Privacy Policy

Last updated: 4 November 2026

1. The short version

CardForge needs no account for browsing or buying — no analytics, no ads. Publishing is restricted to registered seller accounts: a seller signs in with an email address and a password, and we store what sellers publish and nothing else. Riot access tokens pass through memory only, are never stored, logged, or published, and are never visible to other users. Published listings are public by design — anyone with the link can see them, so do not publish anything you would not want public. Terms of Service.

2. What we collect

• Seller account — for the small number of registered sellers: email address and a password hash (never the password itself), kept in the Service's own database and used only to gate publishing, the dashboard, and owner controls. Buyers never see it.
• Seller-published payload — the card content you choose to publish: your display name and tag, level, rank, balances you include, texts, skin picks, owned-skin markers, server region, and any images you upload (avatar and equipped player card).
• Listing fields — the slug (share link), theme, and any price or contact fields you enter on the listing.
• View counters — a simple per-listing view count. To count each visitor once per listing per day, the Service keeps a salted one-way hash derived from the visitor's IP address — never the address itself — for at most two days.

3. What we never collect

• No buyer accounts — browsing and buying never require a login, email, or password.
• No payment data — trades and payments happen off-platform, directly between buyer and seller, and never pass through the Service.
• No browsing history beyond the per-listing view counts described above, and no cross-site tracking of any kind.
• No operator personal identity beyond the service infrastructure required to run the Service.

4. Riot access tokens

The optional Import account feature lets a seller pull their own level, rank, wallet, and owned items from Riot. Riot access tokens (and any entitlements token) are sent once over HTTPS to the import function, used entirely in memory against Riot's APIs, and are never stored, logged, or published. Only the derived snapshot (level, rank tier, balances, owned-item identifiers) comes back to the browser and, if you publish, into the listing you choose to share. Riot tokens expire after roughly one hour; treat them like passwords.

5. On-device storage

Drafts of unpublished cards live only in your browser's localStorage. The edit token created for a listing is also stored in your browser; to publish, it is sent to our database, which keeps only its cryptographic hash. Nothing in local storage is uploaded unless you publish it as part of the listing payload. Clearing your browser storage deletes all drafts and edit tokens on your side.

6. Cookies and analytics

Buyers and visitors get no cookies. Sellers get exactly one: signing in sets a strictly necessary session cookie that keeps you signed in. It cannot be read by page scripts, is sent only to the Service's own data path, and expires after 30 days or when you sign out. CardForge runs no analytics, tracking pixels, or advertising identifiers. We do not sell or share data with anyone.

7. Third parties your browser talks to

To work, your browser makes a small number of direct requests to third parties. These services necessarily see your IP address and request metadata:

• Cloudflare — hosts the site, the database that stores published listings, and uploaded images (Asia-Pacific region).
• valorant-api.com — the community-run source of game item images and catalog data loaded at runtime.
• Google Fonts — the Inter and Anton web fonts used by the pages.

Links to the Service's former address (cardforge.shaheen.works) are forwarded here by Netlify, which sees the same request metadata for that one redirect.

8. Retention

Published listings remain until the seller updates or removes them, or until the operator takes one down. View counts are kept as aggregate totals and are not tied to identities; the hashed visitor identifiers behind them are deleted after two days. Records of failed seller sign-in attempts (also hashed) are deleted after 24 hours.

9. Deletion and requests

Privacy questions or deletion requests: klstore@proton.me.

• Sellers — edit or delete your own listings from the dashboard while signed in. If you need help, contact us with the listing link.
• Buyers and other requesters — for anything specific to a single listing (including its content, images, or the seller's contact details), use the seller contact link shown on that listing. Sellers are responsible for the listings they publish.

10. Children

CardForge is not directed to children under 13, and we do not knowingly collect data from them. Users aged 13–18 must have a guardian's consent to use the Service.

11. Security

All traffic uses HTTPS. Creating or managing listings requires a signed-in seller account, checked server-side on every change, and changes are recorded in an audit log. Passwords are stored only as salted, deliberately slow hashes, and repeated failed sign-ins are blocked for a while. Edit tokens are stored as cryptographic hashes, never in plaintext, and edit tokens and seller-only notes are never returned by public pages.

12. Changes

We may update this policy as the Service changes. When we do, we will revise the "last updated" date at the top of this page. Continued use after an update means you accept the revised policy.

13. Contact

Privacy questions, data requests, or takedown notices for listing content: klstore@proton.me. For legal notices see Terms of Service.