Privacy & cookies

Last updated: 6 September 2026

Rift-Tracker is a private card collection tracker. This page explains what data we store and why we don’t show a cookie consent banner.

Cookies we use

Name	Purpose	Type
rb_sid	Keeps your session alive after you sign in with Google or an email link (HttpOnly, SameSite=Lax, Secure over HTTPS).	Essential
CF_Authorization	Optional Cloudflare Access layer protecting the admin dashboard. Set only when Cloudflare Access is enabled.	Essential / security

We also store small interface preferences in your browser (for example, the collection view you picked) in localStorage. These are not cookies and are not used to identify or track you.

Why there’s no consent banner

Under the GDPR and the ePrivacy Directive, consent is required only for non-essential cookies (analytics, marketing, tracking). Cookies strictly necessary to provide a service the user explicitly requested — and an authentication cookie is the textbook example — are exempt. Since Rift-Tracker itself sets no analytics or marketing cookies at all, no consent banner is required. The counts described under “What we count” need no consent either: consent under the ePrivacy Directive is required for storing or reading information on your device, and those totals are worked out on our own server from a request you had already sent us. Nothing is written to your browser, and nothing is read from it.

Affiliate links

Some “buy this card” buttons are affiliate links. The TCGplayer buttons go through impact.com, TCGplayer’s affiliate network: clicking one sends you to their tracking domain, which records the click and forwards you to the product page. If you then buy something, Rift-Tracker earns a commission — the price you pay is unchanged, and the links never influence which card, which printing, or which price we show you.

Rift-Tracker sets no cookie for this. The tracking cookie is set by impact.com and TCGplayer on their own domains, after you choose to click, and is governed by their privacy policies — we receive only anonymous, aggregated click and commission counts, never your identity or what you bought.

We do keep our own tally of these clicks, and it is deliberately a tally and nothing more: when a buy button is clicked, we add one to a daily total for that storefront and that card. There is no column for who clicked, and no cookie or identifier involved, so the most this record can ever say is “the TCGplayer button on this card was clicked eleven times on Tuesday”. It exists so we can tell whether the buy buttons are worth showing at all.

What we count

We run no analytics product, first-party or third-party. There is no Google Analytics, no Plausible, no Meta pixel, no session recording, and no advertising or tracking script of any kind — the only JavaScript on these pages is our own, and it talks to no one but this server. What we do keep is three deliberately small things:

• Affiliate button clicks — a daily total per storefront and per card, with no record of who clicked. Described in full above.
• Phone versus laptop — for each day, how many page views came from a mobile browser and how many from a desktop one. This is worked out on the server from the User-Agent header your browser sends with every request, and stored only as those two running totals. There is no visitor record behind it: the totals are the entire dataset, and they cannot be traced back to a person, a session, or an address.
• Your own activity, on your own account — when you add, edit or remove a card or a sealed product, we log that you did, what it was, and when. This one is tied to your account, because it is the history of your own collection: it is what lets us answer “where did that card go?”, investigate a bug you report, and see that an import did what you expected. It records the action, not your browsing — we do not log which pages you visit or which cards you look at. These entries are deleted automatically after 90 days, and they go when your account goes.

We keep no web server access log of your browsing, and we do not build a profile of you, sell data, or share any of this with an advertiser.

What data we store

• Your email address, name, and profile picture from your Google account (to sign you in and show your profile).
• The contents of your collection, decks, and wishlist, plus your friend relationships and messages.
• A 90-day log of the changes you make to your own collection, and a security log of sensitive account events (password changes, sign-outs from all devices, and admin actions), which records the IP address the request came from.

Your data is private to your account, and visible to others only to the extent you choose to share it with friends.

Contact

For questions about your data, contact the application administrator.

← Back to the app