Privacy policy for Zementor

Overview

This privacy policy applies to the Windows program “Zementor – TCG Deck Builder”. Zementor works without an account and without a server of its own. As the developer, I receive no data from you; the program contains no ads, no analytics or tracking tools, sends no crash reports and does not check for updates by itself.

To show card data and card images, Zementor connects to Scryfall. Only if you set up the AI assistant with your own OpenAI API key do requests also go to OpenAI (see below).

The website you download the program from is covered by the general privacy policy.

Controller

Kai Röhr, contact details in the legal notice.

Data on your computer

Zementor saves your decks only as files where you save them. The program’s settings folder (%APPDATA%\zementor) also holds:

• a cache of card data from Scryfall (the cards already shown or, if you download them, all cards), so the program also works without internet,
• the list of recently opened decks,
• your preferences, for example column widths and view,
• your OpenAI API key, if you enter one, encrypted with the Windows Data Protection API (DPAPI) so that it can only be read under your Windows account.

This data stays on your computer; I have no access to it. You can clear the card cache in the settings; everything else goes with the settings folder.

Card data from Scryfall

Zementor loads card data, search results and card images directly from your computer from Scryfall (Scryfall, LLC, USA; api.scryfall.com, cards.scryfall.io and data.scryfall.io). Scryfall receives your IP address, the names of the cards you search for or view and your search terms, but no information about you or your decks as a whole. I receive nothing from these requests. Scryfall processes the data in the USA; this is governed by their privacy policy: https://scryfall.com/docs/privacy. Without this connection, the program cannot show new cards; cards already loaded also work offline.

Legal basis: Art. 6 (1) (f) GDPR. Zementor only fetches the cards you search for or view, because it cannot serve its purpose without card data. This is in your and my legitimate interest.

AI assistant with OpenAI

The AI assistant is optional and only works with your own OpenAI API key. When you use it, Zementor sends directly from your computer to OpenAI’s programming interface (api.openai.com):

• your request to the assistant, as you type it,
• the current deck: card names, quantities, your comments on the cards, sideboard, format, commander and deck name,
• for “Explain”, the name of the card you want explained.

If your request contains a web address, OpenAI fetches that page through its own web search. As with any internet connection, OpenAI also receives your IP address.

The requests are billed to your OpenAI account. That makes you OpenAI’s customer, and processing at OpenAI, including how long OpenAI keeps requests, is governed by the terms and privacy policy of your OpenAI account: https://openai.com/policies/. OpenAI may also process data in the USA. I receive nothing from these requests. Please don’t put personal details into your requests.

The legal basis is your consent (Art. 6 (1) (a) GDPR), given by sending a request. You can withdraw it at any time by no longer using the assistant. The AI’s answers are marked as AI results in the program and can be wrong.

Printing and export

Printing and the Tabletop Simulator export happen on your computer only; nothing is transmitted.

Your rights

As I receive no data from you, I cannot hand over, correct or delete any: only you control your data, on your computer. For data at Scryfall or OpenAI, please contact the provider. In general, you have the rights under Art. 15 to 21 GDPR and the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). For questions, you can reach me at the email address given in the legal notice.

Changes

If the program changes in a way that processes different data, I will update this policy.

Last updated: November 2026