Tome of Fyendal

Tome of Fyendal (tomeoffyendal.com) is a community-run price tracker for the Flesh and Blood trading card game, run by Orbital Solutions, Puerto Rico. Contact: [email protected]. It is not affiliated with Legend Story Studios, Discord or TCGplayer.

This page says what we collect, why, who can see it, how long we keep it and how to have it removed. In short: we never store the text of anyone's messages, we never sell or share data, and you can remove yourself at any time from the My data page.

1. Members whose marketplace posts we read

Our Discord bot reads the marketplace channels of the Flesh and Blood Discord server where its staff have invited it. It only reads; it never posts, reacts or sends messages. From a post it keeps:

• your Discord user id and display name;
• the ids of the message, channel and server, and when the post was made or edited;
• for each card line: the card, set, finish, condition, version (for example Marvel or extended art), quantity and price, plus a short summary we generate, such as "WTS · 3 cards · $12 to $95";
• whether the post had a picture (not the picture itself), and advisory flags such as "payment outside Discord or PayPal Goods & Services".

We do not store the text of your message, pictures, your email address, direct messages, member lists or online status, and we keep no seller scores or ratings. Lines that are not a card (shipping notes, playmats and so on) are discarded.

Reported before. If a post in the server's #paypal-watchlist channel names exactly one member, we mark that member "Reported before" and flag their listings. Posts naming several people are ignored. The mark stays until it is removed after a review; email us to dispute it.

2. Visitors to the website

• Signing in with Discord (optional) asks Discord for your basic profile only (the "identify" permission, no email). Your Discord id, username and avatar link are kept in an encrypted cookie in your browser, not on our server. It expires 14 days after your last visit or when you sign out.
• To decide whether to show seller names, we ask Discord once whether you are a member of the server. The answer is kept in memory for 10 minutes and not stored.
• All traffic to the site passes through Cloudflare, which protects it and speeds it up. Cloudflare sees your IP address and the pages you request, under its own privacy policy.
• Our web server logs each request's IP address, browser and page for security and to stop abuse. These logs are deleted after about 14 days.
• Card images load from TCGplayer's image server, so your browser contacts TCGplayer for them. Fonts and everything else come from our own server.
• We use only the cookies needed to run the site (sign-in and form protection). There are no ads, analytics or tracking cookies.

3. Why we use it

To show the community what Flesh and Blood cards are offered for and what they sell for, and to help members spot risky posts. For visitors in the EU and UK, our legal basis is our legitimate interest in running this community service, balanced by showing names only to signed-in members of the server, never keeping message text, and letting anyone opt out. Sign-in is used only to provide the features you sign in for.

We never sell or rent data, never use it for advertising, and never use message content to train AI models.

4. Who can see it

Seller names and "jump to post" links are shown only to visitors who are signed in with Discord and are members of the server. Everyone else sees "Server member". The data is held on a server we rent from IONOS; we use Discord's service to read the channels and check membership, and Cloudflare carries the site's traffic. Nobody else receives it, unless the law requires it.

5. How long we keep it

• A listing stays on the board until the post is deleted, is edited so it is no longer a listing, or turns 30 days old. It is then deleted for good 7 days later.
• Your member record is deleted once you have no listings, except to remember an opt-out (your Discord id only) or a "Reported before" mark (until removed).
• Sign-in cookie: 14 days after your last visit. Server logs: about 14 days.

6. Your choices and rights

On the My data page (sign in with Discord) you can see what we hold about you, delete all of your listings and opt out so the bot skips your posts, and opt back in later. You can also email [email protected] to ask for a copy of your data, a correction, deletion, or to dispute a "Reported before" mark. We answer within 30 days. If you are in the EU or UK you may also complain to your data protection authority.

7. Security

The site uses HTTPS. The database is reachable only by our two services, each with its own login and only the rights it needs; passwords and tokens are kept in a secrets vault, never in code.

8. Donations

The Support page links to a payment provider. If you donate, the provider handles the payment and your details under its own privacy policy, and we see only what it shows any payee (such as your name and the amount). The site itself collects nothing about donations.

9. Children

The site is not aimed at children under 13, the minimum age to use Discord.

10. Changes

If this policy changes, the date at the top changes too. Material changes will be announced on the site.