Privacy Policy

This is a non-binding translation for convenience — the German version is legally authoritative.

Last updated: October 21, 2026

1. Controller

Responsible for data processing on this website is: Andreas Härtel, Rheinstrasse 2, 64319 Pfungstadt, Email: support@lumex-tcg.de

2. What data we process

Account & collection: When you register, we process your email address and a (hashed) password. After signing in, we process the collection, deck, and wishlist data you enter in order to provide you the service (Art. 6(1)(b) GDPR — contract performance). In addition, we store in your account the language in which you use Lumex (German or English), in order to send emails that you trigger through Lumex (for example confirmation, code and password emails) in that language (Art. 6(1)(b) GDPR — contract performance).

Sign in with Google: If you sign in with your Google account, we receive your email address, name, and profile picture from Google to create or sign you into your Lumex account (Art. 6(1)(b) GDPR – contract performance). This data is not shared with third parties and is not used for any other purpose.

Deleting your account & confirmation code: When you delete your account, you confirm the deletion by signing in again: we send a one-time code to the email address of your account, which you enter on the deletion page on the web. For this we process your email address, the code, the time of the request and the technical connection data that arises in the process (including your IP address), solely to carry out the deletion and to protect your account from being deleted by someone else (Art. 6(1)(b) GDPR — ending the user relationship at your request; Art. 6(1)(f) GDPR — legitimate interest in protecting your account). The code is generated and checked by Supabase and sent via Resend (see Section 3); it is valid for a short time only. What the deletion does is described in Section 5.

Server logs: When you access the site, technically necessary data (IP address, timestamp, user agent) is processed by our hosting provider (Art. 6(1)(f) GDPR — legitimate interest in operation and security).

3. Processors / hosting

Vercel: The web app is hosted via Vercel. A data processing agreement is in place with Vercel.

Vercel Analytics & Speed Insights: In addition to hosting, we use Vercel Analytics and Speed Insights for anonymized, cookieless evaluation of page views and load times (Art. 6(1)(f) GDPR — legitimate interest in operating and improving the service). No cookies are set and no personal profiles are built.

Upstash: For rate limiting on certain API routes (including Archidekt import, MTGTop8 import, tournament calculator), we use Upstash Redis; your IP address is processed briefly to prevent abuse (Art. 6(1)(f) GDPR — legitimate interest in abuse prevention). A data processing agreement is in place with Upstash.

Supabase: Authentication and database run via Supabase (EU region, eu-west-1). Your collection and account data is stored there. Access is restricted to your own account via row-level security. If you delete your account, we remove your data from the database there immediately (for backups, see Section 5).

Resend: We use Resend (Plus Five Five, Inc., USA) to send emails that you trigger through Lumex (for example registration and password emails, and the confirmation code for deleting your account). This processes your email address, the content of the message (for example the code) and sending logs (Art. 6(1)(b) GDPR — providing the service). Resend also processes data in the US; based on our current assessment, the transfer relies on Resend's certification under the EU-US Data Privacy Framework, alternatively on EU standard contractual clauses. For the retention of sending logs, see Section 5.

Sentry: We use Sentry (EU region) for error tracking; this processes error reports including your IP address and device/browser information (Art. 6(1)(f) GDPR — legitimate interest in reliable, error-free operation). No recording of user interactions (session replay) takes place. A data processing agreement is in place with Sentry. We do not send Sentry an account identifier (no user context); for retention, see Section 5.

Firebase (Google): We use Firebase Cloud Messaging (FCM) from Google to send push notifications. A data processing agreement is in place with Google (Firebase Data Processing Terms); see Section 9 for details on the processing and the transfer to the US.

4. Cookies

We use exclusively technically necessary cookies: to manage your login session and, if you change the language in the settings, to remember that language. There is no tracking and no third-party advertising on this website.

5. Retention period

Your account data and collection contents are stored until you delete your account; how that works and what remains afterwards is described below. In addition, chat messages (see Section 10) and reports (see Section 12) are deleted automatically 12 months after they were created. For retention on the Discord server, see Section 14.

Deleting your account: You can delete your account yourself at any time: on the web (way: see Section 6). The deletion takes effect immediately and is final; we do not restore a deleted account. What is deleted is your account and the data linked to it, including collection, decks, wishlists, folders and tags, trade offers and matches, friendships, chats, ratings, share links and your device token for push notifications. Chats, friendships, trade offers and ratings also disappear for the other people involved; share links become invalid immediately.

