Privacy

Last updated: May 29, 2026

The short version

PlayIRL.GG is an independent MTG event aggregator. We don't sell your data. We don't run ads. We don't run analytics or marketing trackers. The site uses a small number of cookies to keep you signed in and remember your preferences — that's it.

What we store

Account data — email, display name, and OAuth identifiers (Discord, Google) when you sign in. Used solely to authenticate you and to attribute events / RSVPs to your account.
Preferences — your default location, search radius, and preferred formats. Stored against your account so the homepage opens to the right slice the next time you visit.
Saved events + RSVPs — the events you star and the RSVPs you place. Visible to event hosts so they know who's coming.
Server logs — request IPs are processed by our hosting provider for rate-limiting and abuse prevention. Not retained beyond standard log rotation.

Cookies

authjs.session-token / mtg-cal-session — authentication. Without these you can't stay signed in.
theme — light or dark mode preference.
playirl-locale / playirl-country — overrides for language and country detection. Optional.
playirl-consent — records that you've seen this notice. Set when you click "Got it" on the banner. One-year lifetime.

No analytics cookies, no advertising cookies, no third-party trackers. If that changes, this page changes first.

Third parties

Event sources — we pull public event listings from Wizards of the Coast's official store locator, TopDeck.gg, and Discord servers you (or a site admin) have connected. We do not send your personal data to those services in the course of scraping.
Geocoding — when you change your location, we resolve the address to coordinates via Google's Geocoding API and/or OpenStreetMap Nominatim. They see the address you typed; they don't see your account.
IP geolocation — for first-visit location detection, we send your IP to ipwho.is for a coarse country/lat-lng lookup. Result is cached server-side; no per-user record is kept beyond the 24-hour cache TTL.
Authentication providers — OAuth via Discord / Google shares the basic profile fields you authorize. Optional email sign-in goes through Resend (transactional email only).

Your rights

If you're in the EU/EEA, the UK, or any other jurisdiction with similar data protection rules, you have the right to access, correct, or delete the data we hold about you. Email PlayIRLgg@gmail.com and we'll respond within the statutory window.

Contact

Questions, requests, or anything else: PlayIRLgg@gmail.com.

What we store

Account data — email, display name, and OAuth identifiers (Discord, Google) when you sign in. Used solely to authenticate you and to attribute events / RSVPs to your account.

Preferences — your default location, search radius, and preferred formats. Stored against your account so the homepage opens to the right slice the next time you visit.

Saved events + RSVPs — the events you star and the RSVPs you place. Visible to event hosts so they know who's coming.

Server logs — request IPs are processed by our hosting provider for rate-limiting and abuse prevention. Not retained beyond standard log rotation.

authjs.session-token / mtg-cal-session — authentication. Without these you can't stay signed in.

theme — light or dark mode preference.

playirl-locale / playirl-country — overrides for language and country detection. Optional.

playirl-consent — records that you've seen this notice. Set when you click "Got it" on the banner. One-year lifetime.

No analytics cookies, no advertising cookies, no third-party trackers. If that changes, this page changes first.

Third parties

Event sources — we pull public event listings from Wizards of the Coast's official store locator, TopDeck.gg, and Discord servers you (or a site admin) have connected. We do not send your personal data to those services in the course of scraping.

Geocoding — when you change your location, we resolve the address to coordinates via Google's Geocoding API and/or OpenStreetMap Nominatim. They see the address you typed; they don't see your account.

IP geolocation — for first-visit location detection, we send your IP to ipwho.is for a coarse country/lat-lng lookup. Result is cached server-side; no per-user record is kept beyond the 24-hour cache TTL.

Authentication providers — OAuth via Discord / Google shares the basic profile fields you authorize. Optional email sign-in goes through Resend (transactional email only).