Privacy policy

This page describes what data Lotus Vault processes, why, and what you can do about it. The data controller is Patrice Yolle, reachable at patrice@yolle.net.

Data we collect

Your account: email address, username and password. The password is never stored in plain text — only a bcrypt hash is kept. Legal basis: performing the service you requested.

Your content: your decks, your collection, your shopping lists and your recorded games. They belong to you and are visible only to you, unless you deliberately create a share link.

Card scanner: photos taken by the scanner never leave your device. Recognition runs entirely in your browser, against a fingerprint database downloaded once. No image is ever sent to a server, or kept.

Technical logs: Cloudflare keeps request logs (IP address, timestamp, user agent) for security and abuse-prevention purposes. Legal basis: our legitimate interest in running the service.

Cookies and local storage

Lotus Vault uses your browser's local storage to keep your session open and remember your display preferences. These are strictly necessary for the site to work and do not require your consent.

The site also uses Cloudflare Turnstile on the registration and password-recovery forms, to tell a human from a robot without setting you a puzzle.

Advertising

To cover its costs, the site may display advertisements supplied by Google AdSense. Google and its partners may set cookies to measure audience and, if you consent, personalise adverts. A consent banner lets you accept or decline: declining is as easy as accepting, and declining does not cost you any functionality — you will simply see non-personalised adverts. You can change this choice at any time from the link provided for that purpose, and manage your Google advertising preferences at myadcenter.google.com.

Processors and transfers

Cloudflare (hosting, network, sending transactional emails), Google (advertising and consent), Scryfall and EDHREC (card data, called server-side — your browser never contacts them directly). Some of these providers are established outside the European Union; transfers rely on the Commission's standard contractual clauses.

Retention

Your account data and your content are kept for as long as your account exists. Deleting your account erases your decks, your collection and your games. Password reset links expire after 60 minutes.

Your rights

You have a right of access, rectification, erasure, restriction, objection and portability. Your account already lets you export your collection as CSV and your decks as text. For any other request, write to patrice@yolle.net. You can also lodge a complaint with the CNIL.

In case of discrepancy, the French version prevails.