How Mana Grove collects, uses and protects your data: what is stored about your account, your decks and your collection, and the choices you have.
Last updated: October 26, 2026
The Mana Grove Trading Cards Ltd.
Version 1.8
What changed in version 1.8. Version 1.7 described part of our own measurement wrongly, and this version corrects it. Three things run before you answer, in every country: a cookieless analytics script, a campaign arrival counter and event counts with no identifier (Section 11.1). Everywhere except Canada outside Quebec and the United States outside California, nothing else runs before you answer, and our own measurement entries on your device need your Analytics permission, including in the United Kingdom and the European Union. Sections 4.10, 6, 6.1, 11.1, 11.2, 14, 15, 18.1 and 18.2 were updated to match: Section 4.10 now says where a click identifier can be attached to an account, that we do not attach one in the United Kingdom, and what we record when you follow one of our short campaign links; Section 11.1 adds the anonymous count of answers to our cookie notice; Section 14 adds the retention of our first-party usage records; and Section 18.1 now names both ways you can agree to advertising measurement, including accepting the Advertising category of the cookie notice. Section 18.2 now states the Terms of Service boundary precisely. The information we share with an advertising platform is unchanged, and so are the commitments in Section 18.
Privacy contact: privacy@themanagrove.com
Mana Grove respects your privacy. This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, and the choices and rights available to you when you use Mana Grove.
Decks and collections are private by default. You decide when to make them public.
We do not use account-linked personal information for AI model improvement or training unless you separately opt in.
At launch, a human reviews decisions that could meaningfully and adversely affect your account or access.
We do not sell personal information. Advertising cookies are yours to control: we ask before using them, except in Canada outside Quebec and in the United States outside California, where they are on by default with notice, and you can turn them off at any time. In the United States, a Global Privacy Control signal from your browser keeps them off until you turn them on (Section 11.2).
Everywhere, three things run before you answer and store nothing on your device: a cookieless analytics script, a campaign arrival counter and event counts with no identifier, and you can object to them at any time for free. In Canada outside Quebec and in the United States outside California, measurement and advertising cookies are also on by default and you can turn them off; in the United States, a Global Privacy Control signal from your browser keeps them off until you turn them on. Everywhere else, including the United Kingdom and the European Union, everything else waits for your permission: our own measurement entries on your device, Google Analytics, Microsoft Clarity and the advertising tags (Section 11.1).
The Mana Grove Trading Cards Ltd. ("Mana Grove", "we", "us", or "our") is a Canadian federal corporation. Our office is at 2455 Cawthra Rd #21-22, Mississauga ON L5A 3P1.
For privacy questions, requests, or complaints, contact our privacy function at privacy@themanagrove.com. Our privacy and compliance contact is Andy Kitusa, Chief Operations Officer.
This Policy applies to Mana Grove services that link to it, including our website and, when available, our iOS and Android applications (collectively, the "Platform"). It applies to visitors, registered users, subscribers, and, where marketplace functionality is available, buyers and sellers. It also applies to Scry on Discord, the Mana Grove app for Discord servers, which Section 4.11 describes.
This Policy does not govern third-party websites, applications, or services that have their own privacy practices, even if you reach them through the Platform.
Mana Grove is available in Canada, the European Union, the United Kingdom and the United States; other regions may follow. Where this Policy refers to requirements that apply in the EEA or the United Kingdom, they apply to users in those regions. Some features described in this Policy are also not available today: marketplace functionality, direct messaging, a card scanner, social badges, and a public API are not currently part of the Platform, and where this Policy describes them, it describes how we would handle information if and when they become available.
Mana Grove is not intended for users who are too young to independently create an account and provide the consents required for the Platform in their jurisdiction. We do not currently operate a parental-consent program. The minimum ages below also apply to Scry on Discord (Section 4.11), even though it asks for no age and creates no account.
Canada: you must be at least 16 years old to create a Mana Grove account.
United Kingdom: you must be at least 18 years old.
European Union / European Economic Area: you must be at least 18 years old.
United States: you must be at least 18 years old.
Other jurisdictions: you must meet the minimum age required to independently use the service and provide the required privacy consents under applicable law, and in all cases you must be at least 16 years old.
Marketplace transactions, seller onboarding, or other regulated features may have additional age, identity, or contractual-capacity requirements. We may ask for date of birth and country to determine whether you are eligible to use the Platform. If we learn that an ineligible person has created an account, we may suspend the account and delete or restrict the associated personal information as required by law.
You may choose to provide an avatar, biography, real name, and general profile location. These fields are optional unless a specific feature clearly tells you otherwise. Your shipping address is not used as your public profile location.
We process the decks, collections, names, notes, tags, and other content you create on the Platform. Decks and collections are private by default unless you choose to make them public. If social features are available, we also process content and activity you choose to submit, such as comments, messages, reactions, follows, reports, or other community interactions.
When you use Grover or another AI-enabled feature, we process the text, instructions, searches, deck or collection context, feedback, and other information you choose to submit to that feature, together with the resulting output and operational information necessary to provide, secure, and troubleshoot the feature. AI interactions are handled for the purposes described in this Policy and retained in accordance with Section 14.
Mana Grove uses Stripe to process subscriptions. We process information associated with your subscription, such as your subscription status, plan, transaction status, and related billing or account metadata that is made available to us. Payment-card information is handled through the applicable payment processing flow rather than being used by Mana Grove for unrelated purposes.
If you buy cards through the Mana Grove marketplace, we require the address and transaction information reasonably necessary to process and fulfil the purchase. This may include your name, shipping address, order information, and transaction records. We do not require a residential or shipping address merely to create a standard Mana Grove account.
If you become a seller, additional identity, business, payout, tax, or verification information may be required. We will identify the required information and any relevant third-party verification or payment provider at or before collection.
Like most online services, the Platform generates technical and operational information when it is used. This may include IP address, device and browser information, operating system, language, session or authentication events, pages or features used, search activity, timestamps, diagnostic information, and security logs, depending on the systems and features you use.
If you contact us, we process your contact details, the contents of your message, attachments you provide, and the information needed to respond. Company and support communications currently use Microsoft Outlook / Microsoft 365. Our support address is support@themanagrove.com.
Mana Grove is not designed to collect sensitive personal information such as health information, biometric identifiers, religious beliefs, sexual orientation, or government identity numbers as part of ordinary account use. Please do not include sensitive personal information in public profiles, community posts, or Grover prompts unless it is genuinely necessary for the feature you are using.