Dealer accounts (Lumex Pro): If you are the owner of a dealer account and alone in it (no other team members and no running subscription), the dealer account is deleted together with the dealer data and the stored eBay connection; listings already published on eBay stay on eBay. If you have team members or a running subscription, you can delete your account only once the members have been removed or the subscription has ended; if you have questions, write to support@lumex-tcg.de. If you are only a member of another dealer's team, only your membership is removed; the team's data stays with the team.

After the deletion, the following remains for a limited time or with third parties:

Backups: Copies of our database (encrypted, used only to recover from an outage, not to restore individual accounts) still contain your account for up to 30 days and then expire automatically (Art. 6(1)(f) GDPR in conjunction with Art. 32 GDPR — legitimate interest in resilience against outages). Since 16 October 2026, our own nightly backups no longer include the tables with MTGTop8 tournament data (player names) or the Archidekt cache; older backups may still contain this data until their retention period ends. The nightly backup artifact is kept for up to 30 days. In addition, our database provider (Supabase) keeps its own daily backups for 7 days.

Deletion log: So that restoring a backup does not bring your deleted account back, we record every deletion in a log: random account ID, time and channel of the deletion (app, web or support), without name, email address or IP address. The entry is deleted after 35 days (Art. 6(1)(c) GDPR in conjunction with Art. 17 GDPR — we must enforce your deletion even after a backup is restored).

Logs at service providers: Error reports (Sentry), server and access logs (Vercel, Supabase) and sending logs (Resend) stay stored for as long as the respective provider's retention rules provide (see Section 3); deleting your account does not trigger a separate deletion there.

Accounts with third parties: Your Google account (even if you used it to sign in to Lumex) and your Discord account are held by Google and Discord respectively and are not affected by deleting your Lumex account (for Discord, see Section 14).

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection (Art. 15–21 GDPR), as well as the right to lodge a complaint with a supervisory authority. Contact support@lumex-tcg.de for this. You can also delete your account yourself (see below).

Triggering the deletion yourself: You can exercise your right to erasure (Art. 17 GDPR) fastest yourself, without a request to us: on the web at lumex-tcg.de/en/delete-account (German version: lumex-tcg.de/konto-loeschen). The deletion takes place immediately; what it covers and what remains afterwards is described in Section 5.

Deletion via support: If you cannot sign in or can no longer receive a code (for example because you have no access to the mailbox of your account), write to support@lumex-tcg.de. We then check that the request comes from you (Art. 12(6) GDPR): the simplest way is to reply from the email address stored in your account; otherwise we compare details about your account that only you can know, such as the period of registration and the sign-in method. We use these details only for the check. We handle your request without undue delay and at the latest within one month of receipt (Art. 12(3) GDPR). If we cannot sufficiently confirm your identity, we do not delete the account, because otherwise someone could have another person's account deleted; we will tell you, and you keep the right to lodge a complaint with a supervisory authority or to seek a judicial remedy.

7. External card and deck content

Card images are loaded from third-party providers (including Scryfall CDN, pokemontcg.io). In the web version, Archidekt search results also load the cover image that Archidekt has stored for the deck, directly from its image servers (card-images.archidekt.com and storage.googleapis.com, a storage service of Google). Your IP address may be transmitted to these providers in the process (Art. 6(1)(f) GDPR).

Meta decks and link import (mtgtop8.com): When you open a tournament deck from the meta decks in the app or import an mtgtop8 link, the app fetches the decklist directly from mtgtop8.com. In doing so, your IP address is transmitted to the operator of mtgtop8.com (Art. 6(1)(f) GDPR — legitimate interest in providing this feature). The app keeps the retrieved card list in memory only. It is stored permanently only if you take over the deck or confirm the import: the app then creates your own deck in your collection, on your device and, if you are signed in with an account, also in your account with Supabase via synchronization (see Sections 3 and 5). For a link import, the app also stores the link to the source with the deck and, if mtgtop8.com names an author, the author's name. When you import in the web version, our server fetches the deck page from mtgtop8.com instead; your IP address is not transmitted to mtgtop8.com in that case but is processed briefly for rate limiting (see Section 3, Upstash). The retrieved page is kept for up to seven days in the cache of our hosting provider (Vercel) so that mtgtop8.com is not burdened unnecessarily; a deck of your own is created there only if you confirm the import.

