DeckMate (“we”, “us”) helps friends keep trip person-cards, draws, challenges, and shared moments. This policy explains what we store and why.
Who we are
DeckMate is operated as a small consumer web and mobile app. Contact: privacy@deckmate.io.
What we collect
- Account: email address (for sign-in codes) and the display name you choose.
- Trip content you create or share: trip names and covers, person cards (including photos you upload), challenges, invite codes, membership roles, and moments (text and optional photos).
- Technical: session tokens on your device, basic server logs needed to run the service, and — only if you accept analytics cookies — Google Analytics usage data (see below).
We do not sell your personal data.
Why we process it
- To provide the service (contract): sign-in, syncing trips between members, storing cards/photos/moments you choose to share inside a trip.
- Security and abuse prevention (legitimate interests): keeping accounts and private media protected.
- Optional analytics (consent): understanding aggregate product usage via Google Analytics when you tap “Accept analytics”.
Where data lives
Application data and private photos are hosted with our infrastructure providers (currently Supabase for database, authentication, and private storage; a cloud host for the DeckMate API/website; email delivery for one-time sign-in codes). Providers act as processors under their own terms and data-processing terms.
Photos are stored in a private bucket and are fetched only for people who are members of that trip.
Analytics cookies
If you accept analytics, we load Google Analytics 4 (measurement ID G-YZFY81SVD0). Google may process device and usage information as described in Google’s policies. You can reject analytics; the app still works. You can change your mind later from Account → Privacy & cookies.
Sharing inside DeckMate
Content you add to a trip is visible to other members of that trip according to their role. Invite links/codes let new people join a trip you share with them. Do not upload content you are not allowed to share.
Retention
We keep your account and trip data while your account is active. If you delete a trip, card, or moment, we remove the associated records and queue private photo files for deletion. Operational logs and cleanup receipts may be kept for a limited period for reliability and security.
Your rights (including GDPR)
Depending on where you live, you may have rights to access, correct, delete, or export your personal data, and to object or restrict certain processing. You may withdraw analytics consent at any time.
- Update your display name in Account.
- Leave trips or ask a trip owner to remove you.
- Delete your account in Account → Delete account & all data (type DELETE to confirm). That removes your profile, owned trips (and their content for everyone), and contributions you made in other trips. Photo files are cleaned up shortly after.
- Or email privacy@deckmate.io from the address on your account for help with access, export, or erasure.
You can also contact your local data-protection authority if you have a complaint.
Children
DeckMate is not directed at children under 16. If you believe a child has created an account, contact us and we will delete it.
Changes
We may update this policy as the product evolves. We will revise the “Last updated” date above. Continued use after significant changes means you have had a chance to review the new policy.