When you arrive from one of our own advertisements or campaign links, the web address you arrive on carries a click identifier issued by the advertising platform (for example Google's `gclid` or Reddit's `rdt_cid`) and campaign parameters naming the campaign, the ad group and the creative (the `utm_` parameters). We read them from the address. We keep them on your device, and record the arrival against this browser on our servers, only where your Analytics setting allows it: by default with notice in Canada outside Quebec and in the United States outside California, and only after you turn Analytics on everywhere else (Section 11.1). If you then create an account in the same browser, we attach to it the page and campaign you arrived from in that browsing session and the arrivals recorded on that browser in the 90 days before you signed up, so that we can tell which of our own advertisements or campaigns produced it.
Whether the click identifier itself may be attached to your account depends on where you are when you create it. In Canada outside Quebec, and in the United States outside California where we can determine your state and your browser sends no Global Privacy Control signal, it is attached. In Quebec, wherever we cannot determine your province, your US state or your region, in the European Union and the European Economic Area, in Switzerland, in California, and in the United States whenever your browser sends a Global Privacy Control signal, it is attached only if you had accepted the Advertising category of the cookie notice when you arrived, and the most recent answer you gave before signing up is the one that counts; without that, the campaign you came from is still recorded, but the click identifier is deleted instead of being attached to your account. In the United Kingdom, we do not attach a click identifier to your account.
A click identifier is kept for no more than 13 months from collection, on our servers and on your device, and is then deleted. That is the longest window the advertising platforms we use attribute a result over; we do not need it for longer. The records of your arrivals are kept on our servers for no more than 180 days, and the campaign parameters attached to an account, without the click identifier, are kept for the life of the account as the record of how it was acquired. Section 11.1 explains what runs without asking you first and how to object; Section 18.1 explains what, if anything, we send to an advertising platform.
Our own campaign links can be short web addresses that forward you to a page on Mana Grove. When you follow one, our server records the click as it forwards you, which is before our site has loaded, so it cannot see the choices saved in your browser; nothing is stored on your device for it. In Canada outside Quebec, where we can determine the province you are in, the record holds which link it was, when you followed it, a coarse class of device (desktop, iOS, Android, automated or other) and a one-way hash of your IP address combined with a secret value, never the address itself, and the click gets a random reference, added to the address of the page you arrive on. That reference is handled like a click identifier: it is kept with the record of your arrival only where your Analytics setting allows it, and it is attached to an account only on the terms above. Everywhere else, including the United States, the click is only counted, like the event counts with no identifier in Section 11.1: the record holds which link it was, when and the coarse class of device, with no hash of your IP address and no reference added to the address of the page you arrive on, so it cannot be connected to you, to this browser or to an account. The record of a click is kept for no more than 90 days.
Scry on Discord, the Mana Grove app for Discord servers, is described in Section 9.6 of the Terms of Service. It needs no Mana Grove account, and using it creates none.
What Discord sends us. Each time you use the /scry or /scryimage command, Discord sends us that command: the words you searched for, the command's name, the server's id, your Discord user id, your username, your language setting and the server's preferred language, along with other details Discord attaches to every command, which we do not use. When you use the /help command, Discord sends us the same details, without any words to search for; we use them only to show you the list of commands, in your language. The request comes from Discord's servers, not from your device, so it does not give us your IP address. Scry on Discord does not read the messages in any channel, and it receives nothing about you between commands. When you use the /bracket command, Discord sends us the text of the decklist you submit, including any commander you name, in place of search words; we use that text only to check the list's Commander bracket and answer the command. When you open the link in a private /bracket reply, its address, which contains your list, is kept in our routine server logs for up to 30 days. A public reply links to the plain checker page, which contains no list.
How we use it. We use it only to answer the command, to apply the limits on how many searches one person, one server and all servers together can run, to prevent abuse, and to keep Scry on Discord working, including finding and fixing problems (Section 6). Your search runs through the same Scry search as our website, an automated system (Section 7.1). We do not use your searches to train AI models (Section 7.3), to advertise to you or to build a profile of you, and we never sell them (Section 18).
What we keep. From each command, we keep:
Only the limit counters carry a hash of your Discord user id, and they are gone within 24 hours. While they last, we treat them as personal information (Section 14); after that, nothing we hold can be tied to you, with one exception (Section 15.4).
What we do not do. Scry on Discord does not read channel messages, does not keep your username or language setting, puts nothing on your device, writes nothing about you to our database, creates no Mana Grove account, and never links your Discord identity to a Mana Grove account.
Who sees the reply. Our reply is posted in the channel where you used the command, so anyone who can see that channel under the server's settings can read it, and Discord may also show beside it which member used the command. The reply does not print the words you searched for, but its links to our search page carry them, so anyone who opens or copies one of those links can see them. Refusals, such as a notice that a limit was reached, and the /help reply are shown only to you. A /bracket reply is also shown only to you, unless you choose to post it in the channel. The link in a private reply carries your list, so anyone who opens or copies it can see the list, and when it is opened, its address is kept in our routine server logs for up to 30 days.
Discord, and our links. Discord delivers your command to us and shows our reply under its own terms and privacy policy, which govern what Discord collects and keeps on its side, including the reply in the channel (Sections 12 and 13). We keep no copy of a reply, and we have no way to edit or remove it once it is posted. The links in a reply carry campaign parameters that name Scry on Discord and the link that was used (Section 4.10), and nothing that identifies you. When you open one, you are visiting our website, and the rest of this Policy applies to that visit.
Your choices. You can stop at any time by no longer using the commands. Section 15.4 explains why, after a day, we hold nothing of yours to show you or to delete, with one exception.
The Commander bracket checker reads a decklist you paste, on our website or where it is embedded on another site, and returns its reading: the Commander bracket the list reads as. It needs no Mana Grove account, and using it creates none. We use the list only to check it and return the reading. You can share a reading as a link whose address contains the list itself, and any deck name you add, so anyone who opens or copies the link can see them. When a shared reading is opened, its address, which contains the list, is kept in our routine server logs for up to 30 days; beyond those logs, we keep nothing of the list.
