Privacy
What we store
- Account: username, email, a hash of your password (never the password), and the date you signed up.
- Vaults: the cards you add, their variant, condition, quantity and any notes you write.
- Session: one cookie,
kirava_sid, so you stay signed in. HttpOnly and SameSite=Lax. - Login attempts: a hash of the IP address, never the address itself, kept 24 hours to limit brute force.
- Visits: the page you opened, when, the site you came from (the domain only, never the full address), your browser's language, whether you are on a phone or a computer, your country, and your IP address.
No third-party analytics, no advertising trackers, no external scripts. The Content Security Policy of this site blocks them outright, so there is nowhere for them to hide. The measurement is our own and it runs on our server.
About the IP address
We store it, and we would rather say so plainly than bury it. It is what lets us see where abuse comes from, identify a crawler that does not announce itself, and understand a request that looks wrong. It is the same thing any web server writes to its log.
It is deleted after 30 days. Not archived, not anonymised later — erased from the row. The visit itself is kept longer for counting purposes, without it. Nobody outside the site's administration ever sees it, and it is never shown on any public page.
Visits are not linked to your account. The identifier used to count unique visitors is a hash that changes every day, so aggregate figures cannot follow anyone across days.
What is never public
A vault is private when created. Publishing is a deliberate act. And the total value of a collection is never shown on a public page — not as a sum, not as an estimate. The owner sees it and nobody else.
The reason is not abstract: a public profile stating a collection's worth, combined with a location, is a target list. It has happened in this hobby.
Location on a profile is country only, and optional. Exact quantities are also sensitive, which is why hiding them is a switch you control.
Your rights
- Export. Every vault exports to CSV in one click.
- Deletion. Deleting your account truly erases everything that identifies you: name, email, bio, avatar and access. Your vaults are kept — set to private, under an anonymous placeholder — so that other people's follower counts and history stay intact. What remains is not personal data.
- Rectification. You can edit everything you have written from your account.