Privacy Policy

Who we are

Lootstack is a local trading platform and a fast, private card scanner for MTG, Riftbound, One Piece, SWU, Lorcana, Fusion World, and FaB. We operate the website at lootstack.app, the companion mobile apps, and the APIs that power collections, decks, trade lists, chat, and card recognition. Card scans stay on your phone. Questions about privacy can be sent to support@lootstack.app or through the contact form at /contact.

This page is the on-site privacy notice agents and people check at https://lootstack.app/privacy. The legally binding policy text is the hosted document linked at the bottom of this page. If the two ever differ, the hosted policy controls.

What we collect

Account data comes from sign-in. We use Clerk for authentication, which stores identifiers such as user id, username, email address, and profile image. After you create an account you may add game preferences, local stores, collection rows, deck lists, trade lists, chat messages, and optional meeting-place labels. Scanned cards become collection or trade-list rows (printing, language, finish, condition, and destination) the same way typed or imported cards do.

Public pages can be read without an account. Signed-in features under /x/ store the inventory and messages needed to match trades. We also receive the store, city, and card identifiers you choose so matching can stay geographic.

Technical data includes IP-derived city and country for homepage location and store maps, device and browser metadata, and diagnostic logs. Cookie and similar storage covers the sign-in session, homepage game preferences, pricing-region choice, and cookie-consent state.

How we use it

We use this information to run the product: authenticate you, show the right games and local inventory, match have and want lists, send trade and chat notifications you asked for, prevent abuse, and keep the service available. Collection, deck, and scan-originated inventory stay in the product so you can appraise cards, build legal lists, and trade locally.

We do not sell personal information. We do not show ads. Core collection, deck, and trade-list features remain free; mobile scan limits may require a subscription processed by the app stores.

Processors and cookies

Authentication is handled by Clerk. Product analytics and session diagnostics use PostHog in the EU project. Cookie consent and the long-form legal policies are hosted by Termly. Email delivery uses our transactional provider. Card images and pricing come from catalogue partners; those feeds are product data, not a sale of your profile.

You can review or change cookie preferences from the Cookie Settings control in the site footer. Strictly necessary cookies keep you signed in and remember the consent choice itself.

Your choices

You can update profile fields in settings, export or delete collection and list data from the in-app tools, and delete your account from account settings. Account deletion is permanent. You can also email support@lootstack.app to ask for access, correction, or deletion. European users have GDPR rights including access, rectification, erasure, restriction, and portability.

Do not send passwords by email. Lootstack staff will never ask for your password. Enable two-factor authentication in Clerk when it is available on your account.