the99

Privacy

In effect since 19 August 2026.

the99 is a personal project, run by one person from Argentina. It is free, it sells nothing, and it has no advertising network inside it. What follows is the whole of what it keeps.

What is stored about you

• Your account. Your email address, the display name you chose, and your password stored as a one way hash. The password itself is never written down and cannot be read back, here or by anyone.
• Your sessions. A session token, plus the IP address and browser user agent the session was created from. This is what keeps you signed in and what makes it possible to notice a stolen session.
• Your collection. For each card, the Arena card number and how many copies you own. Nothing else. This is the entire point of the site and it is the most valuable thing here.
• Your uploads. When each upload happened, whether it came from the desktop tool or a file, how many cards it contained, whether anything changed, and how long it took.
• Upload keys, stored hashed, the same way as passwords.
• Decks you copy. Which commander, how many cards you were missing, and how many substitutions you accepted. This is what tells us whether the substitution engine is any good.
• Anything you type into the suggestion box, which is stored as you wrote it.

What is never stored

• Your Arena login. The desktop tool reads the card list out of the running game on your own machine and sends this site nothing but card numbers and quantities. It never sees, asks for, or transmits your Wizards credentials, and this site could not accept them if it tried.
• Payment details. There is nothing to pay for.
• Your real name, address, phone number or date of birth. None of it is asked for.

Your collection is not shared

No other user can see your collection, and it is not sold, rented, published or handed to anybody. The public deck ladder is built from deck lists gathered from public sources, not from anyone's collection. Aggregate counts that cannot be traced to a person, such as how many people copied a given commander, may be mentioned publicly.

Companies that necessarily see some of it

Running a site means other people's computers touch the data. These are all of them.

• Vercel hosts the site and receives the requests your browser makes, including your IP address.
• Neon hosts the database, so everything in the first section is physically stored there.
• Resend delivers exactly one kind of email: a password reset you asked for. It sees your email address.
• PostHog counts pages viewed and steps completed, so it is possible to tell whether the site works for people who are not me.
• Vercel Analytics counts visits without cookies and without following anyone off this site.
• Scryfall serves every card image. Your browser fetches those directly from them, which means they see your IP address the same way any website with images does.

Cookies

One essential cookie keeps you signed in; without it there is no way to have an account. PostHog sets its own cookie to recognise a returning browser. Vercel Analytics sets none. There is no advertising or cross site tracking cookie here, because there is no advertising network here.

How long it is kept

Your account and collection are kept until you ask for them to be deleted. Sessions expire after seven days. Upload records are kept so it is possible to work out why an import went wrong.

Deleting everything

Email hello@the99.cards from the address you signed up with and say you want the account gone. Everything listed above is removed together, because every record is tied to the account row and goes with it. There is no self service button for this yet, and until there is, the mailbox is the honest answer rather than a claim about a feature that does not exist.

You can also ask for a copy of what is held about you, or for something to be corrected, at the same address.

Children

The site is not directed at children under 13 and no account should be created for one.

Changes

If what is collected changes, the date at the top of this page changes with it. Anyone with an account will be told by email before a change that widens what is collected takes effect.

Questions about any of this: hello@the99.cards. Or back to the site.