Privacy Policy

This Privacy Policy describes how Sleeved ("we", "our", or "the app") collects, uses, stores, and shares personal data of users ("you") of the website and web application available at sleeved.app.

Sleeved is operated by Caio Gonçalves, an individual, reachable at contact@sleeved.app. For the purposes of this policy, we act as the data controller for personal data processed through the service. This policy is written primarily to comply with Brazil's General Data Protection Law (Lei nº 13.709/2018 — "LGPD"), with an additional section covering rights under the GDPR and CCPA/CPRA for users in other jurisdictions.

By creating an account or using Sleeved, you agree to the collection and use of information as described in this policy. If you do not agree with these terms, please do not use the service.

We only collect what is necessary to run Sleeved. We never ask for or store passwords — sign-in is handled entirely through Google or Apple.

• To create and authenticate your account, and keep your session secure.
• To provide the product's features: collection management, deck building, pricing, and statistics.
• To process payments and manage your subscription (Pro plan).
• To send essential transactional communications (e.g. account confirmation, billing notices) and, where applicable, product/marketing emails.
• To estimate your approximate country so checkout prices display in the right currency.
• To understand how the product is used, spot usability issues, and prioritize improvements (only with your analytics cookie consent).
• To measure the effectiveness of marketing campaigns (Google Ads/Meta Ads).
• To prevent fraud and abuse, and keep the service secure.
• To comply with legal and regulatory obligations.

We process your personal data under one or more of the following legal bases (LGPD art. 7 / GDPR art. 6):

• Contract performance: account, collection, deck, and payment data, necessary to provide the service you signed up for.
• Consent: non-essential cookies and behavioral analytics (Microsoft Clarity), and marketing communications.
• Legitimate interest: fraud prevention, application security, product improvement using aggregated data, and campaign attribution.
• Legal obligation: when required by law or a competent authority, for example tax obligations related to payments.

We do not sell your personal data. We share data only with processors strictly necessary to run the service, each operating under its own privacy policy:

• Google — "Sign in with Google" authentication and campaign measurement (Google Analytics 4 / Google Ads).
• Apple — "Sign in with Apple" authentication.
• Stripe — payment processing and subscription management.
• Amazon Web Services (AWS) — data hosting and card image storage.
• Loops — transactional emails and, where applicable, marketing emails.
• Microsoft Clarity — session recordings and heatmaps for usage analysis, only after your consent.
• ip-api.com — one-off IP geolocation lookup to estimate your country at checkout.
• CardTrader — only if you connect this integration, to export your collection using the token you provide.
• Public authorities, when required by law, court order, or to protect our rights.

Magic: The Gathering card data (name, image, reference prices) is sourced from public providers such as Scryfall, TCGPlayer, and Cardmarket — no personal data of yours is sent to these services.

We show a cookie consent banner on your first visit. Strictly necessary cookies (e.g. login session) are always active. Behavioral analytics tools (Microsoft Clarity) only load after you click "Accept". You can change your choice at any time by clearing this site's browsing data on your device, which will make the banner appear again.

We also store, locally in your browser (localStorage) and without requiring separate consent because it contains no identifiable personal data: campaign parameters (UTM) and your visit's referrer, used exclusively for marketing attribution.

• Account, collection, and deck data: for as long as your account is active.
• Authentication sessions (refresh tokens): rotated on each use and discarded when they expire or you sign out.
• Search history and export logs: kept tied to your account to improve the product, and anonymized if the account is deleted.
• After account deletion, we remove or anonymize the associated personal data, except where retention is required by law (e.g. payment tax records).

• All communication with Sleeved is encrypted in transit (HTTPS/TLS).
• We never store passwords: authentication is handled entirely via Google and Apple.
• Session tokens are short-lived and stored hashed, never in plain text.
• The CardTrader integration token, when provided, is stored restrictively and used only for calls made on your behalf.
• Access to data is restricted to the team responsible for operating the service.

Under LGPD art. 18, you may request at any time:

• Confirmation that your data is being processed.
• Access to your personal data.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion of unnecessary data or data processed unlawfully.
• Portability of your data to another service provider.
• Deletion of personal data processed based on your consent.
• Information about the entities with which we share your data.
• Withdrawal of consent at any time.
• Objection to processing based on legitimate interest.

You can exercise any of these rights, or delete your account and associated data, by contacting contact@sleeved.app. We will respond within a reasonable timeframe as required by applicable law.

Sleeved is not directed at individuals under 18, and we do not knowingly collect data from children. If you are a parent or guardian and believe a child has provided us with personal data without your consent, please contact us so we can remove it.

Some of the processors listed in section 5 (Google, Apple, Stripe, AWS, Loops, Microsoft) process data on servers located outside Brazil. In these cases, we require these partners to adopt data protection safeguards consistent with the standards required by the LGPD.

While Sleeved is operated from Brazil and the LGPD is the primary basis for this policy, this section addresses users in other jurisdictions.

Users in the European Economic Area / UK (GDPR): the legal bases and rights described in sections 4 and 9 correspond, respectively, to articles 6 and 12–22 of the General Data Protection Regulation (GDPR). You also have the right to lodge a complaint with the data protection authority in your country of residence.

California residents (CCPA/CPRA): we do not sell or share personal data for cross-context behavioral advertising in exchange for money. You have the right to know what data we collect, request its deletion, and not be discriminated against for exercising these rights. Requests can be made through the same contact channel as section 9.

We may update this policy periodically to reflect product or legal changes. Material changes will be communicated by email or a notice on the site before they take effect. The last-updated date is always shown at the top of this page.

Questions or requests related to your personal data or this policy can be sent to contact@sleeved.app.