Privacy

When you sign in

You sign in with Google. The playmat asks Google only for your email address (the openid andemail permissions) and keeps three things:

• your Google account ID, a number Google uses to tell accounts apart;
• your email address;
• whether Google has verified that email address.

It never asks for or keeps your name, photo or password. Google hands the playmat a token when you sign in, which it uses once to confirm who you are and then throws away.

Your sign-ins are kept encrypted, in the playmat's memory only. Two cookies keep you signed in, both hidden from scripts:

• tcgreplay_session, which keeps the board signed in;
• tcgreplay_login_…, which exists only while a Google sign-in is in progress.

The board also remembers four display settings in your browser (replay speed, autoplay, where the panel sits and prize reminders). They never leave your browser.

While you play

The playmat keeps your current game: the battle log and decklists you import, the moves on the board, its branches, the assistant's coaching notes and the opponent's likely list. Each Google account has its own game, and only that account can open its board.

All of it is held in memory only. It is never written to disk or to any storage service, and it is gone when the playmat restarts.

How long it is kept

• Your game is dropped after 60 minutes without activity, when your last sign-in ends, and whenever the playmat is updated or restarted. To keep a game, ask your assistant for its record and save it yourself.
• Your account details (ID, email, verified flag) are kept with your sign-ins and dropped when your last one ends: when you sign out and disconnect your assistant, or when they run out (below).
• Board sign-in lasts up to 30 days. Your assistant's connection lasts up to 30 days and is renewed while you use it; each access it is given lasts one hour. A Google sign-in in progress lasts up to 10 minutes.
• Logs. The playmat writes your email address to its logs when you sign in or out, when a limit stops a request, and when your game expires or is removed. Logs never contain IP addresses, battle logs or decks. The hosting providers, DigitalOcean and Cloudflare, may keep their own request logs.

Outside services

• Google, for signing in.
• TCGdex and malie.io, the sources of the card data, which the project builds and publishes ahead of time; the playmat reads only that published copy, so nothing about you is sent to them.
• Card images are loaded by your browser, from the playmat's own image store, TCGdex or malie.io.
• DigitalOcean hosts the playmat, and Cloudflare delivers its traffic.
• Your AI assistant (Claude, ChatGPT or another) sees what you share with it and what the playmat tells it, under that assistant's own privacy terms.

What it never collects

• Your password, name or photo.
• Your Google access tokens, after the moment of sign-in.
• Analytics, tracking or advertising data of any kind.
• Anything to sell or share: the playmat sells or shares nothing.

Removing your data

Sign out from the board's menu, and disconnect tcgreplay in your assistant's connector settings. There is no stored account to delete: once your sign-ins end, the playmat forgets you.

Questions

Open an issue on the project's GitHub page.