Tournament data in the meta decks (mtgtop8.com): The meta decks show selected tournament decks from mtgtop8.com. For this, we store in our database (Supabase, EU region) the deck name, the player name as published on mtgtop8.com (this may be a real name or a pseudonym), the tournament, the date, the placement and the link to the source. These details come from mtgtop8.com and are publicly viewable there. The deck name, tournament, date, placement and link to the source can be read on our side without signing in and are shown in the meta decks. In the meta decks, we show the player name only to signed-in users of the web version; it is not visible in the public demo, in the meta decks of the app, or when our database interface is queried without signing in. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in offering tournament decks with source attribution). We keep the details until a new import replaces them. The import usually runs once a month; with every run we replace the entries of the tournament formats it covers with the newly selected ones, and the older entries of those formats are deleted in the process. Entries that no new import has replaced are deleted after twelve months at the latest. If you are named as a player and do not want your name shown, write to support@lumex-tcg.de; you can object to the processing under Art. 21 GDPR (see also Section 6). We will then delete the entries in which you are named as a player.

Link import and retrieval of Archidekt decks (archidekt.com): When you import an Archidekt link in the app, the app fetches the decklist directly from archidekt.com. In doing so, your IP address is transmitted to the operator of Archidekt (Art. 6(1)(f) GDPR — legitimate interest in providing this feature). The app keeps the retrieved card list in memory only. It is stored permanently only if you confirm the import: the app then creates your own deck in your collection, on your device and, if you are signed in with an account, also in your account with Supabase via synchronization (see Sections 3 and 5). The app also stores the link to the source with the deck and, if Archidekt names a creator, the creator's username. When you open an Archidekt deck from the meta decks in the app, the app does not ask Archidekt for the decklist but a function of our database provider Supabase; your IP address goes to Supabase (see Section 3), not to Archidekt. That function fetches the decklist from Archidekt and places the response (deck name, format, view count, description and card list of the deck, and the creator's username as published on Archidekt) in a cache in our database (Supabase, EU region) so that repeated requests do not load Archidekt again. The cache does not belong to any user and is accessible only to us. The response counts as current for about 60 minutes. Entries older than 7 days are deleted automatically in a weekly run, so an entry is deleted after 14 days at the latest (for backup copies see Section 5). In the web version, our server fetches Archidekt instead when you are signed in and search, open or import Archidekt decks; your IP address is not transmitted to Archidekt in that case but is processed briefly for rate limiting (see Section 3, Upstash). The response there also counts as current for up to 60 minutes and is held in the cache of our hosting provider (Vercel); in the web version, a deck of your own is created only if you confirm the import. If you click a link to a deck on Archidekt in Lumex, Archidekt's page opens; from then on, Archidekt's privacy policy applies.

Meta decks from Archidekt (archidekt.com): The meta decks show selected decks from Archidekt. For this, we store in our database (Supabase, EU region) the deck name, the creator's username as published on Archidekt (this may be a pseudonym or a real name), further deck details such as format, view count and date, and the link to the source. We do not take over other details about the creator, such as a profile picture. These details come from Archidekt and are publicly viewable there. On our side they can be read without signing in and are shown in the meta decks, in the web version (including the public demo) and in the app, each with the creator's name and a link to the deck on Archidekt. Signed-in users of the web version also see current decks straight from the Archidekt search and, when importing, the deck they chose, again with the creator's name; for this display we do not store the name in our database (for the cache see the previous paragraph). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in offering popular decks with credit to their creators and source attribution). We keep the details stored in our database for as long as we offer this selection in the meta decks; if we discontinue it or replace it with a different data set, we delete the details we no longer need. If you are named as a creator and do not want your username shown, write to support@lumex-tcg.de; you can object to the processing under Art. 21 GDPR (see also Section 6).

8. External content in the app (news feed)

The news feed in the Lumex app primarily fetches RSS feeds via the third-party service rss2json.com as a JSON proxy, to work around Cloudflare/CORS restrictions on direct RSS fetches from mobile devices (only if that fails does it fall back to a direct RSS/Atom fetch). In doing so, the fetched feed URL and your IP address are transmitted to rss2json.com (Art. 6(1)(f) GDPR — legitimate interest in a reliable news feed).

