Privacy

Tapped is a search engine for Magic cards. It works without an account; if you sign in, we keep only what your decks and collection need. We use no tracking cookies and collect no visit statistics. We never sell or share data with anyone.

IP address

To protect the service from abuse, the server keeps your IP address in memory for two minutes at most, long enough to count requests (rate limiting). It is never written to disk. When a page fails, the technical log records the page address and the kind of error, not who asked for it.

Cloudflare

The site goes through Cloudflare, which receives your IP address to deliver the pages and block attacks.

Card images

Card images come straight from Scryfall's servers: to show them, your browser connects to Scryfall, which sees your IP address.

Preferences

The results view and the filter panel state stay in your browser (localStorage). They are never sent to the server; you can clear them in your browser settings.

Account

If you sign in with Google or Discord, we receive an identifier and the name of your account; we do not ask for your email. We keep your display name, linked sign-ins, your decks, your collection (cards, printings, quantities, finish, language and condition) and your sessions (the session code only as a hash), with no IP address. Files you import into the collection are read and thrown away: we do not keep them. The tapped_session cookie is technical: it only keeps you signed in and needs no consent. We process this data to provide the service you asked for. Public decks are visible to everyone together with your display name; only you see your collection. From the Account page you can download all your data and delete your account, right away; backup copies expire within 14 days.

Natural-language search

The phrases you write in "Natural language" mode are sent to Anthropic, which provides the Claude model, to turn them into a search. We keep them for 180 days, without the IP address, to improve the translation. To limit the use of this mode the server keeps your IP address in memory for up to an hour. Avoid writing personal data in your phrases.

For privacy questions, write to [email protected].