller for personal data processed through the Service.
• Legal bases. Section 3.5 sets out the legal basis for each category of processing.
• Your rights. Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection (Art. 21). See Section 6 for how to exercise them. We respond within 30 days of a verified request.
• International transfers. Personal data is processed in the United States (see Section 5). Transfers from the EEA/UK/Switzerland are made under the EU-US Data Privacy Framework (where the sub-processor is certified) or under Standard Contractual Clauses.
• No automated decision-making with legal effect. We do not use your personal data to make decisions about you that produce legal or similarly significant effects within the meaning of GDPR Art. 22. The ML-driven recommendations the Service provides (draft picks, wildcard crafting suggestions) are advisory and have no legal effect.
• Complaints. See Section 6.8.

We do not have an EU representative under GDPR Art. 27 at this stage of the closed beta; this position will be reassessed before general availability based on the volume and nature of EU-resident processing.

10. Contact

For questions about this Privacy Policy, to submit a data access/deletion/portability/ restriction/objection request, or to report a privacy concern:

Email: privacy@vaultmtg.app

For general support: support@vaultmtg.app. For legal notices: legal@vaultmtg.app.

Postal address:

Ray Hamilton Engineering, LLC
6260 Whitetail CT NW
Acworth, GA 30101

We respond to privacy inquiries within 10 business days of receipt and complete verified data-subject-rights requests within 30 days.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Updating the “Last Updated” date below
• Posting a notice on the Service
• Sending an email notification for significant changes affecting your rights

Your continued use of the Service after any modification constitutes your acceptance of the updated Policy.