Privacy policy

Information we collect

We store your email address, player handle, account identifiers and sign-in records. If you use a password, we store a password hash, not the readable password. Sign-in sessions can include your IP address, browser information and activity timestamps.

We also store decks and their saved versions, collection quantities and allocations, printing holdings, named storage locations and placements, saved collection views, card notes, game settings, deck snapshots and game history. If you use community features, we store your profile bio, shared deck snapshots, saved favorites, follows, comments and reports. Service logs can contain request details, IP addresses and diagnostic information used to operate and protect the app.

Private play stores friend requests and accepted friendships, blocks, group and room membership, invitations, readiness, room messages and private reports. Invitations require the named recipient or group owner approval. Room chat is visible only to current room members, beginning when they joined. Other participants cannot download your private deck list, bookmarks or seat-specific game history. Your game record can include public events and cards you were allowed to see.

Google sign-in

Google sign-in requests only basic identity, email and profile permissions. Google provides an account identifier, verified email address and basic profile information such as your name and profile picture. We use this information to authenticate you and connect your Google account to BrewNight.

Your chosen handle is your player identity. Your Google name and photo are not used as your public player profile; the commander of your selected deck supplies your in-game portrait. Authentication tokens are stored encrypted and can contain Google profile information.

We do not request access to Gmail, Drive, Calendar or contacts. Google account data is not used for advertising, sold, or used to train AI models. You can remove BrewNight’s Google access in your Google Account connections. Removing access does not delete your BrewNight account or saved decks.

Mobile sign-in and card scanning

The iOS app stores its sign-in session in the device Keychain and uses it to reach the same BrewNight account service. Hosted signup and account settings open in the system browser. Returning to the app uses a short-lived, single-use code tied to that sign-in attempt; it does not put a reusable session token in the return link.

When Sign in with Apple is enabled, Apple provides an account identifier and a verified email address, which can be a private relay address. We verify the credential to sign you in and store an encrypted provider token so access can be revoked during account deletion. Your player handle remains your public identity.

Camera access is used only when you choose to scan cards. Photos you choose and camera frames are processed on your device by the card scanner. BrewNight does not upload those images. Recognized card identifiers and quantities are saved to your collection when you confirm them. Exported files are shared through the device's system share sheet; the destination you select receives the file.

Optional mobile notifications

If you enable game alerts on your iPhone, we store its Apple push token, a random installation identifier, your selected alert categories and their link to your signed-in account session. Apple receives the push token, a game identifier and a generic turn or decision alert. Notifications do not include deck lists, cards, chat or opponent information. You can turn off each category in the app or disable notifications in iPhone Settings. Signing out or deleting your account removes the device registration; queued delivery records expire after ten minutes. The app also remembers the last open game on this device so it can reopen after a restart.

How information is used and shared

We use information to sign you in, save your decks and progress, run games, respond to support requests and prevent abuse. Your collection, private notes and game history are restricted to your account. Decks stay private unless you choose to publish them. Public decks can appear in discovery; anyone with an unlisted deck’s link can view it. Your handle, profile bio and posted comments are visible with those community features. A published snapshot does not include your private collection or notebook. Other people may save independent copies of a deck you share.

Railway provides application hosting, database storage and backups. Cloudflare provides traffic filtering, DDoS protection and Turnstile security checks, processing request details such as IP addresses and browser signals to prevent automated abuse. See Cloudflare’s privacy policy. Google processes Google sign-in. If password recovery is enabled, the configured email service sends a recovery message to your account address. Card lookups can send card names or printing identifiers to Scryfall to retrieve public card information and artwork; bulk public catalogs and artwork are shared across accounts. These providers process information needed to deliver their services. Authorized operators may access account information when needed for support, maintenance or security; information may also be disclosed when legally required.

Connected AI assistants

When automated content moderation is enabled, we send proposed player handles, room message text and bug or feature request text to OpenAI to check for abusive or unsafe content before accepting it. Submission text can include its title, description, expected behavior and reproduction steps. We do not attach email addresses, account identifiers, sign-in credentials, screenshots, game references, diagnostics or deck lists to these moderation requests. Information you type into the text itself is included, so avoid including private information. Provider processing follows OpenAI’s API data policies. Moderation is separate from connecting an AI assistant and does not require an assistant connection.

If you connect an assistant such as ChatGPT or Claude, you approve access to your saved decks and available collection quantities. Your chosen assistant receives the requested card and deck data. Personal notes, storage locations, email addresses and sign-in credentials are excluded from these tools. The conversation and model usage occur in that assistant and follow its privacy settings and policies.

BrewNight stores the assistant’s connection name, permissions, timestamps and authorization token hashes. It also stores proposed deck lists and the rationale your assistant submits. An assistant can save a proposal; you must review and apply it inside BrewNight to change a deck. Disconnect an assistant from the AI assistants screen to stop future access. Disconnecting cannot remove data already delivered to your assistant.

Connections expire after 30 days and proposals expire seven days after creation or a decision. Expired records are removed during assistant requests or hourly cleanup. Account export includes connection metadata and retained proposals without credentials. Account deletion removes connections and proposals from the live app.

