Privacy policy

Last updated 28 August 2026 · Legal notice · Terms

The short version

You can read the whole site without an account and without giving anything away except what every web server sees. If you make an account, the site stores what you type into it and what you do with it — listings, decks, posts, messages, games. Nothing here is sold, rented or handed to an advertising network; there is no advertising network on this site. Delete your account and it all goes, apart from the few records the law requires to be kept.

Who is responsible for it

The data controller is the publisher of lorcana-market.com, identified in the Legal notice. Any request about your data goes to admin@lorcana-market.com and is answered by a person, within a month at the outside and usually the same week.

What is actually stored

Every visitor, with or without an account

Every page load is logged by the site's own audience counter: your IP address, the browser's user-agent string and what is derived from it (device type, browser, operating system), the pages you open with their timestamps, the referring site, and an approximate country and city. Nothing else. This log is first-party — it stays on this site's database, is used to know how many people came and from where, and is never cross-referenced with any other site.

If you create an account

• Identification — username, email address, password (stored only as a hash; the site never holds the password itself), display name, avatar, and the account's creation and last-activity dates.
• What you publish — forum threads and posts, likes, card analyses and notes, decks, collection and inventory, marketplace listings, buy orders and offers, reviews and reputation received from other members.
• Interactions — private messages and chat with other members, friend list, people you blocked or muted, gifts sent and received, reports you file.
• Games — game rooms, actions played, statistics, leaderboard scores, and the balance and movements of the site's virtual currency.
• Preferences — theme, language, notification settings, and — only if you turn them on — the browser push subscription needed to send you a notification.

If you buy or sell on the marketplace

Order records: what was bought, from whom, when, for how much, and the delivery address the buyer entered. Payment is handled by Stripe: the site records that a payment succeeded or failed and the reference Stripe returns. Card numbers never reach this site — they are entered on Stripe's own page. A seller who receives money goes through Stripe's own identity checks, with Stripe, and the documents involved never pass through this site.

Why, and on what legal basis

• Running your account, the marketplace and the games — performance of the contract you enter into by signing up (GDPR art. 6-1-b).
• Audience measurement, keeping the site up, blocking bots and abuse — legitimate interest (art. 6-1-f): a site cannot be kept alive without knowing that it is being used and how it is being attacked.
• Push notifications — your consent, given by enabling them, withdrawable at any moment from your notification settings (art. 6-1-a).
• Accounting records for completed sales — legal obligation (art. 6-1-c).

Who else sees it

Four outside parties, each for one job, and none of them receives anything beyond what that job needs:

• Hostinger (Cyprus, EU) — hosts the site and its database.
• Stripe Payments Europe (Ireland, EU) — processes payments; its own privacy policy applies to what you type on its page.
• ip-api.com — receives an IP address to return a city and country.
• The browser push service of your own browser vendor (Google, Mozilla, Apple) — only if you enabled notifications, and only to deliver them.

Beyond that: nothing is sold, nothing is rented, and there is no analytics or advertising tag on this site. Data may be disclosed to a competent authority when a legally valid request requires it, and to no one else.

What other members see is a separate matter and is decided by you: your username, avatar, public profile, posts, listings, decks and leaderboard scores are visible to other users by design. Your email address is not.

How long it is kept

• Account and everything attached to it — as long as the account exists, and erased when you delete it.
• Visit log (IP, pages, device) — 13 months, then deleted.
• Private messages — until deleted by a participant or with the account.
• Order and invoice records — 10 years, as French commercial law requires. These survive account deletion; there is no way around that one.
• Moderation records (reports, bans) — up to 3 years, so a banned account cannot be reopened the next day.

Cookies and what is kept in your browser

The site sets a session cookie, which is what keeps you logged in, plus a security token that blocks form forgery. Both are strictly necessary for the site to work, and neither asks for consent under French law, which is also why you are not being shown a cookie banner. Your theme and language choices are kept in your browser's local storage, on your machine, and are never sent anywhere. There are no advertising cookies and no third-party trackers on this site. Clearing your browser data removes all of it.

Your rights, and how to use them

Under the GDPR you may ask for access to your data, correction of anything wrong, erasure, restriction of processing, portability in a machine-readable file, and you may object to processing based on legitimate interest — including the audience log. Most of it needs no request at all: your profile page edits your details, and deleting your account from your account settings removes your data as described above.

For anything else, write to admin@lorcana-market.com. If the answer does not satisfy you, you may lodge a complaint with the French supervisory authority, the CNIL, or with the authority of the EU country you live in.

Children

Accounts are for people aged 15 or over. The site does not knowingly keep data on younger children; if one is reported, the account and its data are removed.