Privacidad
What we store
- Account: username, email, a hash of your password (never the password), and the date you signed up.
- Vaults: the cards you add, their variant, condition, quantity and any notes you write.
- Profile picture and cover image, if you upload them. They are public on your profile. Before storing them we re-draw them as new images, so the metadata your phone or camera adds —including the location where a photo was taken— is discarded and never kept.
- Session: one cookie,
kirava_sid, so you stay signed in. HttpOnly and SameSite=Lax. - Login attempts: a hash of the IP address, never the address itself, kept 24 hours to limit brute force.
- Visits: the page you opened, when, the site you came from (the domain only, never the full address), your browser's language, whether you are on a phone or a computer, your country, your IP address and the identification your browser sends (its name and version).
No third-party analytics, no advertising trackers, no external scripts. The Content Security Policy of this site blocks them outright, so there is nowhere for them to hide. The measurement is our own and it runs on our server.
About the IP address and your browser's identification
We store them, and we would rather say so plainly than bury it. They are what let us see where abuse comes from, identify a crawler that does not announce itself, and understand a request that looks wrong. It is the same thing any web server writes to its log.
The browser identification is the line every browser sends with every request, saying
what it is — Chrome 131 on Windows, roughly. We keep it because without it
we cannot tell people from the automated programs that crawl the site, and counting
crawlers as visitors makes our own numbers useless to us.
Both are deleted after 30 days. Not archived, not anonymised later — erased from the row. The visit itself is kept longer for counting purposes, without them. Nobody outside the site's administration ever sees them, and they are never shown on any public page.
Visits are not linked to your account. The identifier used to count unique visitors is a hash that changes every day, so aggregate figures cannot follow anyone across days.
What is never public
A vault is private when created. Publishing is a deliberate act. And the total value of a collection is never shown on a public page — not as a sum, not as an estimate. The owner sees it and nobody else.
The reason is not abstract: a public profile stating a collection's worth, combined with a location, is a target list. It has happened in this hobby.
Location on a profile is country only, and optional. Exact quantities are also sensitive, which is why hiding them is a switch you control.
Your rights
- Export. Every vault exports to CSV in one click.
- Deletion. Deleting your account truly erases everything that identifies you: name, email, bio, profile picture and cover image (the files, not just the link to them) and access. Your vaults are kept — set to private, under an anonymous placeholder — so that other people's follower counts and history stay intact. What remains is not personal data.
- Rectification. You can edit everything you have written from your account.