We collect personal information in three main ways:
We use personal information only for identified purposes that are appropriate and lawful. Canadian privacy laws use consent, reasonable-purpose, and statutory-exception frameworks rather than the GDPR concept of "lawful bases." For users in the EEA and UK, our principal GDPR/UK GDPR bases are summarized below.
| Purpose | Examples of information used | EEA / UK legal basis |
|---|---|---|
| Provide and manage the Platform | Account, settings, decks, collections, social content, AI requests | Contract / steps requested before contract |
| Answer Scry on Discord commands, apply their limits and keep the feature working | The command, the words you searched for, and one-way hashes of the Discord server and user ids (Section 4.11) | Legitimate interests (Section 6.1) |
| Check decklists with the Commander bracket checker and keep the tool working | The decklist you paste, and the address of a shared reading, which contains the list (Section 4.12) | Legitimate interests (Section 6.1) |
| Remember your preferences and drafts on your device between visits | The preferences and drafts that the Functional category of the Cookie Policy keeps in your browser, such as your theme and language, view modes, recent searches and an unsaved deck draft. They stay on your device, except for the few entries that go only to Mana Grove, to finish an action you started (Section 11 and Cookie Policy Section 4) | Consent in Quebec, the EEA, the UK, Switzerland and California, wherever we cannot determine your region or your US state, and in the United States whenever your browser sends a Global Privacy Control signal; on by default, with notice and the ability to turn it off at any time, in Canada outside Quebec and in the United States outside California |
| Process subscriptions and marketplace transactions | Subscription, order, shipping, billing and transaction information | Contract; legal obligation where applicable |
| Customer support and service communications | Account and communications data | Contract and legitimate interests |
| Security, fraud, abuse prevention, moderation and enforcement | Account, device, logs, reports, content | Legitimate interests; legal obligation where applicable |
| Personalized recommendations | Decks, collections, searches, preferences and activity, when activated | Consent where required; otherwise another lawful basis permitted by law |
| AI model improvement or training | Only information covered by a separate express opt-in | Consent |
| Analytics and service improvement, first party, without identifiers | The cookieless statistics, the campaign arrival counter and the identifier-free event counts described at the start of Section 11.1 | Legitimate interests, with a free right to object at any time (Sections 6.1 and 11.1) |
| Analytics and service improvement, first party, on your device | Our own measurement entries on your device and the records built from them, including the record of the page and campaign you arrived from (Sections 4.10 and 11.1) | Consent in Quebec, the EEA, the UK, Switzerland and California, wherever we cannot determine your region or your US state, and in the United States whenever your browser sends a Global Privacy Control signal; implied consent, with notice and a right to opt out, in Canada outside Quebec; notice and a right to opt out in the rest of the United States |
| Analytics and service improvement, third party, including session replay | Google Analytics and Microsoft Clarity data described in Section 11.1 | Consent in Quebec, the EEA, the UK, Switzerland and California, wherever we cannot determine your region or your US state, and in the United States whenever your browser sends a Global Privacy Control signal; implied consent, with notice and a right to opt out, in Canada outside Quebec; notice and a right to opt out in the rest of the United States |
| Marketing | Contact details and marketing preferences | Consent, subject to applicable electronic-marketing rules |
| Advertising measurement | Click identifiers, hashed identifiers and conversion events (see Sections 4.10 and 18.1) | Consent in Quebec, the EEA, the UK, Switzerland and California, wherever we cannot determine your region or your US state, and in the United States whenever your browser sends a Global Privacy Control signal; legitimate interests elsewhere. That consent can be given at signup or by accepting the Advertising category of the cookie notice (Section 18.1); attaching a click identifier to your account needs the Advertising category to have been accepted when you arrived, and in the United Kingdom we do not attach one at all (Section 4.10). |
| Consent-based advertising | Advertising cookies and the identifiers they carry, used to measure and show Mana Grove's own advertising on other platforms (see Sections 11.2 and 18.2) | Consent: express in Quebec, the EEA, the UK, Switzerland and California, wherever we cannot determine your region or your US state, and in the United States whenever your browser sends a Global Privacy Control signal; implied, with notice and a right to opt out, in Canada outside Quebec; notice and a right to opt out in the rest of the United States (Section 11.2) |
| Legal, regulatory and corporate requirements | Records relevant to legal duties, disputes or transactions | Legal obligation and legitimate interests |
Canada outside Quebec. For measurement and for advertising cookies we rely on your implied consent, given after notice. We tell you at or before collection, in the cookie notice, in the Cookie Policy and here, and we give you a way to opt out that is easy to find, free, and effective immediately. We do not use this basis for sensitive information, and we do not knowingly measure children.
Quebec. Anything that can identify, locate or profile you is off until you activate it, and we tell you it exists and how to activate it. Only the measurement described at the start of Section 11.1 runs before you choose: none of it places anything on your device, carries an identifier, or identifies anybody.
United Kingdom. For the three things described at the start of Section 11.1 (the cookieless script, the campaign arrival counter and the identifier-free event counts), nothing is stored on your device, and the only stored information we read from it is your own privacy choices and, while you hold it, the free demo's session cookie, which is strictly necessary (Cookie Policy section 3) and which our servers read only to limit how many event counts one demo browser can send, so the rules on storing and reading information on a device do not require us to ask you first. We still hold them to the conditions UK law sets for statistics of this kind: they are used only to count how Mana Grove is used, including which of our own pages and campaigns bring visitors, so that we can improve it; we tell you clearly what they are, here and in the Cookie Policy; what they produce is shared with nobody except Plausible, which compiles the script's statistics for us; and you can object free of charge. For our processing of the records they produce we rely on our legitimate interests. Our interest is in improving a service you are using, including knowing which of our own pages and campaigns bring people to it. Against that we weighed what the records actually are: aggregate or free of any identifier, first party, never sold, never shared with an advertising platform, never used to show you advertising, never used to make a decision about you, never used to build a profile of you, and deleted on the schedule in Section 14. We concluded that somebody using Mana Grove would reasonably expect it, and that it does not override your interests or rights. You can object at any time, for free, through the "Measurement settings" link in the website footer or the same link under Settings, then Privacy, when you are signed in, and we stop (Section 11.1 describes the few counts our servers make from a request, which an objection saved in your browser cannot reach). Everything else, including our own measurement entries on your device, Google Analytics, Microsoft Clarity and the advertising tags in Section 11.2, never runs on this basis and always requires your consent. You can ask us for the balancing assessment behind this paragraph at privacy@themanagrove.com.
European Union and European Economic Area. The three things described at the start of Section 11.1 run as an exempt audience measurement: they measure only this site, never follow you elsewhere, and are never combined with any other information about you. None of them places anything on your device, so there is nothing to expire; the counts we keep from them are deleted after 25 months at the latest, and Plausible keeps only aggregate statistics with no identifier. A click identifier is attached to your account only if you accepted the Advertising category of the cookie notice when you arrived (Section 4.10). Everything else requires your consent.
