Privacy Policy

Last updated: August 20, 2026

1. About This Policy

CubeForge operates the CubeForge service and, where data-protection law applies, is the controller of the personal information described in this policy. CubeForge is operated from Japan and is a free web application for building, managing, sharing, and drafting Magic: The Gathering cubes.

This policy applies to the CubeForge website, its account and drafting features, and CubeForge-operated APIs and backend services. Third-party websites that you choose to visit have their own policies.

2. Information We Collect

Account and profile information

When you create or use an account, CubeForge may process your email address, username, display name, profile image, biography, language and theme preferences, public profile slug, account dates, internal account ID, and authentication-provider identifiers. CubeForge uses its self-hosted Supabase authentication service for account sessions and supported sign-in providers; CubeForge does not receive your Google password.

Your username and profile fields that you choose to publish may be visible to other users. Your email address and role information are kept in private account records.

Content and activity

CubeForge stores the content needed for the features you use. This may include cube lists and settings, card choices, ownership and printing preferences, cube metadata, primers and descriptions, cube articles, comments, roadmap posts, draft settings, lobby and participant information, picks, decklists, draft history, and collaboration or sharing activity.

If you create custom cards, CubeForge may store the card information and images you upload, together with resized previews and thumbnails generated from those images.

Technical, log, and analytics information

When you use CubeForge, CubeForge and its infrastructure providers may receive your IP address, request time, requested URL, referrer, browser and device type, operating system, authentication and security events, error information, and similar server or application logs. Approximate country, region, or city may be inferred from an IP address for security or aggregate analytics; CubeForge does not request precise GPS location.

Analytics events can include page views, sign-in and sign-up method, cube and draft actions, feature usage, internal cube or draft identifiers, and marketplace-link interactions. CubeForge does not send email addresses or usernames to its analytics provider as user identifiers or properties.

Communications and referrals

If you contact CubeForge, the service may retain your email address and the contents of your request. If you follow a CardNexus affiliate link, CubeForge may receive referral or conversion information from CardNexus or its affiliate provider, such as whether a qualifying registration or purchase occurred.

3. How We Use Information

CubeForge uses information to:

  • provide, maintain, and improve the website, APIs, and account features;
  • authenticate users and manage accounts, profiles, permissions, and preferences;
  • save, synchronize, display, and share user-created content according to its settings;
  • create and operate hosted and guest drafts, lobbies, picks, decklists, and recaps;
  • process uploaded images and generate technical derivatives such as thumbnails;
  • secure the service, enforce rate limits, prevent abuse, and investigate incidents;
  • debug errors, monitor performance, understand feature use, and improve CubeForge;
  • send service emails and respond to support, privacy, or moderation requests;
  • provide card information and marketplace links and attribute affiliate referrals; and
  • comply with applicable law and protect users, CubeForge, and third parties.

4. Legal Bases for Processing

Where the GDPR or similar law applies, CubeForge relies on the following bases as appropriate:

  • Performance of the service: processing needed to create your account and provide the CubeForge features you request.
  • Legitimate interests: operating, securing, debugging, and improving a free service; preventing abuse; supporting users; and understanding aggregate usage, balanced against user privacy.
  • Consent: where applicable law requires consent for optional analytics, non-essential browser storage, or similar tracking. Consent may be withdrawn without affecting earlier lawful processing.
  • Legal obligations: processing needed to comply with applicable law or valid legal requests.

5. When Information Is Shared

CubeForge does not sell or rent your personal information. Information may be shared:

  • with other users or the public when you use public, unlisted, collaboration, community, or draft-sharing features;
  • with service providers that host, secure, analyze, or deliver CubeForge and its communications;
  • when you choose to follow a third-party or affiliate link;
  • when reasonably necessary to investigate abuse, protect rights or safety, or comply with law; or
  • as part of a transfer of the service, subject to appropriate handling of personal information.

6. Cookies, Browser Storage, and Tracking

Essential and preference storage

CubeForge uses cookies and local or session storage to remember the selected theme and sidebar state, maintain account authentication, protect sessions, cache card and content data, preserve editor drafts and import state, remember draft-display preferences, run guest drafts, and avoid duplicate anonymous votes or events. Blocking this storage may cause some features or preferences not to work correctly.

