Privacy Policy

1. Who is responsible for your data?

Sorcery.no is an independent community service operated from Norway. The operator of Sorcery.no is the data controller for personal data processed by the service.

Sorcery.no is operated under the Ancient Workshop name. Privacy and data-protection requests can be submitted through the contact form.

2. Information we process

You can browse public parts of Sorcery.no without creating an account. If you create an account or use account features, Sorcery.no may process the following limited information:

• Internal account ID: a Sorcery.no identifier used to associate your account with saved content.
• Discord user ID: a stable identifier supplied through Discord OAuth and used to recognise the Discord account that authenticated with Sorcery.no.
• Sorcery.no username: a username you choose or one generated for you. It does not need to match your Discord identity or real name.
• Account metadata: limited technical information such as account creation and modification timestamps where required to operate and maintain the account.
• Content you save: for example collections, decks, lists, preferences, or other Sorcery.no data that you intentionally associate with your account.
• Security and operational data: limited logs or request information may be processed when necessary to operate, secure, troubleshoot, or prevent abuse of the service.

Sorcery.no does not intentionally request or store your Discord email address, real name, friends list, server memberships, or other Discord profile information that is not necessary for authentication.

3. Discord authentication

Sorcery.no uses Discord OAuth to allow users to authenticate without creating and maintaining a separate password for Sorcery.no. Discord is a separate service with its own privacy practices.

The Discord user ID used for authentication is kept separate from most application data wherever practical. Saved Sorcery.no content is associated with an internal Sorcery.no user ID rather than requiring your Discord identifier to be copied throughout the service.

Authentication credentials and tokens are used only as necessary to complete authentication and maintain secure sessions. Sorcery.no does not intentionally retain OAuth credentials longer than required for those purposes.

4. Why we process this information

Personal data is processed only for specific purposes, including:

• creating and authenticating your Sorcery.no account;
• providing account features and storing content you choose to save;
• maintaining account and service security;
• preventing abuse, fraud, or attempts to compromise the service;
• diagnosing technical problems and maintaining service reliability; and
• complying with legal obligations where applicable.

5. Legal basis

Where the GDPR applies, Sorcery.no processes account and saved-content data primarily because it is necessary to provide the service you request when you create and use an account. Limited security and operational processing may also be based on the legitimate interest in operating and protecting Sorcery.no, provided those interests do not override your rights and freedoms. Where processing is required by law, the applicable legal obligation may provide the legal basis.

If Sorcery.no later introduces processing that requires consent, consent will be requested separately and may be withdrawn as required by law.

6. Data minimisation and public identity

You are not required to use your real name as your Sorcery.no username. If no username is chosen, Sorcery.no may assign a generated username. The aim is to let people use the service without unnecessarily connecting their public Sorcery.no activity to their real-world identity or public Discord identity.

Please remember that information you voluntarily place in usernames, deck names, lists, or other user-created content may itself identify you. Avoid putting private information into public-facing content if you do not want it to be public.

7. Service providers and recipients

Sorcery.no relies on a small number of service providers to operate:

• Discord: provides OAuth authentication when you choose to sign in with Discord.
• Cloudflare: provides infrastructure used by Sorcery.no, including networking, security, application hosting and database services.
• GitHub: may provide hosting or deployment infrastructure for public website content and source-code-related services.

These providers may process technical information as part of providing their services. Their processing is also governed by their own applicable privacy terms and legal obligations.

Sorcery.no does not sell or rent personal data to advertisers or data brokers.

8. International processing

Some service providers used by Sorcery.no are international organisations and may process information outside Norway or the European Economic Area. Where the GDPR requires safeguards for international transfers, Sorcery.no relies on the mechanisms made available by the relevant provider and applicable law.

9. Cookies and local storage

Sorcery.no does not use advertising or behavioural-tracking cookies. The service may use cookies, browser storage, or similar technologies when technically necessary for authentication, security, session management, user preferences, or functionality you request.

If Sorcery.no later introduces non-essential cookies or similar tracking technologies that require consent, they will not be treated as necessary merely for convenience and this policy will be updated accordingly.

10. How long information is kept

Account information and saved content are retained while your account exists and for as long as they are necessary to provide the service. Data that is no longer needed should be deleted or anonymised unless retention is required for security, dispute resolution, legal obligations, or another lawful purpose.

Operational and security logs are retained only for as long as reasonably necessary for their purpose. Sorcery.no aims to avoid indefinite retention of identifiable logs.

11. Account deletion

You may request deletion of your Sorcery.no account and associated personal data. Sorcery.no intends to provide self-service account deletion where practical. Until such functionality is available, deletion requests can be made using the privacy contact listed in this policy.

Deletion may not require immediate removal from transient backups or records that must temporarily be retained for legal or security reasons, but such data will not be kept for unrelated purposes.

12. Your rights

Where the GDPR applies, you may have rights including access to personal data concerning you, correction of inaccurate data, erasure, restriction of processing, objection to certain processing, and data portability where applicable. Where processing is based on consent, you may withdraw that consent without affecting processing that was lawful before withdrawal.

Requests can be submitted through the contact form. Sorcery.no may need to verify that a request relates to the correct account before acting on it, but will not request more information than reasonably necessary for verification.

13. Complaints

If you believe your personal data has been handled improperly, you may contact Sorcery.no first so the issue can be investigated. You also have the right to lodge a complaint with a competent data protection supervisory authority. In Norway, the supervisory authority is Datatilsynet (the Norwegian Data Protection Authority).

14. Security

Sorcery.no uses reasonable technical and organisational measures intended to protect information against unauthorised access, alteration, disclosure, or loss. No online service can promise absolute security, which is one reason Sorcery.no deliberately aims to collect as little personal information as possible.

15. Automated decision-making and profiling

Sorcery.no does not use personal data for automated decision-making that produces legal or similarly significant effects, and does not build behavioural advertising profiles of its users.

16. Payments and financial support

Sorcery.no does not currently process payments. If paid features or voluntary financial support are introduced in the future, this Privacy Policy will be updated before those features are made available.

Sorcery.no intends to use third-party payment providers rather than storing complete payment-card or bank-account credentials on its own systems. Any account entitlement, such as a future Plus or Supporter status, should require only the minimum information necessary to record and administer that entitlement.

17. Children

Sorcery.no is not designed to collect unnecessary personal information from children. If age-specific requirements become relevant to account features or consent, Sorcery.no will apply the requirements of applicable law and update this policy as necessary.

18. Changes to this policy

This policy may be updated when Sorcery.no changes how personal data is processed, introduces new account features, changes service providers, or needs to reflect legal requirements. Material changes will be communicated in an appropriate manner before they take effect where required.

The effective date at the top of this page identifies the current version.

19. Contact

Questions about privacy, data protection, access, correction, or deletion can be submitted through the contact form.