United States. Outside California, where we can determine the state you are in, measurement (including Microsoft Clarity's session recording) and the advertising cookies are on by default, as in Canada outside Quebec: we tell you in the cookie notice, in the Cookie Policy and here instead of asking first, and you can turn each of them off at any time. Advertising measurement from our servers (Section 18.1) is on by default too, and you can turn it off at any time in your privacy settings. If you live in California, if we cannot determine your state, or if your browser sends a Global Privacy Control signal, we ask you first instead: only the measurement described at the start of Section 11.1 runs before you choose, and everything else stays off until you turn it on. A choice you make yourself, in the cookie notice or in your settings, takes priority over that signal, in either direction.
Switzerland, and wherever we cannot determine your region. Only the measurement described at the start of Section 11.1 runs. Everything else requires your consent.
Scry on Discord, wherever you are. Discord does not tell us where you are, so we handle every Scry on Discord command the same way, wherever it comes from, and only for the purposes in Section 4.11. In Canada, sending us a command is your consent to that handling. Elsewhere, including in the United Kingdom and the European Union, we rely on our legitimate interests in answering the command you sent us, preventing abuse and keeping the feature working. We weighed those interests against what the records are: no identifier that names you, no username, no profile, never sold, never used for advertising, and, for the record of each command, deleted within 30 days. We concluded that someone who sends us a command would reasonably expect this, and that it does not override their interests or rights.
The Commander bracket checker, wherever you are. We handle every check the same way, wherever it comes from, and only for the purposes in Section 4.12. In Canada, using the checker is your consent to that handling. Elsewhere, including in the United Kingdom and the European Union, we rely on our legitimate interests in checking the list you give us and returning its reading, preventing abuse and keeping the checker working. We weighed those interests against what we keep: no account, no profile, nothing sold, nothing used for advertising, and nothing of the list beyond our routine server logs, which keep the address of an opened shared reading for up to 30 days. We concluded that someone who checks a list would reasonably expect this, and that it does not override their interests or rights.
Grover is an AI-enabled feature. When you interact with Grover, you are interacting with an automated system. AI outputs may be incomplete or inaccurate and should be evaluated in context. Mana Grove may also use AI or algorithmic systems for search, recommendations, safety, security, fraud detection, moderation support, and similar platform functions.
Authorized personnel may review account information, user content, or Grover interactions on a need-to-know basis when reasonably necessary for customer support, debugging, security, fraud or abuse investigations, moderation, legal compliance, AI safety, or quality assurance. Human review for AI model improvement or training is limited to information covered by a separate express opt-in.
Today, Mana Grove does not use your prompts, conversations, or account-linked personal information to train AI models, and no AI-improvement program is currently offered.
AI model improvement or training using account-linked personal information is optional and is not a condition of using Mana Grove. If we offer an AI improvement program, we will ask for separate express consent and identify the categories of information covered before you opt in. The control will be off by default. You may withdraw your consent prospectively at any time through the available privacy controls or by contacting us.
Withdrawal stops new use based on that consent. The technical ability to remove information that has already been incorporated into a trained model can depend on the model architecture and training process; where relevant, the consent notice will explain any material limitation before you opt in.
At launch, Mana Grove will not make a decision that materially and adversely affects your account, eligibility, pricing, access to features, or moderation status solely through automated processing. Automated systems may flag, score, rank, detect, or recommend an action, but a human will review a meaningfully adverse action before it takes effect.
Mana Grove may use information such as your decks, collections, searches, preferences, and Platform activity to personalize card, deck, search, or feature recommendations. Where applicable law requires activation or consent for profiling or personalization, those functions will not be enabled until you activate them or provide the required consent.
Personalization is separate from AI model training. You may be able to use personalized recommendations without agreeing to contribute your personal information to model training. Platform features such as search and recommendations may also be improved using aggregated or de-identified information, including content users have chosen to make public, handled in accordance with Section 14's de-identification rules. Where controls are available, you can change your personalization choices through the Platform or by contacting us.
Decks and collections are private by default. If you choose to make content public, other users may view, share, quote, or otherwise interact with that content according to the features available on the Platform. Public content may also be discoverable through search or copied by others outside Mana Grove.
Changing content from public to private or deleting it does not guarantee that copies previously made by other users or independent third parties will disappear. If you delete your account, we will remove the link between your identity and retained community information where reasonably necessary, subject to legal obligations and the rules described in Section 14.
If messaging or other private communications are available, intended recipients can access the communications you send them. Authorized Mana Grove personnel may access communications only when reasonably necessary for support, security, abuse investigations, moderation, legal compliance, or another disclosed purpose.
We use Stripe to process subscriptions. Payment and subscription data is used to activate and manage paid features, handle billing issues, prevent fraud, maintain records, and satisfy legal or accounting obligations.
For subscriptions billed to the European Union, the European Economic Area, the United Kingdom, or the United States, Sold through Link, LLC, an affiliate of Stripe, Inc., is an additional recipient of your payment and billing information: it acts as the merchant of record for that purchase, calculates and remits the applicable VAT or other sales tax, issues your receipt or invoice, and provides related customer support through link.com. We rely on the same lawful bases as Section 6's "Process subscriptions and marketplace transactions" purpose for sharing this information with Sold through Link, LLC and Stripe: performing our contract with you, and, for the tax elements, our and Stripe's legal obligations. Mana Grove remains the controller for your account and the rest of the Platform; this paragraph adds a recipient and a role for one specific transaction type, it does not change any other part of this Policy.
If marketplace functionality is available in your region, we collect the information necessary to complete the transaction. A buyer must provide a valid delivery address before purchasing a physical card or other item that requires shipping. We may share the minimum information necessary with sellers, payment providers, shipping providers, or other parties required to fulfil the transaction.
Seller onboarding may require additional identity, address, payout, business, or tax information. The specific requirements and providers will be disclosed at the point of seller registration.
The Platform may use cookies, local storage, software development kits, and similar technologies for strictly necessary functions, preferences, security, functionality, analytics and advertising. Where consent is required for a non-essential technology, we will request it before activating that technology. Section 11.1 explains what we use for measurement and where consent is required for it; Section 11.2 does the same for the advertising cookies.
We use advertising cookies only to advertise Mana Grove itself, and only under the choice rules in Section 11.2. We never use any of these technologies to sell or rent information about you, and we never show advertising on the Platform. Additional details and controls are provided in our Cookie Policy and preference tools where available.
We measure how Mana Grove is used so that we can see what works, find what is broken, and decide what to build next. Some of that measurement runs before you answer the cookie notice, in every country; the rest runs only under the Analytics category, on by default with notice in Canada outside Quebec and in the United States outside California, and off until you turn it on everywhere else.
