Privacy Policy

Last updated: 11/02/2026

Overview

Scrollrack is designed with privacy as a default. Your decks and favorites are stored in your own iCloud account and synchronised between your devices by Apple. We collect only minimal, anonymised analytics to improve the app.

Storage and iCloud

Your decks and favorites are stored in your own iCloud account using Apple's CloudKit and synchronised between your devices that use this iCloud account. Synchronisation is always on and cannot be switched off in the app. Apple's privacy policy and your iCloud settings govern how it is stored.

Analytics

Scrollrack collects anonymous usage analytics using a self-hosted instance of Aptabase. The metrics are sent to our own API at api.scrollrackapp.com. No data is shared with third parties. No personally identifiable information is ever stored or processed.

  • A cryptographic hash is derived from your device identifier. The original identifier cannot be reconstructed.
  • We record: app version, iOS version, locale, country (region-level only), and which features you use.
  • No IP addresses are stored.
  • No names, email addresses, or Apple IDs are collected.
  • Data is stored on servers in the European Union.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR). We use this to understand aggregate feature usage and prioritise development, with no impact on individual privacy.

Crash Reporting

If the app crashes, Apple may collect a crash report on your device and make it available to us. Crash reports contain a stack trace and basic device information (device model, iOS version, app version) but no personally identifiable information. Collection is controlled by your device's "Share Analytics" setting in iOS (Settings → Privacy & Security → Analytics & Improvements). Apple's privacy policy governs the transmission of these reports.

Card Data: Scryfall API and Scrollrack API

Card information (images, rulings) is fetched from the Scryfall API. Only the search terms or card identifiers you enter are transmitted; no personal data is sent. Scryfall's privacy policy applies to data processed by their service.

Set, precon and price data are delivered by our own API at api.scrollrackapp.com. The anonymised analytics described above are sent to the same API.

Data Retention & Your Rights

Because we do not store personal data, there is nothing to delete on our end. Analytics signals are retained for a limited period and then automatically purged. Under GDPR you have the right to access, rectification, erasure, and objection. To exercise these rights or with any privacy questions, contact:

[email protected]

California residents (CCPA): We do not sell personal information.

Children's Privacy

Scrollrack is not directed at children under 13 years of age. We do not knowingly collect any information from children.

Changes to This Policy

We may update this privacy policy from time to time. The "Last updated" date above reflects the most recent revision. Continued use of the app constitutes acceptance of the current policy.