Privacy & contact

Who runs this site

DeckPeek is a private, non-commercial fan project run by one person as a hobby. There is no company behind it, nothing is sold, and there are no ads or sponsorships.

The site is free and stays free. There is a Ko-fi page for anyone who would like to chip in voluntarily; what comes in covers what it costs to run this — the domains and hosting — and the time that goes into building it further. Nothing is unlocked by paying, no feature is held back, and nothing about you is processed differently either way. The button that leads there is Ko-fi's own, which means it fetches a few things from Ko-fi and from Google as the page loads — see the section on it below for exactly what, and how to stop it.

Email: [email protected]
Discord: nerythalon

Email is the reliable way to reach me — for questions, bug reports, and for any rights holder who would like something changed or removed. If you need the operator's name for a formal matter, such as a data protection request, just ask and you will get it.

What stays on your device

The viewers keep your own settings (theme, layout, cards per row, sort orders), your list of recently opened decks, and a copy of the card database and the decks you opened. All of it lives in your browser's local storage and IndexedDB on your device — it is never sent to me, and I cannot read it. Clearing the site data in your browser removes it.

There are no tracking cookies and no consent banner, because nothing is stored that isn't needed to run the viewer you asked for. Installing a viewer as an app (PWA) additionally caches its files so it keeps working offline.

Server logs

The site is hosted on Cloudflare Pages. Delivering a page necessarily means Cloudflare processes connection data — your IP address, the time, the requested address, referrer and browser identification — to serve the request and to defend against attacks. Cloudflare acts as a processor on my behalf (Art. 28 GDPR); the legal basis is my legitimate interest in operating the site securely (Art. 6 (1) (f) GDPR).

Cloudflare's dashboard shows me aggregated numbers derived from those logs: how many requests and roughly how many visitors arrive, which pages they open, and which countries and browsers they come from. I look at them to see whether the viewers are used at all. There is no analytics script in the page, nothing is stored on your device for this, and nothing identifies you as an individual or follows you across sites — the numbers are counted, not profiled.

Card data and images come from elsewhere

Deck and card data, and every card image, are loaded by your browser directly from the site the deck lives on: netrunnerdb.com, marvelcdb.com or arkhamdb.com. That is deliberate — images are not copied onto my server. It also means those services receive your IP address and can see which cards you look at; their own privacy policies apply. Apart from the support button described next, nothing else is fetched from a third party: no analytics, no trackers, and no other scripts or fonts.

The Ko-fi support button

The footers show a Ko-fi button, and it is drawn by Ko-fi's own widget rather than by me. It is the only part of this site that loads code from somewhere other than the card databases, and it loads together with the page — you do not have to click anything for that to happen. Showing it makes your browser request:

storage.ko-fi.com — the widget script, and the small cup image on the button itself.
fonts.googleapis.com and fonts.gstatic.com — the “Quicksand” typeface the widget asks for. That is Google Fonts, fetched live from Google rather than served from here.

Each of those requests necessarily reveals your IP address, along with the time, the referring page and your browser identification, to Ko-fi and to Google respectively — both outside the EU. Nothing comes back to me: I am not told that you saw the button, nor whether you clicked it. The basis I rely on for this is my legitimate interest in funding the site (Art. 6 (1) (f) GDPR); what those two companies then do with the data is governed by their own policies — Ko-fi's and Google's.

If you would rather your browser did not make those requests, any content or script blocker will stop the button from loading. Nothing else on the page depends on it, and the viewers work exactly the same without it.

Your rights

You can ask me about data concerning you, and request correction, erasure or restriction of it, object to processing, and receive it in a portable form (Art. 15–21 GDPR). Write to the address above. You also have the right to complain to a data protection supervisory authority.

Beyond the server logs described above, this site has no accounts, no newsletter, no contact form and no way for me to identify a visitor — so there is usually nothing about you for me to hold.