What runs before you answer, everywhere. These three things run on every visit, in every country, without asking you first; everywhere except Canada outside Quebec and the United States outside California, nothing else does:
Nothing is stored on your device for them, and the only stored information we read from it is your own privacy choices, such as the record of your objection if you have made one, so that those choices are honoured, and, while you hold it, the free demo's session cookie (Cookie Policy section 3), which our servers read only to limit how many event counts one demo browser can send. The counter keeps only daily totals, each event count is a record that something happened with no identifier attached, Plausible keeps only aggregate statistics, and none of them can be traced back to you. None of the three is advertising: none of them follows you to another website, none is sold, and none is shared with an advertiser. You can stop them at any time, for free, with "Measurement settings" (below), with one limit: a few of the event counts are made on our servers from a request your browser sends anyway, so an objection saved in your browser cannot reach them. Those are the free demo's own steps (opening it, asking Grover, running a search), counted against the campaign the visit came from, and, everywhere except Canada outside Quebec, a click on one of our own short campaign links, counted as it forwards you (Section 4.10). None of them stores or reads anything on your device.
The count of answers to our cookie notice. When you answer the cookie notice, your browser sends one message that carries no identifier, and our server adds one to a daily total for that kind of answer: whether you accepted everything, refused everything, saved your own choices, or let the notice close by itself once you started using the page; whether the notice told you or asked you; the language it was in; and a broad region worked out from your connection (Canada, the United States, the United Kingdom, France, the rest of the European Union and the EEA, Switzerland, elsewhere, or unknown). Nothing is stored on your device for it, and nothing about you is kept beside it. We count every answer, a refusal included, because a notice cannot be checked without knowing how people answer it; it is a count of answers, never a record of a person.
What waits for your permission. Everything else in this Section runs only under the Analytics category of the cookie notice: on by default with notice in Canada outside Quebec and in the United States outside California, and off until you turn it on everywhere else. That covers our own measurement entries on your device, listed in the Cookie Policy, section 5, including the record of the page you arrived on and of the link that brought you there (Section 4.10 explains when a click identifier in that record may be attached to an account), and two third-party services: Google Analytics 4 (Google LLC), which sets the `_ga` and `_ga_*` cookies for up to two years so that it can tell one browser from another and count visits, and Microsoft Clarity (Microsoft Corporation), which sets the `_clck` cookie for up to one year and the `_clsk` cookie for one day so that it can join the pages of one visit and show us how a page was used and where it broke. Both providers receive technical data about your visit, such as the pages you viewed, your device and browser type, your approximate location and the actions you take on a page. Under the Analytics category alone, Google Analytics is told through Google's consent signals that it may measure but not personalize advertising; the two are joined only if the Advertising category (Section 11.2) is also on for you. These providers process what their tags collect under their own published privacy policies and the data-processing terms we have accepted with them; the cookieless Plausible statistics remain our cross-check on their figures.
Where you are decides whether we ask you first:
In Canada outside Quebec, where we can determine the province you are in, and in the United States outside California, where we can determine the state you are in and your browser sends no Global Privacy Control signal, the three things above, our own measurement entries and the third-party services are all on by default. We describe them here and in the Cookie Policy instead of asking you first, and you can turn them off at any time.
In the United Kingdom, the three things above run without asking you, and everything that waits for your permission stays off until you turn it on. None of the three stores anything on your device, so the rules on storing and reading information on a device do not require us to ask you first. We still hold them to the conditions UK law sets for statistics of this kind: we tell you clearly what we do, we use them only to count how Mana Grove is used, including which of our own pages and campaigns bring visitors, so that we can improve it, never to show you advertising or to follow or profile anyone, we share what they produce with nobody except Plausible, which compiles the script's statistics for us, and we give you a simple way to object that costs you nothing. For our processing of the resulting records we rely on our legitimate interests, as Section 6.1 sets out. Objecting takes a moment and costs nothing: the "Measurement settings" link in the website footer, or the same link under Settings, then Privacy, when you are signed in. Google Analytics, Microsoft Clarity and the advertising tags in Section 11.2 are never covered by this and always stay off until you turn them on.
In the European Union and the European Economic Area, the three things above run without asking you, on the narrower terms an exempt audience measurement has to meet: they measure only this site, they never follow you to another site, and they are never combined with any other information about you. None of them stores anything on your device, so there is nothing to expire; the counts we keep from them are deleted after 25 months at the latest, and Plausible keeps only aggregate statistics with no identifier. A click identifier is never attached to your account here without your express consent, given by accepting the Advertising category of the cookie notice when you arrived (Section 4.10). Everything that waits for your permission stays off until you turn it on. The same "Measurement settings" link turns the three things off.
In Quebec, wherever we cannot determine your province, in Switzerland, in California, wherever we cannot determine your US state or your region, and in the United States whenever your browser sends a Global Privacy Control signal, only the three things above run. Everything else in this Section, and everything in Section 11.2, stays off until you turn it on, and it is never pre-ticked.
Microsoft Clarity is the one provider here that records how a page was used, so that we can replay where it broke. That recording never runs anywhere except Canada outside Quebec and the United States outside California (where a Global Privacy Control signal also keeps it off) unless you have turned the Analytics category on, and anything typed into a form is masked before it is recorded, everywhere and in every mode.
Your two controls. Both are always available, whether or not you have an account, and they do different jobs:
Retention. Our own aggregate counts (the campaign arrival counter and the count of answers to our cookie notice) contain no identifier and are kept for no more than 25 months. Our first-party usage records follow Section 14: the event records described above, together with any identifier attached to them, are kept for up to 180 days and then deleted; search analytics are kept for up to 90 days; the records of the page and campaign a visit arrived from are kept on our servers for up to 180 days; the record of a click on one of our short links for up to 90 days; a click identifier is kept for no more than 13 months, on our servers and on your device (Section 4.10); and the record of which page or campaign an account came from, without the click identifier, is kept for the life of that account so that we can tell how the account was acquired. Google Analytics keeps its event-level data for no more than 14 months, and Microsoft Clarity keeps a session recording for 30 days (a randomly selected sample, and any recording we label or mark as a favourite, for up to 9 months; heatmap data 9 months), with anything typed into a form masked before it is recorded.
Under the Advertising category of the cookie banner, and only while that category is on for you, two tags run so that we can measure our own advertising and show Mana Grove's advertising to people who have visited us: the Google Ads tag (Google LLC), which sets the `_gcl_au` cookie for 90 days and, on a visit that starts from one of our Google ads, the `_gcl_aw` and `_gcl_gs` cookies for the same period; and the Reddit Pixel (Reddit, Inc.), which sets the `_rdt_uuid` cookie for 90 days. These identifiers let the platform recognize that a visit came from its ad, count an account creation or a subscription as a result of that ad, and include you in an audience that may be shown Mana Grove's advertising on that platform later. They do not give the platform access to your account, your decks or your collection.
