Privacy
This page explains how Cardboard's website features use information on cardboard.trading, mtg.cardboard.trading, and pokemon.cardboard.trading.
Privacy questions or requests: matthew@engmanager.xyz.
Browsing and matching cards
When you open a page, search the catalog, or submit filters, your browser sends the requested address and request information to Cardboard's hosting service. Search terms and filters can appear in page addresses. When you ask the deck builder to match a list, that list and your matching choices are sent to Cardboard to produce the result. Do not put personal or confidential information in a deck list or public page address.
Data saved in your browser
Guest Collections save collection names, chosen printings, finishes, and quantities in this browser using IndexedDB. Deck drafts use local storage. Interface preferences and a selected nearby place may also use local storage. A short-lived session-storage entry helps restore keyboard focus during set navigation.
These guest features do not create a Cardboard account or synchronize saved records between devices. Saved data is specific to the browser, profile, and site where you created it. Deleting site data, switching profiles, private browsing, or browser storage limits can remove it. You can remove Collections in the interface or clear the relevant site's data in your browser settings. Clearing site data also removes saved preferences and drafts; keep a separate copy of information you want to retain.
Saving a draft locally does not stop the deck builder from sending that list to Cardboard when you submit it for matching.
Optional Google Analytics
Google Analytics is off until you allow it in Analytics settings. You can reject it or change your choice there. The site does not load the Google analytics container before a saved opt-in.
If you allow analytics, Google receives page-visit and engagement information, including public page titles and addresses, referrer information, and browser, device, and network information. The page addresses Cardboard explicitly supplies to Google exclude query strings and fragments; search-page titles do not include your search terms. The integration disables Google signals and advertising-personalization settings. Google Analytics uses cookies.
The cardboard_analytics cookie remembers “allow” or “reject” for up to 180 days, when your browser permits it. It contains your choice rather than a visitor identifier and applies across the three Cardboard sites listed above. You can change the choice at any time. Rejecting analytics stops Cardboard's Google Analytics loading and attempts to remove its Google Analytics cookies; a page reload may occur to unload previously enabled Google code. If the browser cannot save a choice, the controls explain that limitation and Google remains off for a new unsaved opt-in.
Hosting and performance monitoring
Cardboard uses Cloudflare to deliver pages and assets and help operate and protect the service. Cloudflare processes connection and request information, which can include IP addresses, request addresses, and network information. Cardboard also uses Cloudflare performance monitoring to understand page loading and reliability.
Cloudflare's performance monitoring is separate from optional Google Analytics. Rejecting Google Analytics does not turn off Cloudflare's hosting, security, or performance services. See Cloudflare's Privacy Policy and Cloudflare Web Analytics.
Server-side request analytics
Cardboard uses Profound to understand crawler access and delivery of public pages. For eligible home and card-page requests, the server sends Profound the request time, hostname, method, public path, client IP address, User-Agent, referrer origin, response status, and estimated response size. This reporting can include ordinary browser visits as well as crawlers.
The Cardboard adapter does not send query strings, cookies, authorization headers, or request and response bodies in that report. Requests carrying an Authorization header and private, deck, and API paths are excluded from the adapter's reporting.
This is server-side reporting, separate from the Google Analytics choice, and it can operate when Google Analytics is rejected or JavaScript is disabled. See Profound's Privacy Policy.
Location and maps
Where nearby-shop features are available, using device location asks your browser for permission. Cardboard uses the coordinates in the browser to find nearby results. The shop-data requests identify surrounding two-degree areas rather than sending the exact device coordinates to Cardboard. Choosing a place can save that place in local storage until you change it or clear browser data.
An interactive map loads map tiles and fonts from OpenFreeMap. Map requests reveal the area being viewed and normal connection information to the map provider. The map and shop-data requests therefore should not be treated as anonymous location use. You can decline device-location permission or choose a place instead. Shop availability depends on published data; a preview is not a live directory.
External websites and email
Following a source, merchant, or other external link opens a separate service with its own privacy practices. Submitting a list or other information on a merchant's website shares it with that merchant.
If you email Cardboard, the message, your email address, and the information you include are handled to receive and respond to your request. Avoid sending information that is not needed for the request.
Your choices and questions
Use Analytics settings for the optional Google choice and your browser settings for location permission and saved site data. Contact matthew@engmanager.xyz about access, correction, deletion, retention, or another privacy question. Information held by service providers may require provider-specific steps. Deleting data in your browser does not itself delete records already received by those providers.