9. Push notifications

If you allow push notifications, we process a device token generated by Firebase Cloud Messaging (FCM) (token, platform Android/iOS, timestamp), which we associate with your account to deliver you two types of notifications (Art. 6(1)(b) GDPR — providing the feature you activated):

Wishlist price alert: The notification contains the card name and current price in plain text (for example, “Lightning Bolt is now available for €2.50”) — visible only to you as the recipient, but technically transmitted to Google.

New chat message: The notification only names the alias of the person writing to you (for example, “New message from Lightning_Trader”); when you write, the other person sees your alias in the same way. The message text itself is not transmitted to Google.

Lock screen: If your device shows notification content on the lock screen, that also shows the card name and price of a price alert, or the alias of your chat partner, in plain text — visible to anyone holding your locked device, even without unlocking it. Lumex does not control this visibility itself; whether and how much notification content your lock screen shows is a setting in your device's notification settings (depending on the manufacturer, often under “sensitive/private notifications” or “lock screen content”).

Delivery runs via Firebase Cloud Messaging, operated by Google Ireland Limited; processing may also be carried out by Google LLC (USA) as a sub-processor. A data processing agreement is in place with Google (Firebase Data Processing Terms). Based on our current assessment, the transfer to the US relies on Google's self-certification under the EU-US Data Privacy Framework, alternatively on EU standard contractual clauses. You can disable push notifications at any time via your device permissions, and per conversation via muting. If you delete your account, your device token is deleted on our side; afterwards we no longer send you notifications.

10. Messages between users (chat)

If you chat with a confirmed friend, we process the message text, timestamps (sent/delivered/read), an optional reference to a message being replied to, and, where applicable, an automatically attached reference to the trading context (offer/match/card) through which you found each other, in order to provide you the chat feature (Art. 6(1)(b) GDPR).

The chat is available from the age of 13.

The chat is subject to our chat rules. Read the chat rules

“Delivered” means the other side's app or web version has technically retrieved the message — not that it has been displayed or read. “Read” is only set once the other side opens the conversation.

End-to-end encryption is not used; messages are encrypted in transit like your other account data, but are stored in plain text in our database at Supabase (see Section 3).

Only you and your respective conversation partner can view a conversation; we do not routinely access its contents, except when reviewing a report (Section 12) or where required by law.

Retention: Each message is automatically deleted 12 months after it was sent (weekly cleanup run). A message also disappears as soon as both of you have deleted the conversation for yourselves; a conversation with no remaining messages is removed as well.

If the friendship ends, the existing history remains readable, but you can no longer send new messages.

If you delete your account, all messages you sent and received are permanently removed — this also affects your conversation partners' history.

11. Friends, trade offers, ratings, and share links

For the trading and community features, we additionally process:

Friends: We process friend requests and their status (pending/confirmed/declined/blocked/removed) as well as, if you send a request from within a trade offer, an optional note to the other person (Art. 6(1)(b) GDPR).

Trade offers & matches: We process which of your collection cards you mark as tradeable, as well as an automatic match against other users' wishlists (Art. 6(1)(b) GDPR). The result is a plain suggestion list with no legal or similarly significant effect on you — not an automated individual decision within the meaning of Art. 22 GDPR.

Trading profile: You can set a freely chosen alias instead of your real name, and optionally a postal code/city for local search (Art. 6(1)(b) GDPR — voluntary information for this additional feature). Your city is never shared with other users; your postal code is shown to others only shortened to its first three digits (for example, “641xx”).

Ratings: After a completed trade, you can rate each other (positive/neutral/negative, optional comment; Art. 6(1)(b) GDPR for submitting it). For fairness, a rating only becomes visible once both sides have rated, or automatically after 30 days at the latest. A rating is visible to all users with their own trading profile, not just to friends (Art. 6(1)(f) GDPR — legitimate interest in a working trust system for all trading participants, comparable to ratings on Cardmarket/eBay).

Share links: You can generate a link for your trade list, wishlist, or an individual deck (Art. 6(1)(b) GDPR). Anyone who knows the link can view the shared content — for the trade list, this includes your alias and requires a prior login; for the wishlist and deck, no login and no name are required, only the card/deck contents. A link remains valid until you revoke it via “Create new link”; the old link is invalidated immediately afterward.

Retention: Friendships, trade offers, matches, and ratings remain in place until you remove them yourself, and are deleted at the latest when your account is deleted.