Where you are decides whether we ask you first, exactly as for measurement in Section 11.1. In Canada outside Quebec, where we can determine the province you are in, and in the United States outside California, where we can determine the state you are in and your browser sends no Global Privacy Control signal, this category is on by default: the cookie notice tells you so rather than asking, and you can turn it off at any time, starting with the notice's own Manage options button, where the Advertising switch is shown already on. In Quebec, wherever we cannot determine your province, your US state or your region, in the EEA, the United Kingdom, Switzerland and California, and in the United States whenever your browser sends a Global Privacy Control signal, this category stays off until you turn it on. Wherever you live, turning it off removes the cookies, stops the tags immediately, and ends any further advertising signal about you from your browser; once your answer reaches your account, it also stops the messages our servers send, which have their own switch as well (Section 18.1). Section 18.2 explains what we do and do not do with these audiences.
We do not disclose personal information indiscriminately. We may disclose it in the following circumstances:
Mana Grove is based in Canada. Our service providers may process personal information in Canada and in other jurisdictions. This can mean that personal information is subject to the laws of the country where it is processed and may be lawfully accessible to courts, law-enforcement agencies, or government authorities there. The database behind our card search is hosted in the United States: to find matching cards, our card search, on the Platform and in Scry on Discord, sends it a processed form of the words searched for and of any card filters, such as the cards in your collection when you search only your collection, but never your name, email address or account details.
Where required, we use appropriate contractual, organizational, or other lawful safeguards for cross-border transfers. For Quebec personal information, we assess applicable privacy factors before communicating information outside Quebec as required by law.
Scry on Discord (Section 4.11) answers commands on our Google Cloud servers in Canada, where its limit counters, the identifiers of recent commands and its cached search results are also kept. Its searches go to the database behind our card search, described above, with nothing that identifies you. The record of each command is kept in Google Cloud's logging service, which may store it outside Canada. Discord is a separate company: what it processes about your use of Discord, including your commands and our replies, is governed by its own privacy policy, not by this one.
Google LLC and Microsoft Corporation, which receive the analytics and advertising data described in Sections 11 and 18, have certified under the EU-U.S. Data Privacy Framework, the UK Extension to it, and the Swiss-U.S. Data Privacy Framework for personal information received from those regions. For users in the European Economic Area and the United Kingdom, the information described in Sections 11.2 and 18.1 is received first by Google Ireland Limited in Ireland and then transferred by Google to Google LLC in the United States under that same certification. Reddit, Inc. processes the advertising data described in Sections 11.2 and 18 under its advertising data-processing terms, which rely on the Data Privacy Framework and, for a transfer that does not qualify under it, on the European Commission's Standard Contractual Clauses with the UK International Data Transfer Addendum.
We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions: United Kingdom (UK) and European Union (EU). Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter, or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/12999658157. Our representative under Article 27 of the GDPR is Prighter EU Rep GmbH, 9 Clare Street, Dublin 2 D02 HH30, Ireland. Our representative under Article 27 of the UK GDPR is Prighter Ltd, 20 Mortlake Mortlake High Street, London, SW14 8JN, United Kingdom. You can also contact us directly at privacy@themanagrove.com.
We keep personal information only as long as reasonably necessary for the purposes described in this Policy, to provide the service, resolve disputes, maintain security, enforce agreements, and meet legal, tax, accounting, and regulatory requirements. Our general retention schedule is:
| Category | General retention approach |
|---|---|
| Account/profile data | While your account is active. When you request deletion, there is a 24-hour window to confirm the request, then a 30-day grace period during which you can cancel the deletion, then permanent deletion from active systems, subject to the exceptions described below. |
| Avatar images | All versions of your avatar image are permanently deleted when your account is deleted. |
| Decks, collections and account content | While needed for your account; deleted or de-linked from you after account deletion, subject to public/shared-content and legal exceptions. |
| Grover and AI interaction data (prompts, responses, reasoning records, and related metadata) | Retained for a minimum of 183 days (approximately 6 months) for service integrity, safety, and abuse prevention. We may retain it longer during an active investigation (an abuse hold) or for as long as a user-facing conversation history feature keeps it available to you. Deleted or de-identified after these periods. |
| Security and diagnostic logs | Retention varies by log type: routine error and diagnostic logs generally 30 to 90 days; login history and search analytics generally up to 90 days; audit records generally up to 12 months; unless a longer period is necessary for an active security, fraud, abuse, or legal matter. |
| Scry on Discord records | The record of each command, which holds nothing about you: 30 days, then deleted automatically. Limit counters: no more than 24 hours. The identifier of each command, kept so that it cannot be answered twice: 15 minutes. Cached search results, which hold no Discord id: no more than one hour (Section 4.11). |
| Support communications | Generally 24 months after the support matter is closed, unless a longer period is necessary for a dispute or legal obligation. |
| Subscription, marketplace and accounting records | Generally seven years from the end of the relevant financial year, or longer where required by law. |
| Backups | Deleted personal information may remain in protected backups for up to 90 days before normal overwrite/deletion cycles complete. Certain archival backups are retained longer for disaster recovery (currently up to approximately 13 months). |
| Advertising click identifiers and campaign parameters | A click identifier is kept for no more than 13 months from collection, on our servers and on your device, and is then deleted. The campaign parameters, without the click identifier, are kept for the life of the account as the record of how it was acquired (Section 4.10). |
| Usage analytics events | Up to 180 days, then deleted. This covers the first-party event records described in Section 11.1, including any identifier attached to them, and the records of the page and campaign each visit arrived from. |
| Short-link click records | No more than 90 days, then deleted. In Canada outside Quebec a record includes a one-way hash of the IP address; elsewhere it holds no identifier (Section 4.10). |
| Our own aggregate counts | No more than 25 months. They contain no identifier. These are the campaign arrival counter and the count of answers to our cookie notice described in Section 11.1. The statistics the cookieless script produces are aggregate, carry no identifier, and are held by Plausible under its own published data policy. |
| Consent and compliance records | Privacy choices and consent records are kept for the life of the account and for 24 months after it is closed, so that we can show what was agreed and when. Other compliance records are kept for as long as reasonably necessary to demonstrate compliance and address applicable claims or regulatory requirements. |
These are general retention periods. A shorter or longer period may apply where required by law, necessary for a specific feature, or reasonably necessary for security, fraud prevention, litigation, or another documented purpose.
When you delete your account, we may preserve certain information in de-identified form where reasonably necessary to maintain shared resources, platform integrity, aggregate analytics, or other legitimate purposes. Where information remains capable of being linked or re-identified, we continue to treat it as personal information and protect it accordingly. Information that has been validly anonymized under applicable law may be retained without being linked to you.
