Privacy Policy

Last Updated: January 16, 2026

Introduction

This privacy policy explains how this deck-building website ("the Site") collects, uses, and protects your personal information. This is a non-commercial portfolio project operated by a solo developer based in Germany.

Data Controller

Email: wjoschka@gmail.com

What Data We Collect

Account Information

When you sign in using Google or GitHub, we collect and store:

• Your email address (provided by Google or GitHub)
• Your name or username
• Your profile picture URL
• Your unique user ID (generated by the authentication provider)
• OAuth provider information (which service you used to sign in)
• Account creation and last sign-in timestamps
• Authentication metadata required for security

This data is stored in our Supabase-managed authentication system and in our user profile database.

Deck Data

• Deck compositions are stored locally in your browser using localStorage
• This data never leaves your device unless you explicitly publish it

Technical Data

• Authentication tokens (stored as cookies) to keep you logged in
• Server logs for security, debugging, and abuse prevention (includes IP addresses, request timestamps, and access patterns)
• Browser and device information (user agent) collected automatically by our backend infrastructure
• Anonymous performance metrics collected by Vercel Speed Insights (see below)

Legal Basis for Processing (GDPR)

We process your data based on:

• Consent - You provide consent when you choose to sign in with Google or GitHub
• Legitimate Interest - To provide the deck-building functionality and maintain the security of the service

How We Use Your Data

Your data is used solely to:

• Authenticate you and maintain your session
• Display your profile information
• Provide deck-building functionality
• Ensure security and debug technical issues (via server logs)
• Monitor and improve website performance (via anonymous Speed Insights metrics)

We do not:

• Sell your data
• Use your data for marketing
• Track you across websites
• Identify individual users through analytics (Speed Insights is completely anonymous)
• Share your data with third parties (except as required by law or as described below)

Third-Party Services

Supabase

We use Supabase as our backend infrastructure and authentication provider. Supabase acts as a data processor on our behalf and stores:

• Your authentication data (email, name, avatar, OAuth metadata)
• Your profile information (username, avatar URL)
• Authentication tokens and session data

GDPR Compliance:

• We have signed a Data Processing Agreement (DPA) with Supabase, which ensures they process your data only according to our instructions and GDPR requirements
• All data is stored in EU data centers (West EU - Ireland)
• We (the website operator) are the data controller and remain ultimately responsible for your data

Important: While Supabase manages the authentication system infrastructure, the authentication database is part of our project, and we have administrative access to it.

• Supabase Privacy Policy
• Supabase Security Overview

Vercel

This website is hosted on Vercel's infrastructure. Vercel may process:

• Server logs (including IP addresses, request URLs, timestamps)
• Performance and error monitoring data
• Edge network routing information

Additionally, we use Vercel Speed Insights to monitor website performance. This feature collects anonymous, aggregated performance data including:

• Page routes and URLs visited
• Network connection speed (e.g., 4g, 3g)
• Browser type and version
• Device type (mobile, desktop, tablet)
• Operating system
• Country (based on server location, not IP address)
• Web performance metrics (page load times, Core Web Vitals)
• Timestamp of page visits

Important: Speed Insights is completely anonymous and privacy-friendly:

• No personal data - No user identification or tracking
• No IP addresses stored - Country is determined at the edge, IP is not retained
• No session tracking - Cannot reconstruct browsing sessions or identify individuals
• No cookies used - Performance data is collected without cookies
• GDPR compliant - Designed to work within strict privacy regulations

Vercel acts as a data processor and is GDPR-compliant. Data is processed only to provide hosting services and ensure website performance and security.

• Vercel Privacy Policy
• Vercel GDPR Compliance
• Vercel Speed Insights Privacy

Google OAuth

If you sign in with Google, Google shares the following information with us:

• Email address
• Name
• Profile picture
• Unique Google user ID

During the OAuth flow, you'll see what information Google will share before you authorize the connection. Google's privacy policy applies to their handling of your data.

• Google Privacy Policy

GitHub OAuth

If you sign in with GitHub, GitHub shares the following information with us:

• Username
• Email address (if public)
• Profile picture
• Unique GitHub user ID

During the OAuth flow, you'll see what information GitHub will share before you authorize the connection. GitHub's privacy policy applies to their handling of your data.

• GitHub Privacy Policy

Data Retention

• Account data is retained as long as your account is active
• If you delete your account, all associated data is immediately deleted from our database
• Server logs are retained for a maximum of 90 days

Your Rights (GDPR)

You have the right to:

• Access - Request a copy of your personal data
• Rectification - Correct inaccurate data
• Erasure - Delete your account and all associated data
• Data Portability - Receive your data in a structured format
• Object - Object to processing of your data
• Withdraw Consent - You can delete your account at any time

To exercise these rights, contact: wjoschka@gmail.com

Cookies and Local Storage

Cookies

We use only essential cookies required for authentication:

• sb-[project-id]-auth-token.0 and sb-[project-id]-auth-token.1 - Authentication tokens (strictly necessary)

Local Storage

We use localStorage to save in-progress decks in your browser. This data:

• Stays on your device only
• Is not transmitted to our servers unless you explicitly publish a deck
• Can be cleared at any time through your browser settings

Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encrypted connections (HTTPS)
• Secure authentication via established OAuth providers
• Minimal data collection
• Access controls on the database

However, no method of transmission over the internet is 100% secure.

International Data Transfers

Your data may be processed by Supabase, which may use servers located outside the European Economic Area. Supabase ensures appropriate safeguards are in place for international data transfers.

Children's Privacy

This service is not directed at individuals under 16 (the age of digital consent in Germany under GDPR). We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete it.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last Updated" date.

Contact & Complaints

For privacy-related questions or concerns, contact: wjoschka@gmail.com

You also have the right to lodge a complaint with a supervisory authority:

• Germany: Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)
• BfDI Website