Privacy Policy

Account information: your email and name, handled by our authentication provider (Neon Auth) when you sign up or sign in.

Organization data: organization names, membership, and roles for the teams you create or join.

Collection data: the collections, bins, sorting rules, and card records you create while using the app.

Card scan images: when you scan a physical card, the photo is sent to our server only to generate a match against the card database. It's processed in memory and discarded. We don't store the photo itself, only the resulting card match.

Payment information: if you subscribe to the Business plan, billing details are collected and processed directly by Stripe. We never see or store your full card number.

Discord webhook data: if you connect a Discord webhook, we send the scan and collection notifications you've configured to the webhook URL you provided.

Basic operational logs (errors, request metadata) used to keep the service reliable. We don't use third-party analytics or advertising trackers.

To operate and provide the service, including authenticating you and keeping your data scoped to your organization.

To process payments for paid plans and manage your subscription.

To send the notifications you've explicitly configured (such as Discord webhook messages).

To maintain the security and reliability of the service.

We don't sell your personal information. We share it only with the service providers needed to run Mault:

Neon, for database hosting and authentication.

Stripe, for payment processing on paid plans.

Discord, only if and when you configure a webhook to send notifications there.

Third-party trading card game databases (e.g. Scryfall and similar sources), which we query to identify and enrich card data. These queries don't include your personal information.

We keep your account, organization, and collection data for as long as your account is active.

Card scan photos are never retained. They're discarded immediately after a match is generated.

You can request deletion of your account and associated data at any time by contacting us.

You can access, correct, export, or delete your personal data by contacting us at the address below, or directly through the app where available.

Traffic to the hosted service is encrypted in transit (HTTPS). Data is scoped per organization using database-level row-level security, and API access uses short-lived bearer tokens rather than cookies.

Mault is not directed at children under 13, and we don't knowingly collect personal information from them.

We may update this policy from time to time. We'll update the date at the top of this page when we do.

Questions about this policy? Reach us at [email protected].