Depending on where you live, you may have some or all of the following rights. We may need to verify your identity before completing a request, and legal exceptions may apply.
The measurement and advertising controls are always available, whether or not you have an account: the "Cookie preferences" link in the website footer (the "Your Privacy Choices" link opens the same choices), and the "Measurement settings" link beside it; when you are signed in, both are also under Settings, then Privacy. Using them takes effect immediately, costs nothing, and takes nothing away from what Mana Grove does for you. Where we rely on your consent (the Analytics and Advertising categories in "Cookie preferences"), using them withdraws that consent for the future. Where we rely on our legitimate interests for the three things described at the start of Section 11.1, as Section 6.1 explains, "Measurement settings" is your objection and we stop, apart from the few counts our servers make from a request that Section 11.1 describes. The two controls do different jobs: turning Analytics off does not stop those three things, and objecting stops them even if Analytics is on, deletes four of our own measurement entries from your device and does not change your Analytics or Advertising answers (Section 11.1).
You can use the self-service tools available in your account settings on the website: Settings → Data & export to download a copy of your data, and Settings → Delete account to delete your account. You can also email privacy@themanagrove.com. If a self-service tool is not yet available on a particular Platform surface, we will process eligible requests manually through the privacy contact until the tool is available there.
We respond within the period required by applicable law. For many Canadian requests this is generally 30 days, and for EEA/UK requests it is generally one month, subject to permitted extensions.
Quebec residents may exercise applicable rights under Quebec private-sector privacy law, including access and rectification rights, withdrawal of consent where applicable, and portability rights for eligible computerized personal information. Mana Grove uses privacy-protective defaults for features with privacy settings; decks and collections are private by default. Where a technology includes profiling or similar functions that require activation under Quebec law, we will provide the required notice and activation control.
EEA and UK users may have rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and rights relating to automated decision-making and profiling. At launch, Mana Grove does not make meaningfully adverse decisions solely by automated means. You may also lodge a complaint with the supervisory authority responsible for data protection where you live or work.
This section adds information for people who live in the United States. Several US states have privacy laws of their own, and they do not all apply to every business. Rather than work out which one applies to you, we give everyone in the United States the choices and rights described here.
What we collect and who receives it. The table lists the categories of personal information we collect, as Sections 4 and 5 describe them, and who receives each one (Section 12). We collect it from you, automatically from your use of the Platform, and from service providers (Section 5), for the purposes in Section 6, and we keep it for the periods in Section 14.
| Category | What it covers | Who receives it |
|---|---|---|
| Identifiers and account details | Email address, username, sign-in credentials, account settings and consent records, IP address, cookie identifiers and advertising click identifiers (Sections 4.1, 4.7, 4.10 and 11) | Our service providers. While the Analytics or Advertising category is on for you, also Google, Microsoft and Reddit (Section 11). While advertising measurement is on for your account, the advertising platform our advertisement reached you on (Google or Reddit) also receives the click identifier it issued and a one-way hashed version of your email address (Section 18.1) |
| Profile details you choose to add | Avatar, biography, real name and general profile location (Section 4.2) | Our service providers, and other users where you make it public |
| Content you create | Decks, collections, notes, comments and other community content, and what you send to Grover (Sections 4.3 and 4.4) | Our service providers, including the infrastructure that runs Grover, and other users where you make it public |
| Subscription and payment information | Your plan, your subscription and transaction status and related billing records; card details are handled by the payment processor (Sections 4.5 and 10) | Stripe and, for a subscription billed to the United States, Sold through Link, LLC |
| Internet and device activity | Device and browser information, pages and features used, searches, sign-in and security events, diagnostic logs, and the country and the state or province your connection appears to come from (Sections 4.7 and 11.1) | Our service providers. While the Analytics category is on for you, Google and Microsoft; while the Advertising category is on, Google and Reddit |
| Messages to us | Your contact details and what you write to us (Section 4.8) | Our service providers for email and support |
| Age and country | Your country and your declaration that you meet the minimum age; a date of birth only where we ask for one (Sections 3 and 4.1) | Our service providers |
| Scry on Discord commands | What you search for with Scry on Discord and a one-way hash of the server's id, and, for no more than 24 hours, a one-way hash of your Discord user id (Section 4.11) | Our service providers. Our reply goes to Discord, which shows it to everyone who can see that channel, or only to you for a private /bracket reply or a /help reply, and its search links carry what you searched for (Section 12) |
Selling and sharing. We do not sell your personal information: we never give it to anyone for money (Section 18). One thing we do is what some US state privacy laws call "sharing" personal information for cross-context behavioural advertising, or "targeted advertising". While the Advertising cookie category is on for you, the Google Ads tag and the Reddit Pixel receive a cookie identifier and a record of your visit, and Google and Reddit use it, together with the identifiers described in Section 18.1 where advertising measurement is on for your account, to show you Mana Grove's advertising on their own services (Sections 11.2, 18.1 and 18.2). In the United States outside California that category is on by default, with notice; in California, wherever we cannot determine your state, and whenever your browser sends a Global Privacy Control signal, it stays off until you turn it on.
How to opt out. Use the "Your Privacy Choices" link in the website footer and turn the Advertising category off; you can turn the Analytics category off in the same place. It takes effect immediately: the cookies are removed, the tags stop, and nothing about your visits reaches an advertising platform from your browser (Section 18.2). If you have an account, the same switches are under Settings, then Privacy, together with the one for advertising measurement (Section 18.1): turn that one off as well to stop the messages our servers send to an advertising platform about you. You can also turn on Global Privacy Control in your browser, which we treat everywhere in the United States as an opt-out from both, unless you turn them on yourself.
Your rights. If you live in the United States, you can ask us to:
How to use them. Settings → Data & export gives you a copy of your data, and Settings → Delete account deletes your account. For anything else, or if you have no account, write to privacy@themanagrove.com; an email is all it takes. We may ask for information to confirm that the request comes from you, and someone you have authorized may ask on your behalf if they show us that authorization. We answer within 45 days; if we need longer we will tell you within those 45 days, and we may then take up to 45 more. If we refuse a request we will say why, and you can ask us to look at it again. We will never refuse you service, charge you a different price or give you a lesser service because you used one of these rights.
Do Not Track and Global Privacy Control. We do not respond to the "Do Not Track" setting that some browsers send. We do honour Global Privacy Control, which is a different signal: anywhere in the United States it keeps the Analytics and Advertising categories and our advertising measurement off unless you turn them on yourself (Sections 6.1, 11 and 18.1). While the Analytics or Advertising category is on for you, Google, Microsoft and Reddit collect information through their tags about what you do on Mana Grove, and they may combine it with what they know about your activity on other sites and services, as their own privacy policies describe (Sections 11 and 12).
