Privacy Policy

Mythic Deal operates mythicdeal.com, a peer-to-peer marketplace where players buy, sell, and negotiate Magic: The Gathering cards. This policy explains what we collect, why, and what you can ask us to do with it. Questions go to stephen@uxcalifornia.com.

We collect only what the marketplace needs to work:

• Account data — email address, display name, username, and the terms version you accepted with its timestamp.
• Marketplace activity — listings, bounties, offers, counters, messages in a deal room, reviews, and order history.
• Fulfilment data — the shipping name and address you enter at checkout, shared with the seller who is shipping to you, and tracking numbers sellers enter.
• Payment data — handled by our payment processor. Card numbers never reach our servers; we store only the processor's reference IDs, the last four digits, and payout status.
• Technical data — IP address, browser and device type, and pages viewed, used for security, fraud prevention, and aggregate analytics.

All card payments and seller payouts are processed by Stripe. When you pay, your card details are entered directly into Stripe's hosted fields and transmitted to Stripe — Mythic Deal never sees, stores, or transmits your full card number, expiry, or security code.

Sellers taking payouts complete identity and bank verification with Stripe. That verification data is held by Stripe under its own privacy policy; we receive only a pass/fail status and the account reference.

• To run your account, listings, bounties, offers, and orders.
• To route payments and payouts, and to resolve disputes, refunds, and chargebacks.
• To send transactional email — offer alerts, order confirmations, shipping notices, review requests, and security notices.
• To detect and prevent fraud, counterfeiting, and abuse.
• To improve search, pricing estimates, and site performance in aggregate.

We do not sell your personal information, and we do not share it with advertisers.

• Other users see your public profile: username, display name, listings, decks, public bounties, reviews, and your seller track record. They do not see your email address.
• A seller you buy from receives the shipping name and address for that order only. A buyer receives the seller's return address when a return is approved.
• Service providers process data on our behalf under contract: Stripe (payments and payouts), our email delivery provider, our database and hosting provider, and Scryfall for public card catalog data.
• We disclose information to law enforcement only where legally required, or where necessary to investigate fraud or protect someone's safety.

We use cookies and local browser storage to keep you signed in, remember your cart and staged bounties, and measure aggregate traffic with Google Analytics. We do not run advertising or cross-site tracking cookies. Blocking cookies will sign you out and empty your cart between visits.

Account and transaction records are kept for as long as your account is open, and afterwards for the period required by tax, accounting, chargeback, and fraud-prevention obligations — normally seven years for financial records. Deal-room messages and dispute evidence are kept for the life of the dispute plus two years. Analytics data is retained in aggregate only.

You can access, correct, export, or delete your personal information. Most of it is editable from your account settings; for anything else, email stephen@uxcalifornia.com and we will respond within 1 business day. You can close your account at any time — we will delete or anonymise your personal data except records we must keep for open orders, refunds, and legal obligations.

You can opt out of non-essential email at any time. Transactional email about your own orders, offers, and account security cannot be switched off while your account is active.

Traffic is encrypted with TLS. Database access is restricted by row-level security so users can only read their own private data. Payment credentials are held by Stripe, a PCI-DSS Level 1 service provider. No system is perfect: if a breach affects your data, we will notify you and the relevant authority as required by law.

Mythic Deal is for adults. You must be 18, or the age of majority where you live, to buy or sell. We do not knowingly collect information from children; accounts belonging to minors are closed and funds returned.

We will post any change to this policy here with a new effective date, and surface material changes in-app. For any privacy question or request, email stephen@uxcalifornia.com.