RiftCardex
Privacy Policy
Last updated: 19 June 2026
1. Who is responsible for your data?
RiftCardex is published by Kapé Apps (a personal, non-professional project).
Contact (exercising your rights, questions): contact@riftcardex.com
RiftCardex is a collection-tracking app for the Riftbound card game. It is an independent project, not affiliated with Riot Games.
2. What data, and only if you create an account
Without an account, RiftCardex runs 100% locally: your collection, your wishlist and your settings are stored on your device only and are not transmitted to anyone.
If — and only if — you create an account to sync your data across your devices, we process:
| Data | Purpose | Legal basis |
|---|---|---|
| Email address (+ password, managed by Firebase Authentication) | Create and secure your account, sign you in | Performance of the service you request (art. 6.1.b GDPR) |
| Your collection, wishlist, settings | Sync this data across your devices | Performance of the service you request (art. 6.1.b GDPR) |
| Google identity (email address, account identifier, basic profile: name, picture) — only if you choose “Continue with Google” | Create and secure your account via your Google account | Performance of the service you request (art. 6.1.b GDPR) |
Signing in with Google (optional): if you choose to sign in via “Continue with Google”, authentication relies on your Google account, with Google acting as identity provider. We then receive your email address, your Google account identifier and the associated basic profile information, solely to create and secure your account — no other use, no sharing.
We collect no other data: no advertising, no analytics tracker, no geolocation, no access to your contacts or files. No profiling and no automated decision-making.
Short-link sharing (optional)
If you create a short link to share a card list (the “Get a short link” action, restricted to signed-in accounts), that card list is stored and made publicly accessible to anyone holding the code, until its automatic expiry (about 15 days) — that is the very purpose of sharing. The link is tied to your account (for quota and management). You can delete a link at any time (“My short links” screen), and all your links are deleted if you delete your account. Classic link sharing (…/l/#…), on the other hand, records no data on our servers: the list is encoded in the link and travels with it.
3. Who hosts this data
Accounts and synchronisation rely on Google Firebase (Firebase Authentication + Cloud Firestore), our sole processor. Your collection data is stored in the europe-west9 (Paris, EU) region.
Transfers outside the EU: your collection data is hosted in the EU. However, as Google LLC is a US company, certain technical operations (notably authentication) may involve processing in the United States. These transfers are covered by the EU-US Data Privacy Framework adequacy decision (to which Google adheres) and by the European Commission's standard contractual clauses incorporated into the Firebase contract.
Card images are loaded from Riot Games' content delivery network (CDN); your IP address is therefore visible to that CDN, as with any image displayed from the Internet.
Exchanges with our servers are encrypted in transit (HTTPS/TLS).
4. How long
Your account data is kept for as long as your account is active. It is deleted when you delete your account (immediately in the application; a short technical delay may apply while backups are purged). Short sharing links expire automatically (~15 days) and are then erased, and are purged immediately when the account is deleted.
5. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection regarding your data.
- Delete your data yourself: in the application, screen Account → Delete account (erases your account and your data in the cloud). You may also submit a request (see the Account deletion page).
- Exercise your other rights / ask a question: contact@riftcardex.com
- Complaint: you may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
6. Minors
RiftCardex is intended for people aged 15 and over. If you are under 15, do not use the account feature without your parents' consent.
7. Changes
This policy may be updated; the date at the top of the page indicates the latest version. Significant changes will be announced in the application.
Courtesy translation. This English version is provided for convenience only. In the event of any discrepancy between this version and the French version, the French version prevails.