Pauperizer keeps the records of a local Magic: the Gathering Pauper league. This page says what it stores about you, why, and what you can do about it.
Who is responsible
The league organiser who runs this site is the data controller for everything described here. Write to privacy@pauperize.me about anything on this page and you will get an answer.
What is stored, and why
Your account holds your name, your email address, your password as an Argon2 hash that cannot be turned back into the password you chose, your role in the league, and the moment you accepted the terms. This exists so the league has members who can log in and enter results. The legal basis is legitimate interest: running a members' league requires knowing who the members are. Without a name and an email address there is no account, so providing them is a condition of having one.
League results hold the league and its date, your finishing rank, your wins, losses and draws, the deck you played, and who entered the result. These are the league record and they are public. The legal basis is again legitimate interest: a league that keeps no public record is not a league.
A public display name is stored only if you set one, together with the moment you consented to it being published. The legal basis for that is your consent, and nothing else.
Sessions and invites are random tokens tied to your account, stored so that logging in works and an invite link can be used once. The legal basis is legitimate interest in keeping accounts secure.
How your name appears
By default you appear as your first name and the initial of your surname: "Jan Kowalski" appears as "Jan K". Your full name is never published. If you consented to a public display name, that name is shown instead. Withdraw that consent at any time and the name reverts to first name and initial; withdrawing does not make the earlier publication unlawful, but it stops any further use.
Where it goes
The site runs on a server rented from Hetzner Online GmbH, a German company, on hardware in the European Union; Hetzner processes the data only as our hosting provider. Database backups are copied to a Nextcloud instance run by the organiser. Nothing we hold about you is stored or processed outside the European Economic Area, and nothing is sold, rented, or shared for advertising.
League standings, including names in the form described above, are sometimes posted to the league's own chat and social channels. Anything posted there is subject to that platform's own terms, and once a standing has been posted it cannot be recalled from it.
Card pictures — the ones on the front page and the one beside the log-in form — are loaded by your browser from Scryfall directly rather than from this site. Scryfall therefore sees those requests: your IP address, your browser's user agent, and which images were asked for. Nothing about your account or your league record is sent with them. What Scryfall does with those requests is covered by their privacy policy.
The same is true of a player picture, if one has been set: it is a link to wherever the picture already lives, loaded by your browser rather than stored here, so that host sees your IP address and user agent. Your browser is told not to pass on which page you were reading, so the host is not told whose profile you were looking at. A picture is shown only if that player consented to a public display name — the same consent, because a picture of you is at least as personal as your name.
Cookies
One cookie, set when you log in, holding a signed reference to your session and nothing else. It lasts 30 days and is removed when you log out. There is no analytics, no advertising, and no third-party tracking on this site, so there is nothing to consent to and no banner to dismiss.
How long it is kept
Sessions expire after 30 days and invite links after seven. Account details are kept while your account exists. League results are kept as the league's history: if your account is deleted the results remain, with your name reduced to a first name and initial, or removed entirely if you ask.
Your rights
Under the General Data Protection Regulation you can ask for a copy of what is stored about you, have it corrected, have it erased, have its use restricted while a dispute is resolved, receive it in a portable machine-readable form, and object to processing carried out on the basis of legitimate interest. Where processing rests on your consent — the public display name — you can withdraw that consent at any time, which stops future use without making past use unlawful.
Write to privacy@pauperize.me to use any of these. If you are not satisfied with the answer, you can complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland — or to the supervisory authority in the EEA country where you live.
No decisions here are made automatically: nothing on this site profiles you or decides anything about you without a person doing it.
Last updated: 12 September 2026