Privacy Policy

Last updated: 1 October 2026

This website (www.moddi.com) is a small, non-commercial fan site about the Spellfire collectible card game. We keep the processing of personal data to the absolute minimum. This page explains what happens with your data when you visit the site.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (Datenschutzgesetz, DSG). The site is operated from and hosted in Austria.

1. Who is responsible

The controller responsible for data processing on this website is:

Tom / Spellfire Community Email: support[a t]moddi[d o t]com

2. Hosting and server log files

The site is served as static files from a shared web-hosting provider located in Austria (within the EU/EEA). Each time a page or file is requested, the hosting server automatically records standard access-log information, which may include:

• your IP address,
• date and time of the request,
• the page or file requested,
• the referring page (if any),
• your browser type and operating system.

This data is technically necessary to deliver the website and to keep it secure and stable. The legal basis is our legitimate interest in the safe and reliable operation of the site (Art. 6 (1) (f) GDPR). These logs are handled by the hosting provider and are not combined with other data or used to identify individual visitors by us. They are kept only for a limited period set by the hosting provider (typically a few weeks) and then deleted automatically. As the hosting is located within the EU/EEA, this processing does not involve any transfer of your data to a country outside the EU.

3. Cookies and local storage

This website does not set any cookies and does not use any analytics, advertising, or tracking services.

To remember your own preferences, the site stores a few small values in your browser’s local storage. This information never leaves your device and is not transmitted to us or to anyone else:

• theme – your light / dark / system appearance choice,
• fc_sort and fc_q – the sort order and filter you last used on the Fan Cards overview,
• chase_draw_<set> (e.g. chase_draw_ethereal) – which chase card you drew on a set page and on which day, so the “Draw a chase card” button only offers one draw per period,
• debug – only if you switch on the site’s troubleshooting output yourself (off by default),
• chase_codes_<set> – only if you tick “Remember my code(s)” on a set page: the reveal codes that worked for you, so those cards open again on your next visit. Nothing is saved without that tick; unticking the box or clicking “Forget my code(s)” deletes them immediately.

Because these values are strictly necessary to provide functions you actively request, no consent banner is required. Saving your reveal codes (chase_codes_<set>) additionally requires your explicit choice: it only happens after you tick the box, which you can undo at any time.

How long: these values have no expiry date. They stay in your browser until you delete them, either with the controls on the page (unticking the box, “Forget my code(s)”) or by clearing this site’s data in your browser settings. Private/incognito windows delete them when closed, and some browsers (e.g. Safari) remove them on their own after a period without visits.

4. No external content

All resources needed to display the site (styles, scripts, fonts, images, the image lightbox) are hosted on this website itself. No content is loaded from third-party servers when you browse, so no data (such as your IP address) is transmitted to third parties simply by viewing a page.

Some Fan Card sets may contain code-protected cards (e.g. “Chase cards” or “Special cards”); unlocking them with a code happens entirely locally in your browser, with no data transmission. Drawing a chase card also happens only in your browser, and codes are never sent to or stored on our server. If you then request a code, you do so through the contact form (section 5); the form is merely pre-filled with the set and card number, and nothing is sent until you submit it yourself.

5. Contact form

If you use the contact form, the details you enter (your name, email address, and message) are transmitted to and processed by Formhook (formhook.app), a form-backend service acting as our processor, which stores the submission and forwards your message to us by email.

• Formhook hosts the data within the EU (Germany), so using the form does not involve a transfer of your data to a country outside the EU. A data processing agreement (DPA) is in place.
• Spam protection is handled by a hidden honeypot field and server-side rate limiting, for which Formhook technically processes your IP address when you submit the form; no third-party CAPTCHA is loaded and no additional scripts are added to the page.
• We use the form to receive and respond to your enquiry. The legal basis is your consent and/or the handling of your request (Art. 6 (1) (a) and (b) GDPR); for spam protection and reliable delivery we also rely on our legitimate interest (Art. 6 (1) (f) GDPR).
• Providing this data is voluntary; without it we cannot reply to a message sent through the form.
• How long: we keep your message only as long as needed to handle your enquiry. Submissions are deleted from Formhook once they have been forwarded and answered, and the email in our inbox is deleted when the conversation is finished, at the latest after 12 months, unless you ask us to delete it sooner.

If you would rather not use the form, you can simply send us an email directly using the address in section 1.

6. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• request rectification (Art. 16) or erasure (Art. 17),
• request restriction of processing (Art. 18),
• object to processing based on legitimate interests (Art. 21),
• data portability (Art. 20).

Where we process your data based on your consent, you can withdraw your consent at any time with effect for the future (Art. 7 (3) GDPR); this does not affect the lawfulness of processing before the withdrawal.

To exercise any of these rights, please contact us using the details in section 1.

In practice, the only personal data we actively hold is what you send us through the contact form (stored by our form provider and in our email inbox); these rights apply to that data. The server access logs (section 2) are not used to identify visitors, and we generally cannot link them to a specific person — so for that data we may be unable to act on a request unless you provide information that lets us locate the relevant entries (Art. 11 GDPR).

7. Right to lodge a complaint

If you believe that our processing of your personal data infringes data protection law, you have the right to lodge a complaint with a supervisory authority. In Austria, the competent authority is:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority) Barichgasse 40–42, 1030 Vienna, Austria Email: dsb@dsb.gv.at Website: www.dsb.gv.at

8. Changes to this policy

We may update this privacy policy if the website or the applicable law changes. The current version is always available on this page; the date at the top shows when it was last revised.