Privacy notice

Who processes your data

Controller: Nikolas Costa, reachable at nikolas.costa91+cardsarchive@gmail.com.

What we collect

Account: email address, username, preferred language and currency, password (stored only as a scrypt hash). If you sign in with Google we receive only your confirmed email address from Google; we keep no name or picture.

Collection: the cards you record, with quantity, condition, language, finish, locations and notes.

Sessions: the IP address and browser type of each sign-in, to protect your account.

Technical server logs (IP address, requested page, result), for security and troubleshooting.

Why, and on what basis

We use the data only to provide the service you asked for by signing up (legal basis: performance of a contract, GDPR art. 6(1)(b)) and to protect it from abuse (legitimate interest, art. 6(1)(f)). We do not sell it, show ads or build profiles.

Providers

Service emails (address confirmation, password reset, account notices) are sent from a Gmail account through Google’s SMTP server: Google processes your email address and the message to deliver it, and a copy stays in that account’s Sent folder. Google may process this data outside the European Union, under the safeguards in its terms.

The service runs on the controller’s own server, at their home: no hosting provider processes your data. The card data providers (YGOPRODeck, TCGdex) receive none of your data: the server downloads the catalog and the images itself, never with anything about you.

When you choose a new password, we send only the first 5 characters of its SHA-1 hash to the Have I Been Pwned service, to check it does not appear in known breaches: the password never leaves our server.

How long

Account and collection: until you delete the account. Sessions: 7 days after last use. Technical logs: 14 days. Backups: deleted data disappears from them too within 5 weeks.

Cookies

We use only strictly necessary cookies: the sign-in session, a reminder to renew it once a day and, only during Google sign-in, the interface language. No tracking or third-party cookies, hence no banner.

Your rights

You can download all your data and delete your account from your account page at any time. For access, rectification, restriction, objection or portability write to nikolas.costa91+cardsarchive@gmail.com. You can also lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, garanteprivacy.it).