Effective date: April 24, 2026. Last updated: April 24, 2026.
This policy covers the Spell State web app, our public websites (such as spellstate.com), and any native mobile app we release that connects to the same service. We collect what we need to run sessions and optional accounts. We do not sell personal data to data brokers. We use hosting and email vendors to operate the product.
Spell State, operated by Future Design 3D ("we," "our," or "us"), explains here how we handle information when you use our websites, web application, APIs, and any future Spell State mobile application that shares the same accounts and backend.
Email address: Used for login, password reset, and important account messages.
Password: Stored as a cryptographic hash (for example bcrypt). We do not store plaintext passwords.
Display name: Shown where the product displays your label to you or to others, depending on the feature.
Game statistics and history: When you are signed in, gameplay outcomes and related stats may be linked to your account for profile and history features.
Our marketing site may let you open the same sign-in flow as the web app. If you sign in there, your browser stores session tokens (for example in localStorage) the same way as on the app domain, and your browser sends those tokens to our servers when you use account features. We process that data under this policy and our Terms of Service.
We may assign a random identifier to your browser or device so you can rejoin recent games and so we can tie session state together. That identifier may be linked to your account when you sign in.
We store gameplay and session information you or the host enters, such as life totals, commander damage, poison, timers, round notes, player labels, and similar fields needed to run a live game.
If you use a QR join flow, the browser or app may request camera access only to read a QR code locally. We do not use your camera to record video for storage, and we do not upload camera frames for advertising.
If we ship a Spell State mobile app, we may also collect: app version, device type, operating system version, and limited diagnostic or crash information needed to keep the app stable. If we add optional push notifications, we would store a push token tied to your account or device only to deliver those notifications, and we would describe that in an update to this page before turning it on.
If the app is installed from Apple or Google app stores, those companies process certain technical and billing data under their own policies in addition to what we describe here.
Our servers may log standard data such as IP address, approximate time, request path, user agent string, and error codes. We use that for security, abuse prevention, debugging, and capacity planning.
We host the application and database on infrastructure provided by Railway (or successor providers we may use). Traffic to our app is served over HTTPS. Authentication may use signed tokens (for example JWTs) stored in your browser for convenience, in addition to password hashing on our side.
Game sessions that are not tied to a long-term account feature may be removed after inactivity, on a schedule that can change as we tune the product. Short-lived identifiers and anonymous session cleanup may run automatically (for example within roughly twenty-four hours for some guest paths), but exact timing can vary by feature.
Account data is kept until you ask us to delete it or we delete it under our Terms. Some information may persist in encrypted backups for a limited window after deletion before it ages out.
We rely on vendors that process data on our behalf. Current categories include:
We do not allow these vendors to use your personal data for their own unrelated marketing.
The web app and marketing sign-in pages may store tokens or preferences in your browser (including localStorage or sessionStorage) so you stay signed in until you sign out or the token expires. We do not run third-party ad trackers on these pages today.
You may request access, correction, export, or deletion of personal data tied to your account by emailing [email protected]. We will verify reasonable ownership of the account before acting where we can.
If you live in the European Economic Area, the United Kingdom, or other regions with privacy laws, you may have additional rights (including to object or restrict certain processing, or to lodge a complaint with a regulator). We will respond within the timeframes required by law where they apply.
Our servers and vendors are primarily located in the United States. If you access the Services from another country, your information may be transferred to the United States and processed there, where privacy laws may differ from your home country.
We do not knowingly collect personal information from children under 13. If you believe a child under 13 provided personal data to us, contact [email protected] and we will take appropriate steps to delete it.
We may update this Privacy Policy from time to time. We will change the effective date at the top of this page when we do. For material changes, we may also send email notice or show an in-product message when we have a way to reach you.