ManaVault Privacy Policy


This privacy policy explains what personal data is processed when you use the ManaVault website (manavault.pl, "Website") and the ManaVault: TCG Toolbox mobile app for Android and iOS ("App"), together the "Service", and how it is used.

1. Administrator

The Service is administered by VILQ Grzegorz Wilczyński ("Administrator"), email: admin@manavault.pl.

2. Data processed on the Website

  • Account data: name and surname, email address, password (stored only in encrypted/hashed form), location (country/city, optional), language and selected game.
  • Collection data: cards you own, want or offer for trade, decks and related settings.
  • Plan and payment data: chosen plan and its validity. Card payments are handled by Stripe – the Administrator does not receive or store payment card numbers. Data needed for invoices (name, address, tax ID if provided) is processed in the invoicing service.
  • Messages sent through the contact form or by email.
  • Technical data: IP address, browser type and server logs, cookies (see section 6).

3. Data processed by the App

The App can be used without an account. In that case it sends to the ManaVault server only what is needed to answer your request:
  • search queries, and the text recognised from a card you scan,
  • device make and model, operating system version and App version,
  • App settings needed for the answer (game, currency, price source),
  • the IP address of the request (server logs).
These requests are logged on the server for statistics, error analysis and improving the Service.

Camera: the camera is used only to scan cards. The image is processed on your device; only the recognised text is sent. Photos are never uploaded or stored by the Administrator.

Pairing with an account: if you pair the App with your ManaVault account using a one-time code from your profile, the App receives an access token (stored in the device's secure storage; the server keeps only its hash) and your user ID, name and settings. Requests from a paired App are linked to your account, and the App shows and lets you manage your collection data described in section 2. You can unpair the App at any time in its Settings.

Stored only on your device: App settings, life counter state and player colours. They are not sent to the server.

The App contains no advertising and no third-party analytics or tracking tools. Links to Cardmarket, TCGplayer and manavault.pl open in a browser; those sites have their own privacy policies.

4. Purposes and legal bases

  • providing the Service, the account, collection management and paid plans – performance of a contract (Art. 6(1)(b) GDPR),
  • issuing invoices and keeping accounting records – legal obligation (Art. 6(1)(c) GDPR),
  • security, preventing abuse, error analysis, statistics and improving the Service, replying to messages – the Administrator's legitimate interest (Art. 6(1)(f) GDPR),
  • analytics cookies on the Website – your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

5. Recipients

Personal data is not sold. It may be processed on behalf of the Administrator by: the hosting provider, Stripe (payments), the invoicing service provider and Google (Google Analytics on the Website, only with consent). Some of these providers may process data outside the European Economic Area; in that case transfers are based on the safeguards required by GDPR (e.g. standard contractual clauses).

6. Cookies

The Website uses cookies needed for it to work (e.g. keeping you signed in) and, with your consent, analytics cookies. You can change your choice in the cookie banner or in your browser settings. The App does not use cookies.

7. Retention

Account and collection data is kept until the account is deleted. App and Website logs are kept as long as needed for statistics and security, then deleted or anonymised. Invoices are kept for the period required by tax law.

8. Your rights

You have the right to access your data, rectify it, delete it, restrict its processing, port it, and to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time. You can delete your account in your profile on manavault.pl or by writing to admin@manavault.pl. You also have the right to lodge a complaint with the supervisory authority – in Poland the President of the Personal Data Protection Office (Prezes UODO).

9. Children

The Service is not directed at children under 16.

10. Data protection

The Administrator uses appropriate technical and organisational measures to protect personal data against loss, unauthorised access, disclosure, alteration or destruction. Connections to the Service are encrypted (HTTPS).

11. Changes

This policy may be updated. The current version is always available on this page; registered users will be informed about significant changes by email.

Contact

Administrator: VILQ Grzegorz Wilczyński
Email address: admin@manavault.pl

Last updated: October 30, 2026

This privacy policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, GDPR).