Privacy policy
Applies to this website and the MTG League Castlefield Android app. Last updated 22 October 2026.
MTG League Castlefield is run by volunteers to organise our Magic: The Gathering play group. We collect as little as we can, we don't sell or share it, and there are no adverts or third-party trackers in the website or the app.
What we store
- Your account: username, email address, a securely hashed password (we can't read it), your role (player, organiser or admin), and when you joined and last signed in.
- League records: events you said you'd attend, check-ins, matches, results, standings and prizes. If you played as a guest, an organiser created that record under the username you gave them.
- Signed-in devices: for each app sign-in, a device name such as "Android app (Pixel 8)", when it was created and last used, and when it expires. We store only a fingerprint of the sign-in token, never the token itself.
- Security records: failed sign-in attempts (the username tried, IP address and browser or app identifier) so we can block password guessing. They are cleared when you next sign in successfully. Our hosting provider also keeps short-lived server logs.
- Organiser actions: an audit log of things organisers do, such as creating guests, assigning matches and changing results.
Why we use it
Only to run the league: to let you sign in, assign matches, work out standings, award prizes and send password-reset emails. Our lawful basis is our legitimate interest in running the league you joined, and your consent when you create an account.
Who can see it
- Your email address is never shown to other players and is never returned by the public API.
- Your username, results and prizes are visible to everyone by default. Turn off Public profile in your account settings (or the app's Account tab) and people who aren't signed in see you as "Private player". Signed-in league members can still see results, because they're part of everyone's standings.
- Organisers and admins can see what they need to run events. Admins can see account details.
- We use a hosting provider and an email provider to run the service. They process data on our behalf only.
The Android app
The app talks only to this website, over an encrypted connection. It stores your sign-in token on your phone, encrypted with a key held in Android's secure keystore, and excludes it from backups. It doesn't use your location, contacts, camera or advertising ID, and contains no analytics or ad libraries. Signing out removes the token from your phone and revokes it on our server.
How long we keep it
Account data is kept while your account exists. App sign-ins expire after 60 days. Guest claim codes expire after 90 days. When you delete your account, your username, email and password are removed; if you played matches, they stay in the standings under an anonymous name ("Former player") so other people's results still add up.
Your choices and rights
- Download all your data as a file, from the website or the app.
- Hide your profile from the public, revoke signed-in devices, or change your password at any time.
- Delete your account from the website or the app's Account tab. If you can't sign in, contact us and we'll delete it for you.
- You can ask us to correct your data or object to how we use it. In the UK you can also complain to the Information Commissioner's Office (ico.org.uk).
Children
The league is not aimed at children under 13 and we don't knowingly create accounts for them.
Contact
Email ReportDaSupport@EphyraGameDev.co.uk with any privacy question or request.
Changes
If we change this policy we'll update the date above and post an announcement on the site.