1. Who we are
Deck Kitchen is an independent project made in Brazil. It is not affiliated with The Pokémon Company, Nintendo, or Pokémon TCG Live.
2. Account data
When you create an account we store:
- Email, name if you give one, and a password as a bcrypt hash only. We never store the password itself.
- Or a GitHub login: the email, name, and avatar URL GitHub sends us.
- Optional PTCG Live name on your profile, so we can tell which side is you in a battle log.
- Optional Limitless username on your profile, if you add one.
3. What you submit
If you use the app, we store what you paste or type:
- Battle logs: the raw text and the data we extract, including the opponent in-game name from the log. Decks, events, rounds, and review notes you write.
- A short import outcome (success or fail, no battle-log text) so we can see if paste is breaking.
- The tournament card draft stays in your browser (localStorage). The decklist image is built from what you type on the page. Neither is stored on our server unless you later save an event or deck to your account.
- Matches stay private unless you turn on a public share link. The opponent name is always hidden. You can turn the link off at any time.
4. Usage and measurement
We use Vercel Analytics and Speed Insights. They do not set cookies. We record our own funnel events (for example a landing visit or a signup) with the visit origin: the referrer and UTM tags. Those events do not include your email. To rate-limit signup abuse, we hash the visitor IP with SHA-256 and a secret, and keep only that hash. We do the same with a hashed email when rate-limiting password reset requests.
5. Google Ads
The Google tag loads only if you arrived from our ad click (gclid, gbraid, or wbraid in the URL, or a _gcl_* cookie from that first visit). We use it to measure signups from ads. Everyone else loads no Google scripts.
6. Cookies and local storage
These names match the product. On HTTPS the login cookie is named __Secure-authjs.session-token. The tab also uses sessionStorage keys dk.funnel_origin, dk.landing_view, dk.share_link_opened, and dk.quick_import_draft so we do not lose the landing origin, count a visit twice, or lose a pasted battle log if the tab reloads. Those values go away when you close the tab.
| Name | Purpose | Duration |
|---|---|---|
| authjs.session-token | Keeps you signed in. | Until you sign out |
| dk-locale | Language you chose. | 1 year |
| dk_tz | Timezone so dates match your clock. | 1 year |
| dk_deck | The deck selected in the app. | 1 year |
| dk_fo | Visit origin (referrer and UTMs). | 30 days |
| dk_lv | Marks that we already recorded this visit. | Browser session |
| dk_fu | Marks a recent card, decklist, or share action so the same click is not counted twice. | Browser session |
| dk_signup_conv | Marks a signup so we can measure an ad conversion. | 10 minutes |
| _gcl_* | Google Ads click. Only if you arrived from an ad. | Set by Google |
| dk-card-draft | Tournament card draft in this browser. | Until you clear it or save the card |
7. Who processes data for us
These companies process data so the product can run:
- Vercel: hosting.
- Neon: database.
- Resend: password reset and notice emails.
- GitHub: optional login.
- Stripe: support donations on /support. Payment happens on Stripe's page. We never receive card data.
- Google Ads: only for visitors who arrived from an ad.
- Limitless: we only read public meta. We do not send your data to Limitless.
8. We do not sell data
We do not sell your data. There are no ads on this site.
9. Your rights (LGPD)
You can ask us to access, correct, export, or delete your account and data.
Email privacy@deckkitchen.live. We reply within 15 days.
10. Updates
When the facts on this page change, we update the date at the top.