Privacy Policy

The Service is a Model Context Protocol (MCP) server that exposes read-only tools for Magic: The Gathering deckbuilding. When a client invokes a tool, the Service forwards the request to a public upstream provider (Scryfall, Moxfield, or EDHREC), receives the response, and returns it to the client.

The Service receives, on each request:

• The JSON-RPC request body, which includes the tool name and any tool arguments (card names, deck IDs, commander names, color identities, decklists you submit for validation).
• Standard HTTP request metadata: source IP, user-agent, and timestamps. This is logged by the hosting platform (Netlify) for operational and abuse-prevention purposes.

The Service does not require an account, does not request authentication, and does not collect names, email addresses, payment details, or any other personally identifying information.

Tool calls are forwarded as outbound HTTPS requests to the upstream APIs listed below. Each provider has its own privacy policy and may log the outgoing request:

• Scryfall — api.scryfall.com.
• Moxfield — api.moxfield.com and api2.moxfield.com.
• EDHREC — json.edhrec.com.
• AwesomeAPI — economia.awesomeapi.com.br for live USD-BRL conversion in get_card_price.

Outbound requests carry only the tool argument values needed to answer the query (e.g. a card name, deck ID, or color identity). The Service does not forward your IP address, user-agent, or any ChatGPT user identifier to upstream providers.

The Service is stateless. Tool inputs and outputs are not written to any database, blob store, or persistent log. Operational request logs (status code, latency, IP) are retained by the hosting platform for a short rolling window (typically 7–30 days) for diagnostic purposes only.

The Service does not set cookies, does not use analytics trackers, and does not embed third-party advertising scripts.

The Service is not directed to children under 13 and does not knowingly collect personal information from anyone.

Because the Service does not store user-identifying data, there is no account to delete or data export to request. If you believe a request you sent has been retained in a way inconsistent with this policy, contact support@mtg-mcp.doodlemed.org.

We will update this page if our data handling materially changes. The “Last updated” date at the top of this page reflects the most recent revision.

Doodle Med — support@mtg-mcp.doodlemed.org.