Privacy Policy

XatuVision is an independent, non-commercial project operated by Thomas Michelini (Italy), the data controller for the purposes of the EU General Data Protection Regulation (GDPR). For any privacy question or to exercise your rights, contact

.

Your Discord account. XatuVision is a private beta behind "Sign in with Discord". When you sign in we store your Discord user ID, username, email address and avatar, together with the OAuth tokens Discord issues us. We use them only to sign you in and to verify that you hold the beta role that grants access; we never post anything on your behalf. Legal basis: performance of a contract (providing the beta you asked to join), Art. 6(1)(b) GDPR.

A login cookie. To keep you signed in we set one essential, encrypted session cookie (valid up to 30 days). It is strictly necessary for the gated site to work, so it needs no consent banner; there are no advertising or tracking cookies. Legal basis: our legitimate interest in operating a secure login, Art. 6(1)(f) GDPR.

Server logs. Our hosting keeps standard HTTP access logs (IP address, timestamp, requested URL, user agent) for a short period for security and debugging. They are not used to profile you. Legal basis: legitimate interest in the security and stability of the service, Art. 6(1)(f) GDPR.

Local preferences. Your light/dark theme and recent command-palette searches live only in your browser (localStorage), never on our servers.

Product analytics. While the beta is running we use PostHog (EU Cloud) to understand how the site is used — which pages and features are visited, anonymous click and navigation events, and aggregate session replays — so we can fix what is confusing and decide what to build next. Replays mask everything you type (search queries and the feedback box are never recorded); analytics profiles are created only for signed-in users and keyed to your Discord ID, with no extra personal data; and the data is ingested and stored in the EU. We use it only in aggregate for product decisions — never for advertising. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in improving the service; you can object at any time by emailing us.

We keep your Discord account data and OAuth tokens for as long as your beta access is active, or until you ask us to delete them. The access and refresh tokens are replaced as they rotate during normal use. Server access logs are retained only short-term by our host. Published tournament and player data (below) is retained for as long as it is relevant to the historical meta dataset.

XatuVision aggregates tournament results and decklists that players and organisers have already published publicly on

. This can include a player's chosen display name, country, match records, placements and decklist. We did not collect this from you directly (GDPR Art. 14).

Legal basis: legitimate interest (Art. 6(1)(f)) in providing competitive-meta statistics from results that are already in the public domain. If you are a player and want your name or results removed or anonymised, email

and we will action it — you can object to this processing at any time.

We rely on a small number of providers (processors / recipients):

• Hetzner (Germany, EU) — hosting of the application and database.

• Backblaze B2 — encrypted database backups. Depending on the bucket region this may involve a transfer outside the EEA, covered by the provider's standard contractual clauses.

• Discord — the identity provider that authenticates your sign-in.

• PostHog (EU Cloud) — privacy-focused product analytics (page and feature usage), with everything you type masked and all data processed in the EU. See "Product analytics" above.

• Card image hosts (pokemontcg.io, scrydex.com) — see "External requests" below.

We do not sell, rent or share your account data, and we run no advertising. The only behavioural data we collect is the privacy-focused, EU-hosted product analytics described above (PostHog) — never used for advertising or sold to anyone.

Card images. Thumbnails next to card names are served directly by

and

. Loading them sends a request from your browser to those services, which may log your IP address and user agent under their own policies. XatuVision does not see those requests.

Under the GDPR you can request access to, correction or erasure of your data, restriction of or objection to processing, and data portability. To exercise any of these, email

. You also have the right to lodge a complaint with your supervisory authority — in Italy, the

.

Questions about how XatuVision handles data, or want to exercise a right? Email

.

Last updated: 30 June 2026.