Legal information

Privacy Policy

Last updated: November 5, 2026

1. Controller

TechRevo GmbH only receives correspondence on behalf of the controller. It is not the operator or controller of EDH Lens merely by providing this address.

2. Website delivery and server logs

When EDH Lens is accessed, the hosting provider processes connection data that is technically required to deliver the service. This may include the IP address, date and time, requested URL, HTTP status, transferred data volume, referrer, browser, and operating-system information. The processing is used to deliver the service, maintain stability, diagnose errors, and prevent misuse.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure and reliable operation of the service. Render makes application logs available for up to seven days on the current Hobby workspace plan. EDH Lens does not maintain a separate request-log archive. Data may be retained longer where a specific security investigation or legal obligation requires it.

3. Hosting

The service is hosted by Render Services, Inc. Render processes connection and usage data to provide and secure the service. Even where a European server region is selected, processing by a US company or its subprocessors may occur. The data processing agreement and its safeguards, including EU Standard Contractual Clauses where applicable, govern processing and international transfers.

Further information is available in Render's Privacy Policy and Data Processing Addendum.

4. Local browser storage

EDH Lens does not currently set analytics or advertising cookies. The app uses the browser's LocalStorage to retain user-requested settings, including favourite categories, user-created categories, and the navigation-panel width. These values generally remain until changed in the app or deleted through browser controls.

This local storage is necessary to provide the requested personalisation features. It is used under Section 25(2)(2) TDDDG and, where the data is personal data, Article 6(1)(f) GDPR. It is not used for advertising or cross-site tracking.

5. Synchronisation of favourites and categories

To process favourites and virtual categories during a session, the browser sends those preferences to the EDH Lens API. A pseudonymous profile identifier is derived from them. The browser remains the durable source of the settings; the server retains only a limited number of short-lived profiles in memory, which are automatically evicted. No user account or persistent profile database is created.

6. Card images and external links

Card images are loaded directly from cards.scryfall.io. The operator of that service necessarily receives technical connection information such as the IP address and browser details. Selecting “Open in Scryfall” or “View card on Scryfall” also opens an external service. The legal basis for loading images needed for the catalogue is Article 6(1)(f) GDPR. The legitimate interest is the functional presentation of the card catalogue.

Further information is available in Scryfall's Privacy Policy.

7. Optional access protection

HTTP Basic Authentication may be enabled during a non-public test phase. Credentials are checked solely for access control and are not stored in a user profile database. A browser may retain credentials according to its own settings. The legal basis is Article 6(1)(f) GDPR, based on the legitimate interest in protecting a non-public test environment.

8. Recipients

Personal data is disclosed only to service providers technically required for hosting and delivery and to external providers whose resources are loaded or whose links are deliberately selected. EDH Lens does not currently disclose personal data for independent advertising purposes.

9. Data-subject rights

Subject to the applicable legal requirements, users have rights including:

• access under Article 15 GDPR,
• rectification under Article 16 GDPR,
• erasure under Article 17 GDPR,
• restriction of processing under Article 18 GDPR,
• data portability under Article 20 GDPR, and
• objection under Article 21 GDPR.

Requests may be sent to the privacy contact above. Users may also lodge a complaint with a data-protection supervisory authority. The supervisory authority responsible for the controller is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).

10. Automated decision-making

EDH Lens does not carry out automated decision-making within the meaning of Article 22 GDPR or personal profiling.

11. Changes to this policy

This policy will be updated when the service's features, providers, or legal requirements change. The current version is always available on this page.