Privacy Policy

1. Who We Are

Deka ("we", "us", "our") is a social trading card application operated by Get Deka, based in Ireland, and accessible at getdeka.app and via the Deka mobile application on iOS and Android. Deka acts as the data controller for the personal data described in this policy.

For any privacy-related queries, you can contact our data protection point of contact at support@getdeka.com.

2. Age Requirement

Deka is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that a user is under 18, we will promptly delete their account and all associated data. If you believe a minor has created an account on Deka, please contact us immediately at support@getdeka.com.

3. Data We Collect

3.1 Account Information

When you create a Deka account, we collect your email address, display name, username, and profile photo. You may also provide optional profile information such as a bio and social media links.

3.2 Collection Data

Cards you add to your collection, wishlist, and trade bait lists, including any notes, tags, conditions, grades, or values you assign to them.

3.3 Marketplace Data

Listings you create, offers you send or receive, trade and purchase history, negotiation messages, and reviews you leave or receive.

3.4 Payment and Financial Data

When you buy or sell cards on Deka, payments are processed by Stripe. We do not store your full card number or bank account details — these are handled directly by Stripe in accordance with PCI DSS standards. We do collect and store:

• Shipping addresses you save in-app.
• Transaction records including order amounts, fees, and status.
• For sellers: your Stripe connected account ID and payout status (but not your bank details).

3.5 User Content

Photos, videos, and text you upload or publish on Deka, including post images, stories, card photos, listing images, post text, and comments.

3.6 Messages

Content of direct messages and group chat messages you send or receive on Deka. Messages are stored on our servers to deliver them to recipients and to provide message history. We do not read your messages except where required to investigate reported violations of our Terms of Service or to comply with legal obligations.

3.7 Device and Usage Data

Through our analytics provider (PostHog), we collect pseudonymous usage data — linked to your account identifier — such as screens viewed, features used, app version, device type, device model, and operating system. We do not track precise GPS location; however, we collect your country code for localisation purposes, and approximate location may be inferred from your IP address.

3.8 Push Notification Tokens

If you enable push notifications, we collect and store your device push token (via Expo Push Notification Service) to deliver notifications about activity relevant to your account, such as new messages, likes, comments, follows, marketplace updates, and price alerts.

3.9 Technical and Crash Data

We collect IP addresses, browser and app identifiers, and crash/error logs via Sentry for debugging, performance monitoring, and service reliability purposes. Crash reports may include device state, stack traces, and app version information at the time of the error. This data is used solely to identify and fix bugs.

3.10 Card Image Data

When you use Deka's card scanning feature, your card photo may be transmitted to our image recognition provider (Ximilar) for identification. These images are processed in real time and are not retained by Ximilar after the identification result is returned. MTG card scanning uses on-device text recognition (OCR) and does not transmit images to any external service. Deka retains card images only as part of your collection or listing content.

3.11 Price Tracking and Alerts

If you set up price alerts, we store your alert preferences (card identifiers and target prices) to monitor pricing data and notify you when conditions are met. No additional personal data is collected for this feature beyond what is described above.

3.12 Waitlist Sign-ups

If you join the DEKA V2 early-access waitlist on our website (getdeka.app), we collect the email address you submit so we can contact you about early access and your waitlist status. If you tick the optional box, we also record your consent to receive occasional product-update emails, together with the date and version of the consent notice; you can withdraw this at any time by contacting us or using the unsubscribe option in those emails. We also record basic campaign attribution (utm_source, utm_medium, utm_campaign and a referral identifier) read from the web address you used to reach the site, to understand how people discover DEKA — this is not collected using cookies. Joining the waitlist never requires opting in to marketing.

4. Lawful Basis for Processing

Under the General Data Protection Regulation (GDPR), we rely on the following lawful bases to process your personal data:

• Contract: Processing that is necessary to provide you with the Deka service, including maintaining your account, enabling marketplace functionality, facilitating trades, processing payments, delivering messages, sending push notifications, and displaying your collection to other users.
• Legitimate Interest: Processing that supports our legitimate business interests, including improving the app through product analytics (PostHog), maintaining platform safety and integrity, monitoring app stability and performance (Sentry), preventing fraud and abuse, and calculating trust scores. We balance these interests against your rights and freedoms.
• Consent: Where we rely on your consent (for example, for optional marketing communications or push notifications), you may withdraw your consent at any time by contacting us or adjusting your in-app or device settings.
• Legal Obligation: Processing that is necessary to comply with a legal obligation to which we are subject, including tax record-keeping and responding to lawful requests from authorities.

