Privacy policy

This page describes what data Lotus Vault processes, why, and what you can do about it. The data controller is Patrice Yolle, reachable at patrice@yolle.net.

Data we collect

Your account: email address, username and password. The password is never stored in plain text — only a bcrypt hash is kept. Legal basis: performing the service you requested. We also record the country you signed up from and the country of your latest sign-in, derived from your IP address by Cloudflare (the IP address itself is not kept), on the basis of our legitimate interest in securing accounts and knowing our audience.

Your content: your decks, your collection, your shopping lists and your recorded games. They belong to you and are visible only to you, unless you deliberately create a share link.

Card scanner: photos taken by the scanner never leave your device. Recognition runs entirely in your browser, against a fingerprint database downloaded once. No image is ever sent to a server, or kept.

Technical logs: Cloudflare keeps request logs (IP address, timestamp, user agent) for security and abuse-prevention purposes. Legal basis: our legitimate interest in running the service.

Cookies and local storage

Lotus Vault uses your browser's local storage to keep your session open and remember your display preferences. These are strictly necessary for the site to work and do not require your consent.

The site also uses Cloudflare Turnstile on the registration, password-recovery and contact forms, to tell a human from a robot without setting you a puzzle.

Usage measurement

To know which features are used, the server records anonymous events — for example "a deck was created" or "a playtest was started" — with their date, the country the request came from (derived from the IP address by Cloudflare) and, when you are signed in, your account identifier. These events contain no IP address, no user agent, no cookie and no content (no deck name, card or message). They are kept for 13 months, then deleted. If you delete your account, the events are kept but unlinked from it. Legal basis: our legitimate interest in understanding and improving the service.

Contact form

When you write to us through the contact form, we store your message (category, subject, text), the email address to answer (your account's address when you are signed in), the date and, for a bug report, the page you came from, your screen size and your browser (user agent). The form is protected by Cloudflare Turnstile. The message is forwarded to our support mailbox and a confirmation is sent to you, through Cloudflare's email services. We keep it for 24 months after the request is closed; deleting your account deletes the messages linked to it. Legal basis: our legitimate interest in answering you (and, for a request about your account, performing the service).

Advertising

To cover its costs, the site may display advertisements supplied by Google AdSense. Google and its partners may set cookies to measure audience and, if you consent, personalise adverts. A consent banner lets you accept or decline: declining is as easy as accepting, and declining does not cost you any functionality — you will simply see non-personalised adverts. You can change this choice at any time from the link provided for that purpose, and manage your Google advertising preferences at myadcenter.google.com.

Processors and transfers

Cloudflare (hosting, network, sending transactional emails), Google (advertising and consent), Scryfall and EDHREC (card data, called server-side — your browser never contacts them directly). Some of these providers are established outside the European Union; transfers rely on the Commission's standard contractual clauses.

Retention

Your account data and your content are kept for as long as your account exists. Deleting your account erases your decks, your collection and your games. Password reset links expire after 60 minutes.

Your rights

You have a right of access, rectification, erasure, restriction, objection and portability. Your account already lets you export your collection as CSV and your decks as text. You can also delete your account yourself from your profile page, by confirming your password. For any other request, write to patrice@yolle.net. You can also lodge a complaint with the CNIL.

In case of discrepancy, the French version prevails.