After the limit counters expire, within 24 hours, we hold nothing that can be tied to you: the record of a command keeps your search and the server's hashed id, never anything about you, so there is nothing of yours for us to find or delete. The one exception is the link in a private /bracket reply, which only you can see: if you open that link, its address, which contains your list, is kept in our routine server logs for up to 30 days. A reply that Scry on Discord posted is a message in that Discord channel, held by Discord. We keep no copy and have no way to change or remove it, so use Discord's own tools, or ask the server's moderators, to remove it.
We send marketing communications only where permitted by law and, where required, after you separately opt in. Marketing consent is separate from acceptance of the Terms of Service, the Privacy Policy, and optional AI-training consent. You can unsubscribe through the link in a marketing email or update available notification preferences.
Service messages necessary to operate your account, provide security notices, confirm transactions, or communicate material changes are not marketing and may still be sent where necessary.
We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, loss, or destruction, taking into account the sensitivity and amount of the information, the purposes for which it is used, and the risks presented by the Platform.
No online service can guarantee absolute security. If a privacy or security incident occurs, we investigate and take appropriate steps. Where applicable law requires notification to affected individuals, privacy regulators, or other authorities, we will provide those notices.
Mana Grove does not sell personal information to third parties, and we show no advertising on the Platform. We advertise Mana Grove itself on other platforms, and there are exactly two ways your information can be involved in that: measuring whether our own advertising worked (Section 18.1), and, only where the Advertising cookie category is on for you, showing our advertising to people who have visited us (Section 18.2). Nothing we do for advertising gives anyone else access to your account data.
We may create or use aggregate or de-identified information for analytics, product planning, market insights, or business reporting, provided that it is handled in accordance with applicable law and is not used to identify you.
Mana Grove may share a small set of identifiers and conversion events with the advertising platform where our own promotion reached you (currently Reddit or Google Ads), to measure the effectiveness of Mana Grove's own advertising campaigns. The identifiers are the click identifier that platform itself issued when you clicked our advertisement (Section 4.10) and a one-way hashed version of your email address. The events are things such as "created an account" or "subscribed". We send this from our servers rather than from your browser, and every send carries a signal telling the platform that it may count the result and may not use it to personalize advertising. We never send your name, your decks, your collection, your searches, your messages to Grover, or anything you typed.
Outside Quebec, where we can determine that you are in a region for which this default applies, which does not include the EEA, the United Kingdom, Switzerland or California, it is on by default. In the United States, the default also requires that we can determine your state and that your browser sends no Global Privacy Control signal. You can turn it off at any time, with prospective effect, in your privacy settings or by turning the Advertising category off (below).
In Quebec, in the EEA, in the United Kingdom, in Switzerland, in California, wherever we cannot determine your region or your US state, and in the United States whenever your browser sends a Global Privacy Control signal, this is an opt-in choice. We share the identifiers and events described above only if you have agreed, and you can agree in either of two ways, each enough on its own: by ticking the advertising-measurement choice offered at signup, which is unchecked by default, or by accepting the Advertising category in the cookie notice or in "Cookie preferences", which is never pre-ticked either. If you accept the Advertising category before you have an account, or while you are signed out, that answer is copied onto your account the next time you sign in. You can decline both, or withdraw your consent at any time, with prospective effect (below).
Wherever you live, you can stop it at any time, with prospective effect: turn advertising measurement off in your privacy settings, or turn the Advertising category off in "Cookie preferences". Either one records on your account that you declined (if you are signed out, when you next sign in), and a recorded refusal stops these messages whichever way you had agreed, including where they would otherwise be on by default. You can turn advertising measurement back on in your privacy settings at any time.
On its own, this measurement is not retargeting, wherever you live: it does not follow your browsing across other sites, we do not sell this information, and we do not use it to build an advertising profile of you. Only where the Advertising cookie category is also on for you (Section 18.2) may the platform use the same identifiers to include you in an audience for Mana Grove's own advertising. We delete our own copy of a shared hashed email address within 30 days of sharing it, and we never keep one for more than 90 days from collection; a click identifier is kept for no more than 13 months from collection, as Section 4.10 describes. The advertising platform processes uploads under its own published data policies.
Only while the Advertising cookie category (Section 11.2) is on for you, the Google Ads tag and the Reddit Pixel may record that you visited Mana Grove and, at a coarse level, what you did here (for example, that you viewed the pricing page or created an account). The platform uses that record to show you Mana Grove's advertising on its own service and to measure it. This is behavioural retargeting, and it happens only for people whose Advertising category is on: because they turned it on or, in Canada outside Quebec and in the United States outside California, because they were told it is on and have not turned it off. It never happens for anyone else, it never involves selling your personal information, and it never gives a platform access to your account.
Accounts created before September 13, 2026 remain on version 1.3 of our Terms of Service until they accept version 2.0 or later, and until then they are excluded from this section: every conversion we send about such an account is sent with personalization denied (Google's `ad_personalization` and `ad_user_data` signals are set to denied), and the account is left out of any audience we build, so no retargeting can be built from it.
You can withdraw this permission at any time, with prospective effect: from the cookie notice's Manage options button while the notice is open, from the "Cookie preferences" link in the website footer, or from the Advertising switch under Settings, then Privacy, in your account. The cookies are deleted from your device, the tags stop, and nothing more about you reaches an advertising platform from your browser; once your answer reaches your account, the messages our servers send stop as well (Section 18.1). What a platform already collected stays subject to its own published data policy and to the choices its own advertising settings offer you.
Every commitment in this Section 18 remains true regardless of these choices: we do not sell personal information, we show no advertising on the Platform, and nothing we do for advertising gives anyone else access to your account data.
We may update this Policy as the Platform, our technology, our service providers, or applicable law changes. We will post the updated version and update the "Last updated" date. If a change is material, we will provide additional notice appropriate to the circumstances, such as an in-app notice or email, and obtain new consent where required by law.
Questions, privacy requests, or complaints may be sent to:
The Mana Grove Trading Cards Ltd.
Privacy & Compliance
2455 Cawthra Rd #21-22, Mississauga ON L5A 3P1
We will review privacy complaints and respond in accordance with applicable law. You may also have the right to complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the UK Information Commissioner's Office, or the data protection supervisory authority in your EEA jurisdiction, as applicable.
This Policy is published in English and French. Both versions are intended to convey the same information; questions of interpretation are subject to applicable law.