Privacy Policy

Controller and contact

The business below operates Marzipan Deck and is the controller for the personal data described here. Email us with privacy questions or requests.

Operator

Dragan Atanasov

EU VAT ID

PL6762491554

Email

support@datanasov.com

Local app data

Your saved services, settings, bookmarks, favorites and recent launches stay on your device. There is no Marzipan Deck account or cloud sync. Apple device backups may include app data, depending on your backup settings.

Each service keeps its own cookies and sign-in data. You sign in directly on the provider’s website. We do not copy passwords into app settings or reports. The websites you open have their own privacy policies.

You can choose to show your game title and artwork on the Lock Screen or Dynamic Island with Live Activities. Updates are handled on your device. You can change this in the app’s iOS settings.

Optional app reporting

App reporting is optional and off by default. If you enable it, Google Analytics for Firebase receives basic usage, such as which app tab you visit and when playback starts or ends. Firebase Crashlytics receives crash details, app version and device information to help us fix problems. Automatic app events and information leading up to a crash may also be included.

Reports use app or installation IDs, called pseudonymous identifiers. They may include approximate location based on your IP address. The app does not ask for your location. We do not add game titles, saved service names, website addresses, credentials, artwork searches, or a personal account ID.

You can use the app and purchased features without reporting. Advertising consent and advertising identifier features remain off.

Change your choice with Share usage and crash data in Settings. Turning it off stops future reporting, resets local Analytics data and clears unsent crash reports. Reports already received by Google are not automatically deleted. App and website choices are separate.

Artwork and external websites

To search for artwork, you can add your own SteamGridDB API key in Settings. It stays in your device’s Keychain without iCloud sync and is sent directly to SteamGridDB over HTTPS to authorize requests. We do not receive the key or include it in reporting.

Saving a key works offline. Check Connection runs a small, uncached search for Portal to confirm it works, without changing your Library. Artwork searches send the game title you enter. Image requests use game or image IDs. SteamGridDB and image hosts receive your IP address, request details and ordinary network information. SteamGridDB may link API requests to your account.

Opening the game editor does not automatically request artwork. Manual game details and HTTPS image addresses remain available without a key. Loading a saved image contacts its host, even if you later remove your API key. Artwork requests and gaming website traffic are separate from optional app reporting.

Remove the key in Settings → Artwork Providers → SteamGridDB to stop API search and cancel outstanding API work. This keeps your bookmarks and cached images. Revoke the key separately on SteamGridDB’s API preferences page. Its service is subject to SteamGridDB’s Privacy Policy.

Gaming websites, embedded services and other image hosts apply their own privacy policies to requests you make through them.

Purchases and support

Apple processes Pro purchases. The app uses StoreKit to verify purchase and Family Sharing entitlements. We do not receive your payment card details. Gaming accounts, games and provider subscriptions are separate. See Apple’s Privacy Policy for Apple’s processing.

If you contact support, we receive your email address, message and any attachments or diagnostics you choose to send. We use our email service to reply and help with your request. Please leave passwords, sign-in codes, API keys and payment details out of messages and screenshots.

Website and cookies

Cloudflare hosts and protects this website. It may process IP addresses, requested pages, browser information and operational or security logs to deliver the site and prevent abuse. See Cloudflare’s Privacy Policy.

Optional website analytics stays off until you select Accept or enable Analytics in Cookie preferences. Once accepted, Google Analytics for Firebase measures visits, pages viewed and engagement using cookies and pseudonymous identifiers. Reports may include device and browser information, referral information and approximate location derived from IP addresses. Advertising consent, Google signals and advertising personalization remain disabled.

• marzipan_consent is an essential cookie that remembers either choice for 180 days.
• marzipan_ga and cookies beginning marzipan_ga_ are optional analytics cookies, set only after acceptance and lasting up to 180 days.
• Temporary storage in this browser tab helps remember a refusal if the consent cookie cannot be updated.

Use Cookie preferences in any page’s footer to review or withdraw consent. Rejection leaves optional analytics off. Withdrawal stops future collection, clears analytics cookies where browser storage permits and reloads the page when the refusal can be preserved. It does not erase previously submitted reports. Your app reporting setting is independent of this choice.

Why we process data

Where the GDPR applies, we rely on:

• Consent for optional app reporting and website analytics. You can withdraw it at any time without affecting the lawfulness of earlier processing.
• Providing the app and purchases to deliver the features you request and support them. The legal basis is performance of a contract or steps you ask us to take before one.
• Legitimate interests to run and protect the website, answer other enquiries and handle legal claims, while respecting your rights.
• Legal obligations where records must be retained or information disclosed under applicable law.

Optional reporting is not required to browse the website or use purchased features. Details needed for a support request are voluntary, but we may be unable to resolve it without relevant information. We do not sell your personal data or use it to make solely automated decisions with legal or similarly significant effects.

Providers and international transfers

We use Google for optional analytics and crash reporting, Cloudflare to run the website and an email provider for support. Information may also be shared when needed to meet legal duties or handle a legal claim. Apple, gaming providers, SteamGridDB and other websites have their own policies for their services.

Providers may process data outside Poland and the European Economic Area, including in the United States. Where required, provider arrangements use legal safeguards such as adequacy decisions or standard contractual clauses. Contact us if you would like more information about these safeguards.

See Firebase Privacy and Security, Google’s Privacy Policy, Google’s data transfer frameworks and Cloudflare’s Data Processing Addendum. Google Analytics is a separate service with its own terms, even when used through Firebase.

Retention and deletion

You can edit or remove local settings and bookmarks in the app. Settings → Data & Storage lets you clear cached artwork and service website data. Clearing website data signs you out on this device, while your provider account stays in place. Deleting the app removes its local app data. Apple backups are managed separately.

Artwork search results are cached for 24 hours, with older results sometimes reused offline. Downloaded images stay until you clear the cache or the system removes them. Saved image addresses and source details stay with your bookmarks until edited or deleted. You can remove your API key through Artwork Providers.

Website cookie lifetimes are listed above and are separate from retention of reports already uploaded. Analytics report retention follows the relevant Google Analytics property settings. Google states that Crashlytics retains crash traces and associated identifiers for 90 days before beginning removal from live and backup systems.

Support records are kept as needed to resolve your request and follow-up issues and longer where needed to meet legal duties or establish or defend claims. Website operational logs are kept for delivery, troubleshooting and security under the hosting configuration. Retention depends on those purposes and any applicable legal requirements. Contact us to ask about current reporting retention or request deletion.

Your privacy rights

Depending on the law that applies, you can ask to access, correct, delete, restrict use of, or receive your personal data in a reusable format to transfer elsewhere. You can also object to use based on legitimate interests and withdraw consent for optional reporting. These rights apply within the conditions set by law.

Email support@datanasov.com and tell us what you need. We may ask for enough information to confirm the request is yours. App IDs can make it difficult to find a report belonging to a particular person. We normally respond within one month and explain if the law allows more time.

You can complain to the data protection authority where you live or work, or where an alleged infringement occurred. In Poland, the authority is the President of the Personal Data Protection Office, UODO. You do not have to contact us before exercising that right.

Children and policy changes

Marzipan Deck is not directed at children. Follow the age rating for your App Store territory and the eligibility rules of each gaming provider. Contact us if you believe a child has supplied personal information to us inappropriately.

We update this policy when our data practices change and show the revision date above. Where required, we provide notice or request new consent. Read the Terms of Use for service conditions, or visit Support for help with local data controls.