Privacy

Last updated September 10, 2026

Slowdraw is a place to play card games slowly. It is run by Synergy. This page says what we store, who else can see it, and how to get rid of it. If something here is unclear, write to hello@slowdraw.app and we will fix the wording.

What we store

• Your email address. It is how you sign in and how we tell you it is your turn.
• What you put on your profile. A handle, a display name if you want one, a short bio, an avatar, your time zone and the formats you like to play.
• Your decks. The list you pasted in and the cards we matched it to.
• Your games. Every move, in order, and who made it. That log is how the game knows where it stands, and it is never edited or deleted.
• Your email settings. Whether you want a message as things happen, one summary a day, or nothing, and what hour you want the daily one.
• When you were last here. So the player list can show who is actually around.

There is no password to lose, because there is no password. Signing in sends you a one-time link.

If you use the Google button, Google hands us four things: your email address, your name, the address of your Google profile picture, and the id of your Google account. Your email address is the part we use. It signs you in and it is where your notifications go. The other three sit with your sign-in record, unread, and are never shown to anyone. The handle, display name and avatar people see here are the ones you chose, not the ones Google supplied. We never see your Google password, and nothing Google gives us is passed on to anyone else.

What we do not do

We do not sell your information or hand it to advertisers. There are no ads here, and nothing follows you around other sites.

Counting visits

We do use Google Analytics, to see whether anyone is finding the site at all. It sets cookies in your browser and tells Google the address of each page you open, roughly where in the world you are, and what sort of device you are on. Inside a game that address carries the game's id, so those are addresses Google sees too.

So there are two kinds of cookie here: the one that keeps you signed in, and Google's, which tells a returning visit from a new one. There is no switch for the second on the site yet. A browser that blocks third-party scripts stops it, as does any of the usual blocking extensions, and everything works the same without it.

What your opponent sees

Your handle, your display name, your avatar, your bio and your win-loss record are visible to other signed-in players. Once a game starts, the people at that table can see the name of the deck you brought and every move you make. They cannot see your hand, the order of your library, or the face-down cards in front of you. Those live in a separate place the database will not hand over, no matter which page asks.

Your avatar is different. It is served from a public address, so anyone holding that link can look at it without signing in. Treat it like a public profile picture.

Who else touches it

The service runs on a handful of companies. Each one sees only the part it needs.

• Supabase holds the database, the sign-in system and the avatars, on servers in the United States.
• Vercel serves the pages.
• Resend sends the email, so it handles your address and the text of each message.
• Google handles sign-in if you use that button, and receives the page addresses above through Analytics.
• Cloudflare answers the question of where slowdraw.app lives. It sees nothing you do here.

Card pictures are not copies. Your browser loads them from Scryfall as you play, which means Scryfall sees those requests the same way any site you visit sees a request for an image.

Email you can switch off

Turn reminders, challenges and daily summaries are all yours to turn down or off in settings. Sign-in links are not, because that is the only way back into your account. If our mail keeps bouncing off your address we stop sending, and the site tells you so.

Getting your account removed

Write to hello@slowdraw.app and ask. There is no self-serve button yet, and we would rather say that than pretend otherwise.

When we remove an account we take your name, handle, bio and avatar off it and leave the games standing. A game is a shared record. Erasing your side of it would tear a hole in the history of everyone you played, which is not ours to do. What is left behind cannot be traced back to you from the site.

How long we keep things

Games and their logs stay for as long as the site does, for the same reason. Notifications, sign-in links and anything else that exists to nudge you get cleared out once they are stale.

Young players

Slowdraw is not built for children, and we do not knowingly keep accounts for anyone under 13. If one turns up, write to us and it goes.

When this page changes

The date at the top moves and the change goes live at the same time. If a change is one you would want to know about rather than discover, we will email you about it.