5. How We Use Your Data

We use your data to:

• Provide, operate, and maintain your Deka account and its features.
• Display your collection, wishlist, and trade bait to other users in accordance with your privacy settings.
• Facilitate marketplace transactions, trades, and messaging between users.
• Deliver direct messages and group chat messages between users.
• Process payments, manage seller payouts, and prevent payment fraud via our payment processor (Stripe).
• Send push notifications about account activity, messages, marketplace updates, and price alerts.
• Monitor card prices and send price alert notifications when your target conditions are met.
• Calculate and display trust scores and user reviews.
• Display indicative card pricing sourced from third-party providers.
• Improve the app through product analytics and usage data (PostHog).
• Monitor app stability, detect crashes, and fix bugs (Sentry).
• Communicate with you about your account, service updates, or policy changes.
• Enforce our Terms of Service, investigate potential violations, and prevent misuse.
• Monitor platform activity to maintain a safe and trustworthy environment for all users.

We do not sell your personal data to third parties. We do not currently use your data for targeted advertising. Should this change in the future, we will update this policy and notify you in advance.

6. Third-Party Services

We share data with the following third-party service providers, solely to operate and improve Deka:

We require all third-party providers to process personal data in accordance with applicable data protection laws. Where data is transferred outside the European Economic Area (EEA), appropriate safeguards are in place (see Section 11).

7. Data Storage and Security

Your data is primarily stored on Supabase servers located in the Ireland (EU West) region. We implement industry-standard security measures, including row-level security policies, encrypted connections (TLS), secure authentication protocols, and hashed credentials.

Images and files you upload (including profile photos, post images, story media, and card photos) are stored in Supabase Storage with access controlled by row-level security policies.

While we take reasonable steps to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents that may arise.

8. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights in relation to your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your data. You can do this via the Delete Account feature in Settings, or by contacting us directly.
• Restriction: Request that we limit the processing of your data in certain circumstances.
• Data Portability: Receive your data in a structured, commonly used, machine-readable format.
• Objection: Object to the processing of your data where we rely on legitimate interest as the legal basis.
• Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at support@getdeka.com. We will respond within 30 days of receiving your request. If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commission (DPC) in Ireland or your local supervisory authority.

9. Data Retention

We retain your personal data for as long as your account remains active and as necessary to provide the Deka service.

When you delete your account, all associated data is permanently removed, including your profile information, posts, stories, collection data, listings, messages, reviews, price alerts, push tokens, and all uploaded images and videos.

Certain data may be retained for a limited period after account deletion where required by law or to resolve disputes, enforce our agreements, or comply with legal obligations. Transaction records and payment data may be retained for up to 7 years to comply with tax and financial reporting requirements.

Crash and error logs collected by Sentry are retained for 90 days by default and are automatically purged thereafter.

10. Cookies and Tracking

Deka is primarily a mobile application and does not use browser cookies. Our analytics provider (PostHog) may use local device identifiers for session tracking purposes. Sentry uses minimal local storage for crash reporting session data.

The Deka website (getdeka.app) does not use tracking cookies or third-party analytics scripts.

If you wish to opt out of analytics processing, please contact us at support@getdeka.com.

11. International Data Transfers

Your primary data is stored in the EU (Ireland). Some of our third-party service providers are located outside the European Economic Area (EEA), including Stripe, Sentry, Expo, Resend, and Scryfall (all US-based). Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Reliance on an adequacy decision by the European Commission (e.g. the EU-US Data Privacy Framework where applicable).
• Ensuring the provider maintains equivalent data protection standards.

12. Children's Privacy

Deka is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support@getdeka.com so that we can take appropriate action. For more information, see our Child Safety Standards.

13. Your Choices

• Push Notifications: You can enable or disable push notifications at any time through your device settings. Disabling push notifications will not affect the core functionality of your account.
• Collection Privacy: You can set your collection to public or private through your in-app privacy settings.
• Account Deletion: You can delete your account at any time through Settings in the app, or by contacting us at support@getdeka.com. Account deletion is permanent and cannot be undone.
• Analytics Opt-Out: To opt out of analytics tracking, contact us at support@getdeka.com.

14. California Privacy Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us at support@getdeka.com.

15. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of significant changes through the app or via email. The "Last updated" date at the top of this page indicates the most recent revision. Your continued use of Deka after any changes take effect constitutes your acceptance of the updated policy.

16. Contact

For any questions about this privacy policy or the handling of your personal data, contact us at: