1. Who runs this
Openhand is operated by an individual based in the United States. You can reach us at openhandtcg@gmail.com with any privacy-related questions.
2. What we collect and why
| Data | Why we collect it | How long we keep it |
|---|---|---|
| Email address | To create and manage your account, send confirmation and password reset emails | Until you delete your account |
| Deck data (card lists you build and save) | To save your decks to the cloud so you can access them across devices | Until you delete the deck or your account |
| AI prompts (if you use the Strategy tab) | Sent to Anthropic's Claude API to generate a response. Not stored by us. | Not retained by Openhand |
We do not collect your name, phone number, location, payment card details, or any sensitive personal information. We do not run advertising or sell data to third parties.
3. Third-party services
Openhand uses the following services to operate. Each has its own privacy policy.
| Service | What it does |
|---|---|
| Supabase | Stores your email address, login session, and deck data in a US-hosted Postgres database |
| Netlify | Hosts the app and serverless functions; may log basic request metadata (IP, timestamp) |
| Resend | Sends transactional emails (account confirmation, password resets) |
| pokemontcg.io | Card image and data API — read-only, no personal data is sent to this service |
| Anthropic (Claude API) | Powers AI features. Prompts you submit may be processed under Anthropic's terms. |
| TCGPlayer / Impact.com | Affiliate links for card purchases. Clicking a link may place a cookie on your device per TCGPlayer's policy. No personal data from Openhand is shared with TCGPlayer. |
4. Cookies and local storage
Openhand uses browser localStorage to remember decks you have built while not logged in (guest mode). This data stays on your device and is not transmitted to our servers unless you choose to save an account.
We do not use tracking cookies or analytics cookies. Third-party services (Supabase for session management, TCGPlayer for affiliate attribution) may set their own cookies as described in their policies.
5. Affiliate links
Openhand participates in the TCGPlayer affiliate program. When you click a buy link, it opens TCGPlayer in a new tab and may earn Openhand a small commission on eligible purchases. Affiliate links are clearly labeled. No personal data from your Openhand account is shared with TCGPlayer through these links.
6. Your rights
You can:
- Delete your account and data — email us at openhandtcg@gmail.com and we will delete your account and associated deck data within 30 days.
- Request a copy of your data — email us and we will provide your stored deck data in a readable format.
- Correct your email address — update it in your account settings once that feature ships, or contact us.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we have collected and the right to request deletion. We do not sell personal information. To exercise your rights, contact us at openhandtcg@gmail.com.
7. Data security
Your data is stored in Supabase with row-level security enabled, meaning your decks are only accessible to your account. Connections use HTTPS. We are a small operation and cannot guarantee absolute security, but we take reasonable precautions.
8. Children
Openhand is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has created an account, please contact us and we will delete it promptly.
9. Changes to this policy
If we make material changes to how we handle your data, we will update the "Last updated" date at the top of this page. For significant changes, we will send a notice to your account email if you have one.