Privacy Policy

My Waifu Cards ("we", "us", "our") is a free anime trading card collection tracker. This policy explains what data we collect, why, and what rights you have over it.

Data controller: This website is operated by an individual. For any data-related requests, contact us at [email protected]. We will respond within 30 days as required by GDPR.

1. Data we collect

Without an account (all visitors)

Your browser's local storage is used to save:

Your card collection (cards owned and quantities)
Your wishlist (cards marked as wanted)
Your theme preference (dark / light)
An anonymous sync ID (randomly generated, used only for optional legacy cloud backup)

This data never leaves your device unless you explicitly use a sync or export feature.

With a registered account (optional)

If you choose to sign in with Google or Discord, we collect and store via Supabase (our authentication and database provider):

Your email address (provided by Google or Discord)
Your OAuth profile data: display name and profile picture URL from your provider
A display nickname you choose on our site
Your full card collection (owned quantities and wishlist flags)
Timestamps of account creation and last data update

We do not store passwords. Authentication is handled entirely by Google and Discord via OAuth 2.0.

2. How we use your data

Collection sync — to save your collection across devices and sessions
Display name — to show your chosen nickname on the site
We do not use your data for advertising, profiling, or selling to third parties

2b. Legal basis for processing (GDPR Article 6)

Local storage (collection, preferences) — Legitimate interest (Article 6(1)(f)): strictly necessary for the core functionality you have come to use.
Account sign-in via Google or Discord — Consent (Article 6(1)(a)): you actively initiate authentication and can withdraw at any time by deleting your account.
Affiliate link disclosure — Legitimate interest (Article 6(1)(f)): transparency about third-party cookies that may be set when you click external links.

3. Data storage and transfers

Account data is stored on Supabase (supabase.com), a Backend-as-a-Service platform. Supabase stores data in the EU (AWS eu-west-1, Ireland). Supabase is GDPR-compliant and acts as a data processor under a Data Processing Agreement.

When you sign in with Google or Discord, those providers process your login under their own privacy policies:

4. Affiliate links

This site contains affiliate links to eBay, Amazon, and AliExpress. Clicking these links may result in cookies being set by those platforms. We may earn a small commission on qualifying purchases at no extra cost to you.

4b. Cookies and local storage

We show a cookie consent banner on your first visit with two options:

Accept — you acknowledge that local storage is used for your collection and preferences, authentication may set session cookies, and affiliate links may set third-party cookies when clicked.
Necessary only — same as above, but you explicitly limit consent to strictly necessary functionality only. Since we do not use analytics or marketing cookies, this option provides equivalent functionality.

We do not use Google Analytics or any other third-party analytics tracking. No tracking scripts load on page load.

Cookies set by Google or Discord are strictly necessary for authentication and only created when you initiate sign-in. Affiliate link cookies are set by eBay, Amazon, and AliExpress only when you actively click those links.

5. Your rights (GDPR)

If you are located in the European Economic Area or the UK, you have the following rights:

Right of access — you can export your full collection at any time from the Collection page (Download JSON).
Right to rectification — you can change your display nickname at any time by clicking your name in the header.
Right to erasure — you can permanently delete your account and all associated data by clicking your name → Delete account. This immediately removes your email, nickname, and collection from our servers. This action cannot be undone.
Right to data portability — your collection data can be downloaded as a JSON file at any time.
Right to object — since we do not use your data for marketing or profiling, this right is not applicable in our context.

For any other requests regarding your personal data, contact us at [email protected]. We will respond within 30 days.

6. Data retention

Account data is retained until you delete your account. Local storage data stays on your device until you clear it. There are no automatic retention periods — your data is yours to keep or delete.

7. Security

All data is transmitted over HTTPS. Authentication tokens are verified server-side before any account actions are taken. Your collection data is protected by Row Level Security (RLS) policies in our database — only you can access your own data.

8. Changes to this policy

We may update this policy as the site evolves. The date at the top of this page reflects the last update. Continued use of the site after changes constitutes acceptance of the updated policy.

9. Contact

Questions about this Privacy Policy? Contact us at [email protected].