12. Reporting and blocking

If you report a conversation, we process your user ID, the ID of the reported person, the affected chat, and your reason (Art. 6(1)(f) GDPR — legitimate interest in a safe environment free of abuse). Reports are visible exclusively to us as the operator — not to the reported person, and not retroactively to you either. We use reports for manual review of abuse cases; no automated suspension takes place. Reports are automatically deleted 12 months after they are created. If the reporting or the reported person deletes their account, the report is deleted as well.

You can also block other users: a blocked person can no longer send you friend requests or messages; only you can undo the block (Art. 6(1)(b)/(f) GDPR).

13. Beta tests

If you submit a test plan via /beta, we process the name or alias you provide, the version and kind of test plan (full/delta), and your input per test case — checked or not, with an optional comment. This runs without an account and without any link to an existing Lumex account (Art. 6(1)(f) GDPR — legitimate interest in structured beta feedback ahead of a release).

The public results page for a test plan version shows only how often each test case was checked overall (for example, “7/9”). Your name or alias and your comments never appear there — they remain visible to the Lumex team only.

Retention: Each submission is deleted completely 12 months after it was made (weekly cleanup run) — not just the name, but the entire row including all test case results. The corresponding counts on the results page disappear accordingly.

14. Discord community

In the footer, we link to our Discord community. This is a plain link, not an embedded Discord widget — simply visiting our site does not transmit any data to Discord as a result. Its purpose is exchange with other Lumex users and an additional, voluntary support channel (Art. 6(1)(f) GDPR — legitimate interest in community-building and low-threshold support). Whether you click the link, follow the invite, and use a Discord account is entirely your choice; only then does data processing by Discord begin.

When you join our Discord server, we process the following as the server operator, in addition to the processing carried out by Discord itself (see below):

Username and posts: Your Discord username (possibly with display name and profile picture) and your posts (text, images, attachments, reactions) are visible to us and, depending on the channel, to other members. We use them to run the community, answer questions, and provide support. Please do not post credentials or anything you do not want to share publicly: posts in a channel can be read, copied, and redistributed by all members of that channel, and we have no influence over that.

Moderation: To enforce the server rules and protect the community, we remove posts and may warn, mute, or remove members from the server. In doing so we process the data of the affected members and posts (username, post content) to the extent necessary for the respective measure.

Legal basis and voluntary participation: Our processing is based on Art. 6(1)(f) GDPR — legitimate interest in a functioning, safe, rule-abiding community and in low-threshold support. Joining the Discord server is voluntary and not required to use Lumex; you can still get support by email at support@lumex-tcg.de.

Retention: We store the data we process only for as long as necessary for the respective purpose. Your posts stay on the server until you delete them yourself or we remove them as part of moderation; on request to support@lumex-tcg.de we remove posts of yours where technically possible. If you leave the server or delete your Discord account, further storage of your data at Discord is governed by Discord's own rules; posts you have already published may remain visible on the server until they are deleted.

For users in the EEA, Discord Netherlands B.V. (Amsterdam) is the controller under data protection law; however, processing is also carried out by Discord Inc. (USA), i.e. outside the EU. According to Discord's own statements, this transfer relies on EU standard contractual clauses as well as a self-certification under the EU-US Data Privacy Framework. According to Discord's privacy policy, Discord processes your data as its own controller: we have not concluded a data processing agreement or a joint controllership arrangement with Discord, and we have no influence over the nature, scope, or purpose of Discord's processing. Discord's own privacy policy governs your use of Discord.

You can find Discord's privacy policy at https://discord.com/privacy. It also explains how to exercise your rights towards Discord.

Minimum age: Use of Discord is subject to Discord's terms of service, which require a minimum age of 13 or the higher minimum age applicable in your country; if you do not meet this requirement, you may not use Discord under those terms. We do not verify the age of our members; if we learn that someone does not meet the minimum age, we remove that member from the server. Parents and guardians can reach us at any time at support@lumex-tcg.de.

You can exercise the rights described in Section 6 (access, rectification, erasure, restriction, data portability, objection) against us for the data we process: support@lumex-tcg.de. Because our processing is based on a legitimate interest, you may object to it at any time on grounds relating to your particular situation (Art. 21 GDPR). For processing by Discord, please contact Discord (see its privacy policy).