Privacy Policy
Last updated: 2026-07-06
This is a non-commercial fan project for card collectors. This policy explains what data we process, why, and what cookies we use. We collect the minimum needed to run your account and keep it secure.
Who processes your data
The site administration processes your data solely to provide this service — creating and running your account and collection. We do not sell your data and do not use it for advertising.
What data we collect
Account data: your email address, a display name, and your password. The password is never stored in plain text — only a one-way bcrypt hash is kept, which cannot be reversed back into your password.
Collection data: the cards, waves and rarities you add to your collection and wishlist, plus your personal settings (such as a Telegram ID, if you choose to enter one).
Technical data: basic request logs (including IP address) kept for a limited time for security and abuse prevention.
Why we use it
To authenticate you and keep you signed in; to verify your email and let you reset a forgotten password; to save and display your collection and wishlist; and to protect the service against abuse.
Cookies
We use exactly one cookie, named "auth_token". It is a strictly necessary session cookie that keeps you signed in after you log in. It is httpOnly (not readable by page scripts) and is not used for tracking.
We do not use any analytics, advertising, or third-party tracking cookies. Because the only cookie is strictly necessary to provide the service, no separate consent banner is required. Deleting this cookie simply signs you out.
Third parties
Uploaded images (such as a custom logo) may be stored in an S3-compatible object storage service. Verification and password-reset messages are sent through an email delivery provider. These providers process only the data needed to perform those functions and do not receive your collection data.
How long we keep it
Account and collection data are kept for as long as your account exists. When your account is deleted, the associated personal data is removed. Limited security logs may be retained for a short period afterwards.
Your rights
You can view and edit your profile and collection at any time from your account, and you can request deletion of your account and associated data. To exercise these rights or ask any privacy question, contact the site administration.
Changes to this policy
We may update this policy from time to time. The date at the top reflects the latest version. Significant changes will be communicated where appropriate.