Log inDiscordSupport

Legal

Privacy Policy

Last updated: 6 September 2026

This Privacy Policy explains how The Magma Chamber (“we”, “us”, “the Site”) processes personal data when you visit or use magmachamber-related deployments of this fan community hub for non-standard Riftbound formats.

We aim to comply with the EU General Data Protection Regulation (GDPR) and related EU/EEA privacy rules. This notice is informational and not legal advice.

1. Controller

The Magma Chamber is operated as a community project. There is no separate company or postal address yet. For privacy requests, including access or deletion, use the Contact page (Discord or Metafy, and email if one is published there). If a formal legal entity or postal address is later designated, this page will be updated.

2. Google sign-in (Google OAuth)

If you choose Sign in with Google, Google authenticates you and shares profile information with The Magma Chamber through our auth provider (Supabase Auth). We specifically receive:

  • Email address — used to identify your account, send essential account-related notices if needed, and recover or verify access.
  • Name (display name from your Google account) — used to personalize your profile and show who owns decks, cubes, or other content you publish.
  • Profile picture (avatar URL from Google) — used to display your avatar on the Site where account identity is shown.

We use this Google data only to create and operate your The Magma Chamber account, keep you signed in, attribute content you create, and secure the service. We do not sell your Google data, use it for advertising, or share it with third parties except as processors needed to run auth/hosting (see Processors below) or when required by law.

Google’s own processing is governed by Google’s Privacy Policy. You can review or revoke The Magma Chamber’s access to your Google Account under Google Account → Security → Third-party access (wording may vary by region).

3. Discord sign-in

If you choose Sign in with Discord, Discord may share identifiers and profile fields (such as Discord user id, username, email if permitted, and avatar) through Supabase Auth. We use those fields the same way as Google profile data: to create your account, keep you signed in, and attribute your content.

4. Other data we process

  • Account data you set on The Magma Chamber: the username you claim and related profile settings.
  • Content you create: decklists, cubes, drafts, and similar user-generated content you choose to save or publish.
  • Local device storage: drafts and preferences stored in your browser (for example local cubes/teams and cookie consent choice). This stays on your device unless/until you sync to an account.
  • Usage analytics (optional): if you accept analytics, Vercel Web Analytics may process page views and related usage metrics. Vercel’s analytics product is designed to be cookieless and uses privacy-oriented hashing; it may still involve processing that can be personal data under GDPR.
  • Consent choice: a record in your browser (localStorage) of whether you allowed analytics and/or advertising. This is necessary to remember and honour your choice.
  • Advertising (Google AdSense): only if you opt in. Until then we do not load Google ad code. After consent, Google may process device identifiers, IP address, cookie data, and browsing activity to serve, measure, and personalize ads. Google’s processing is described in Google’s Privacy Policy and How Google uses information from sites that use our services.
  • Technical logs: standard hosting/security logs from our providers (for example Vercel) that may include IP address, user agent, and request metadata for security and reliability.

5. Purposes and legal bases

  • Provide the Site and accounts (including Google / Discord login) — contract / steps prior to contract (Art. 6(1)(b) GDPR).
  • Security, fraud prevention, abuse handling — legitimate interests (Art. 6(1)(f)).
  • Optional analytics — consent (Art. 6(1)(a)). You can withdraw consent anytime via Privacy settings in the footer.
  • Advertising — consent (Art. 6(1)(a) GDPR and ePrivacy rules for advertising cookies). Ads and AdSense cookies do not load unless you opt in. You can withdraw anytime via Privacy settings in the footer, and you can also use Google Ad Settings.
  • Legal obligations — where we must retain or disclose data (Art. 6(1)(c)).

6. How to delete your account

You can request deletion of your The Magma Chamber account at any time. To delete your account and associated personal data:

  1. Use the Contact page and write from the same identity you use on the Site (or include your account email / username).
  2. Clearly ask to delete your account.

When we process a verified deletion request, we will:

  • delete your auth account and profile data stored for The Magma Chamber, including Google- or Discord-provided email, name, and profile picture references we hold;
  • delete or anonymize content tied to your account where feasible (published lists may be removed or detached from your identity);
  • retain only what we must keep briefly for security, fraud prevention, or legal compliance, then delete it when no longer required.

Deleting your The Magma Chamber account does not automatically delete your Google or Discord accounts. You may also revoke the Site’s OAuth access in your Google or Discord security settings.

You can clear local browser drafts yourself via your browser’s site data / storage settings.

7. Cookies and similar technologies

See the dedicated Cookie Policy. Essential storage may be required for authentication and remembering your consent choice. Analytics and advertising each need their own opt-in. We send Google Consent Mode defaults of “denied” until you choose, and we do not load AdSense unless you accept advertising.

8. Processors / recipients

  • Vercel — hosting, edge delivery, and (if consented) Web Analytics.
  • Supabase — authentication and database when The Magma Chamber auth is configured (EU Frankfurt region intended).
  • Google — if you use Google sign-in (identity provider), and Google AdSense only after you opt in to advertising.
  • Discord — if you use Discord sign-in (identity provider).

Some providers may process data in the United States or other countries outside the EEA. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses offered by those providers.

9. Retention

Account and published content are kept while your account remains active and as needed to operate the Site, or until you request deletion. Local drafts remain until you clear site data. Analytics aggregates follow Vercel’s retention practices. Logs are kept only as long as needed for security and operations.

10. Your rights (EEA/UK)

Subject to applicable law, you may have rights to:

  • access, rectify, or erase your personal data;
  • restrict or object to certain processing;
  • data portability;
  • withdraw consent at any time (without affecting prior lawful processing);
  • lodge a complaint with your local supervisory authority.

To exercise rights (including erasure / account deletion), use the Contact page and describe your request. We may need to verify your identity. You can withdraw analytics or advertising consent in the footer without contacting us.

11. Children

The Site is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child provided personal data, use the Contact page so we can delete it. Personalized ads are not intended for child-directed sections; this Site is a general-audience community hub.

12. Riot / third-party brands

Riftbound and related marks belong to Riot Games, Inc. Card data and imagery may come from community/catalog sources and Riot-hosted assets. Those parties have their own privacy practices.

13. Changes

We may update this policy. The “Last updated” date at the top will change when we do. Material changes may also be highlighted on the Site.

Related: About · Contact · Terms of Service · Cookie Policy · Disclaimer