Analytics

Production pages load Plausible Analytics to measure aggregate page traffic and selected product goals. Plausible is designed not to use persistent cookies; the analytics request still includes technical information such as an IP address and user agent, which is used to produce short-lived aggregate measurements. CubeForge also sends limited server-side Plausible events when accounts, cubes, or drafts are created.

Affiliate links

CubeForge does not directly load an Impact tracking script. CardNexus marketplace links use a CardNexus affiliate redirect. After you click, CardNexus, Impact, or the destination service may set cookies or use other identifiers under their own privacy and cookie policies to attribute a registration or purchase to CubeForge.

7. Service Providers and External Services

The implementation currently uses the following providers or services in ways relevant to this policy:

  • Google: optional Google sign-in and web fonts. See Google's Privacy Policy.
  • Cloudflare: DNS, content delivery, traffic security, and R2 object storage for cube-card and draft snapshots. See Cloudflare's Privacy Policy.
  • Hetzner: VPS hosting for CubeForge-operated web, API, drafting, and database infrastructure. See Hetzner's Privacy Policy.
  • Plausible Analytics: aggregate traffic and selected product-event measurement through CubeForge-configured analytics endpoints. See the Plausible Data Policy.
  • Mailgun: delivery of welcome and other service emails. See Mailgun's Privacy Policy.
  • Scryfall: card data, symbols, and card images. Some images and API resources are requested directly from Scryfall by your browser, so Scryfall receives the associated request information. See Scryfall.
  • CardNexus / Impact: marketplace pricing, outbound affiliate links, and referral attribution after a user chooses to click a CardNexus link. See CardNexus Legal and Impact's Privacy Policy.

These providers process information under their own terms and may receive IP addresses, browser details, identifiers, content, or other information needed to perform their services.

8. International Transfers

CubeForge is operated from Japan and serves users internationally. Depending on the service and provider, information may be processed or stored in Japan, the United States, the EU/EEA, or other jurisdictions whose data-protection laws may differ from those where you live. CubeForge considers the nature of the data and the safeguards offered by providers when selecting and operating these services.

9. Data Retention and Deletion

  • Account and profile information is generally retained while your account exists.
  • Cubes, drafts, uploaded images, comments, and other user-created content are retained while needed to provide the service, preserve content you have chosen to share, or meet operational and legal needs.
  • Inactive unfinished drafts and some temporary draft data may be cleaned up automatically.
  • Security, email, analytics, and server logs are kept for limited operational, security, and debugging needs.
  • Deleted information may remain temporarily in backups, caches, logs, or provider systems.
  • Aggregated or de-identified statistics may be retained after the underlying records are deleted.

Contact CubeForge to request account deletion. Some user-created content, uploaded assets, analytics events, or operational records may require separate handling where retention is necessary for shared content, security, or legal obligations.

10. Your Rights

Depending on where you live, you may have rights to access, correct, or delete personal information; restrict or object to processing; receive portable data where applicable; and withdraw consent for consent-based processing. You may also complain to the data-protection authority that applies to you.

You can edit profile and account information, delete individual content where the relevant control exists, or use Account Settings → Danger Zone to delete the account records described above. For access, portability, objections, or a broader deletion request, email [email protected]. CubeForge may need to verify your identity before completing a request.

11. Security

CubeForge uses reasonable technical and organizational safeguards appropriate to a small web service, including authenticated access controls, encrypted network connections, provider security features, validation and size limits for uploads, and restricted administrative access. No internet service or storage system can guarantee absolute security.

12. Children

CubeForge is not directed to young children. Anyone who cannot legally agree to these practices or use the service under the law where they live should use CubeForge only with the involvement and consent of a parent or guardian where required. If CubeForge learns that personal information was collected without required parental consent, reasonable steps will be taken to delete it.

13. Changes to This Policy

This policy may be updated as CubeForge and its providers change. Material updates will be communicated through the service where reasonably practical, and the date at the top of this page will be updated.

14. Contact

Privacy questions and rights requests can be sent to [email protected]. General support requests can be sent to [email protected].

← Back to Sign In