Privacy policy
Last updated 27 October 2026
This explains what personal information Origins Vault (“we”, “the site”) collects, why, and the choices you have. We collect as little as we can. You can browse cards, decks, tournaments and news without signing in, and nothing personal is stored when you do.
Who is responsible
Origins Vault is an independent fan project and is the data controller for the information described here. Contact us about privacy at contact@originsvault.net.
What we collect, and why
| Information | When | Why |
|---|---|---|
| Your Steam ID, Steam display name, avatar and profile link | When you sign in with Steam | To create your account and show your name on decks you publish |
| A sign-in session (stored as a one-way hash, not the token itself) | When you sign in | To keep you signed in for up to 30 days |
| Decks you build, their names, notes and public/private setting | When you save a deck | To store and, if you choose, publish your decks |
| Which decks you've liked | When you like a deck | To show like counts and let you unlike a deck |
| Tier lists you make, their titles, notes and public/private setting | When you save a tier list | To store and, if you choose, publish your tier lists and include them in the community tier list |
| Your collection: card versions you add, grades, serial numbers, “for trade” flags and wishlist | When you add cards or sync your Steam inventory | To run the collection tracker |
| Marketplace listings (which copy, asking price, status) and listings you've registered interest in | When you list a card or press “I want this” | To run the marketplace preview and show sellers how many buyers are interested |
| Matches recorded by the Match Tracker app: time played, result, your deck's cards and name, the opponent's Legendary if you pick it, and when each linked PC last connected. Never your opponent's name, and nothing from your screen. | When you link the app and play | To show your match history and stats, and to build community win rates |
| Steam inventory item IDs and names for Origins TCG items | When you press “Sync Steam inventory” | To fill in your collection automatically |
| Your Steam trade URL | Only if you add it on your account page | So trade offers can reach you once the marketplace launches |
| Your Discord user ID, username and avatar | Only if you press “Link Discord” on your account page | So the Origins Vault Discord bot can show your public decks and collection summary when you or others ask it to |
We never see your Steam password: signing in happens on Steam's own site, and Steam only tells us your Steam ID. We don't collect your email address or run advertising, and our visitor statistics don't identify you.
Legal basis
Under UK GDPR we rely on performance of a contract (providing the features you sign up for) for account, deck and collection data, and on our legitimate interests in keeping the site secure and working for the session data.
Cookies
The site sets only these cookies, all strictly necessary, so no consent banner is needed:
- session: keeps you signed in. Lasts up to 30 days, or until you sign out.
- login_next: remembers which page to return you to after signing in with Steam. Lasts 10 minutes.
- discord_state: a random value that protects the “Link Discord” step from being started by another site. Lasts 10 minutes.
We don't use advertising, analytics or third-party tracking cookies.
Visitor statistics
We use Cloudflare Web Analytics to count page views and see which pages people find useful. It sets no cookies, stores nothing on your device, and doesn't use your IP address or browser details to identify you or follow you across other sites. We only see totals: pages viewed, the sites that linked here, and visitors' country, browser and device type, plus how fast pages load. We rely on our legitimate interests in understanding how the site is used.
Who else is involved
- Valve (Steam) handles sign-in, provides public profile details and inventory data, and hosts Steam avatars and the images in official news posts. When a page shows those images your browser loads them from Steam's servers, which can see your IP address. See Valve's privacy policy.
- Discord, only if you link it or use our bot: Discord tells us your user ID, username and avatar when you link, and passes us the commands you use with the bot. See Discord's privacy policy.
- Cloudflare hosts and serves the site, routes our email and keeps short-lived request logs. Turso hosts our database. Both act on our behalf under contracts that limit how they can use the data, and may process it outside the UK with appropriate safeguards in place. See Cloudflare's and Turso's privacy policies.
We don't sell or rent personal data to anyone.
What's public
Decks and tier lists you mark as public show your Steam display name, and public tier lists count towards the community tier list. Like counts are public, but not who liked a deck. The POP report publishes how many graded copies of each card variant are recorded across all collections, as totals only; it never shows whose copies they are. Analytics combine tracked matches into win rates the same way, without showing who played them. Marketplace listings show your Steam display name, the card, its grade and serial number, and your asking price. Sellers see how many people registered interest, but not who. If you link Discord, anyone in a server with our bot can use /profile on you to see your Steam display name, public decks and how many cards you have in your collection and up for trade. Private decks and tier lists, the rest of your collection, your wishlist and your trade URL are only visible to you. Before checkout opens we'll update this policy to cover payments.
How long we keep it
We keep your account data until you delete your account. Sign-in sessions expire after 30 days. Items removed from your Steam inventory drop out of your collection on your next sync.
Your rights
You can, at any time:
- Download your data as a file, from your account page
- Delete your account and everything tied to it, from the same page. This takes effect immediately.
- Edit or delete individual decks, tier lists and collection entries
- Ask us to correct, restrict or explain our use of your data, or object to it, by emailing us
If you're unhappy with how we handle your data, please contact us first. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).
Children
The site isn't aimed at children under 13, and you need a Steam account to sign in, which has its own minimum age.
Changes
We'll update this page when our practices change and change the date at the top. Significant changes will be announced on the site.