Cookies and browser storage

Essential cookies keep you signed in and secure the sign-in flow. Browser storage remembers game preferences and deck choices; the local practice lab can also save positions on your device. Account deletion clears these saved values in the browser where you confirm deletion. Other browsers’ local preferences and any exports you saved stay on those devices. The account download covers server-held data. BrewNight does not include advertising trackers. Blocking essential cookies prevents account sign-in from working.

When product analytics is enabled, a separate cookie keeps a random visitor and session identifier and bounded campaign labels. It expires after 90 days of inactivity. Signing out or switching accounts rotates the analytics identity. The iOS app retains this cookie in its device Keychain. Global Privacy Control and Do Not Track disable browser analytics; server records of successful product actions are handled separately as described below.

Product analytics

When enabled, we use PostHog Cloud in the United States to understand page categories, acquisition sources, signup, deck creation and import, accepted scans and correction actions, game outcomes and reconnect success. Events contain pseudonymous visitor or internal account identifiers, session and applicable game identifiers, timestamps, app version, platform and bounded counts or categories. Campaign source, medium and campaign labels may be recorded. On the website, we also record the referring site’s domain and a bounded, sanitized page URL when the browser provides it, to understand where visitors arrive from. We remove query strings, fragments and credentials, omit internal BrewNight URLs, and reduce likely sensitive or identifier-bearing paths to the source domain. Browsers may provide only a domain or no referrer. The iOS app does not collect these referring URLs.

Product analytics does not receive email addresses, handles, passwords, tokens, chat messages, card images, recognized text, full decks or hidden opponent state. When enabled, masked session replays record page layout, scrolling and interaction positions. Heatmaps aggregate interaction coordinates on page categories. All text, input values and element attributes are masked before recording leaves the device; images, camera/video, canvas, embedded content and marked private areas are blocked. Console, network headers and payloads, automatic text/attribute capture and advertising tracking remain disabled. We do not use analytics for cross-site advertising. Authorized operators and our private reporting tools can read analytics to understand product use and reliability.

Pseudonymous product events follow PostHog’s seven-year plan retention window; routine BrewNight reports use up to 90 days. Masked session recordings use the provider’s 30-day retention setting. The provider’s reporting window is not an automatic erasure guarantee. See PostHog’s retention explanation and privacy policy. Account deletion includes removal of the linked PostHog person and associated events, including linked anonymous activity. Deletion remains pending while that cleanup is verified. If analytics was blocked or never linked to an account, contact us for help with a request about that browser’s activity.

Retention and your choices

Account information, saved decks, collection data, notes and community activity remain while your account is active or until you remove the relevant content. Saved deck versions remain until their deck or account is deleted. Finished or interrupted games expire 90 days after their last saved update. Removing a game from history hides it immediately; the retained history and seat deck snapshots expire after 7 days. Inactive private worker profiles and diagnostics older than 7 days are cleaned up, and may be removed sooner when the diagnostics limit is reached. The app runs cleanup at startup and hourly. Live workers and unrecognized files are protected from automatic removal; failed cleanup is retried.

Room chat retains at most the most recent 1,000 messages for up to 30 days. A private report can retain its selected message as evidence for up to 90 days. Invitations expire after 24 hours; expired invitations and creation retry receipts are removed after 7 days. Finished or closed rooms expire after 90 days. Removing a shared game from your record affects only your history and saved deck. Account deletion removes your private game records and deck snapshots, revokes social access and removes your attribution from retained shared messages. Other participants can retain their own game records and shared messages under these limits. Deleting an account during a live game interrupts it without declaring a winner.

Beta testing stores monthly allowance counters and session timing, reservation, consumption and failure/recovery records. These records remain through their calendar month and for 30 days after that month ends, independently of whether a game is hidden or removed. Account deletion removes your personal testing records; shared monthly totals contain no account identifiers.

From account settings, you can download a JSON snapshot of your account, library, decks and versions, retained games (including hidden history), legacy notebook records, testing allowance records, AI assistant connection metadata and proposals, and your community activity. The download excludes passwords, authentication tokens and other users’ private information. You can change your handle and sign out there too.

Account settings also provides permanent account deletion. Verify your current password, or sign in again with your connected provider and confirm within five minutes. Export is optional. Deletion stops your active games, revokes sign-in sessions and removes your account, saved decks and versions, collection, notes, AI assistant connections and proposals, profile, shared decks, comments and retained games from the live app. Private worker files are removed before the app reports completion. If cleanup cannot complete, access is locked and deletion stays pending for automatic retry. Independent copies other users already saved are retained by those users.

A deletion receipt containing a random receipt ID, internal account ID, status and timestamps is retained for 30 days to track cleanup. Pending receipts also retain the game IDs needed to retry file removal. Expired sign-in sessions and verification records are cleaned up hourly; authentication rate-limit records expire after 24 hours. The notebook feature has been retired. Previously saved notebook copies remain available in your account download until you delete your account, even if the original game history expires or its deck is deleted. Provider backups, delivery records and platform security logs have separate expiry schedules and may remain after live-app deletion. The app’s cleanup does not erase provider backups or other people’s copies.

For access, correction, deletion or other privacy requests you cannot complete in the app, email [email protected] from your account address. We may need to verify ownership before acting on a request.

Contact and updates

For privacy questions, contact [email protected]. We will update this page when these practices change and show the revised date above.