Privacy policy

Who we are

Runekeeper is a free, non-commercial fan application for tracking a Riftbound card collection, sharing it inside a team and keeping track of cards lent to other players. It is not affiliated with Riot Games. The operator of this service is responsible for the data processed here.

What data we store

Account data: display name, email address, avatar, your Discord account identifier and the access tokens Discord issues at sign-in, the interface language you choose and timestamps of account creation and updates. If the operator turns on sign-in with a password, a salted password hash is stored for accounts that use one.

Collection data: the binders you create and the cards, quantities, finishes, languages, conditions and notes you record in them.

Team, loan and deck data: teams you create or join, invite codes, the loans you take part in as lender or borrower (card, quantity, note, status, dates), the history of changes to those loans, and the decks you build together with their assembled state.

Technical data: session records (token, expiry, IP address, user agent) needed to keep you signed in, short-lived rate-limit counters used to protect the service from abuse, and application logs kept for up to 14 days (error message, route, HTTP status and the id of the signed-in user, if any).

Who can see your data

Your collection is private by default. Members of a team you join can see your display name, the cards and quantities counted towards that team's shared view, the loans you take part in and the decks you mark as assembled. Leaving the team ends that access for cards counted afterwards.

Cookies

We use strictly necessary cookies only: a session cookie that keeps you signed in, a short-lived cookie that protects the Discord sign-in from forged requests, and a cookie that remembers your interface language. Cloudflare may set its own security cookies to tell people from bots. No analytics or advertising cookies are set.

Purpose and legal basis

Data is processed solely to provide the service you asked for: signing you in, storing and displaying your collection, teams, loans and decks, and, where used, sending transactional emails. The legal basis is the performance of the agreement between you and the operator. Traffic filtering by Cloudflare relies on the operator's legitimate interest in keeping the service safe and available.

Third parties

Card data is sourced from the Riftcodex API and the official Riftbound card gallery. Card images are downloaded by the server and served from here, so your browser never contacts external card services.

Sign-in uses Discord (Discord Inc., USA). When you choose Continue with Discord, you sign in on Discord's own page and Discord shares your account identifier, display name, avatar and email address with Runekeeper. We do not see your Discord password, servers or messages. Discord handles the sign-in under its own privacy policy, and you can remove Runekeeper's access at any time in Discord under Settings, Authorized Apps.

The site runs behind Cloudflare (Cloudflare, Inc., USA), which passes every request on to our server and filters out attacks and abusive traffic. To do that Cloudflare processes your IP address, the requested address, your browser's user agent and similar technical request data. Cloudflare acts as a processor for the operator.

Discord and Cloudflare may process data outside the European Economic Area. Both take part in the EU-US Data Privacy Framework and offer the European Commission's standard contractual clauses.

Emails, if any are sent, go through the SMTP provider configured by the operator. Links to marketplaces such as Cardmarket open external websites with their own privacy policies.

Retention and your rights

Your data is kept for as long as your account exists. You can download a copy of your data and permanently delete your account, including all binders, collection entries, teams you own and decks, from the settings page at any time. Active loans have to be returned or cancelled first, so the other side is not left with an open entry. You may also ask the operator to access, correct or erase your data.