Privacy policy

Last updated 28 October 2026 (sharing decks and collections).

Yama (yama.ing) is a free, non-commercial hobby app for playing and tracking Magic: The Gathering Commander games. It is run by one person, Bryan Roscoe, on a home server in the United States. This page says what Yama stores, why, who else is involved, and how to have your data deleted.

What Yama gets from Google

You sign in with Google. Yama asks Google only for your basic profile: your email address, your name and Google's ID for your account. Yama uses them to make and recognise your account and to show your name to people you play with. It does not get your password and has no access to your Gmail, contacts, calendar, Drive or anything else in your Google account.

What you put in

Whatever you create in Yama is stored with your account: decks and their versions, your card collection, life totals and logged games, playgroups, online games and where they stop for you, deck plans and review answers, simulation runs, script keys, and the apps you connect, such as Claude (their keys and sign-in tokens are stored only as a one-way hash).

Who can see it

Your data is private to your account until you share it.
Sharing is yours to turn on. A deck you share by link can be seen by anyone who has its link; a deck you make public is also listed on your profile at /u/ and the handle you pick. A shared deck shows its card list, the printings its exports name, its commander's art and the bracket you declare. If you show your collection, your profile lists the names, printings, finishes, conditions and counts of your real cards. Sharing never shows your name, email, prices you paid, notes, where cards are filed, proxies, plans, games or playgroups. Turn it off, or reset a deck's link, any time; it takes effect at once. Shared pages ask search engines not to index them.
The public precon reference contains stock decklists, dated public source data and deliberately published stock-precon simulation results. It does not publish your decks, collection, plans, games, personal experiments or account details. Reading it requires no account and does not load your private data.
The exception is what you choose to share with others: people in a playgroup you join, or players in a game you play together, see that game and the names and decks shown in it.
The person who runs Yama can see the database while maintaining the server, and looks only when needed to keep it working or to answer a request from you.
To help with a problem, an admin can view your account as you see it, read only, for up to 30 minutes at a time ("View as"). They can't change anything, and your script keys, connected apps and Ask Claude (your conversations and any API key you saved) stay hidden. They can't connect an app to your account.
Yama doesn't sell, rent or trade your data, shows no ads and uses no analytics or tracking.

Cookies

Yama sets one cookie, yama_session, which keeps you signed in for up to 90 days. There are no advertising or tracking cookies. Google's sign-in button may set Google's own cookies under Google's policies.

Other services involved

Google handles sign-in.
Cloudflare carries traffic between your browser and the server, so it sees your IP address and requests.
Scryfall serves card images and card data. Your browser loads images straight from Scryfall, so Scryfall sees your IP address.
Commander Spellbook receives a deck's card list (by card ID, with no account details) when Yama checks a deck for combos and its Commander bracket.
Apps you connect. If you connect Claude (Claude Code, or a connector in Claude's apps) after Yama asks you to allow it, that app reads your decks, plans, Review, collection and lab runs through Yama's tools, under its own terms. Disconnect it any time in Decks, Plans, Settings.

IP addresses and logs

Yama uses your IP address for a short time, in memory, to limit repeated sign-in attempts. It is not stored with your account and is forgotten when the server restarts. The server keeps short technical logs for fixing problems.

How long data is kept, and deleting it

Your data stays until you ask for it to be deleted. To delete your account and everything stored with it, email [email protected] from the address you sign in with. It will be removed from the live database, and from backups as they are replaced. You can also remove Yama's access in your Google account's security settings at any time.

Children

Yama isn't meant for children under 13, and doesn't knowingly collect their data.

Changes

If this policy changes, this page will show the new date. Questions: [email protected].

Yama is unofficial fan software, not affiliated with, endorsed by, or sponsored by Wizards of the Coast. Card data and images come from Scryfall.