Legal
RiftPocket is a free, unofficial collection tracker for the Riftbound trading card game. This page describes exactly what it stores, who else is involved, and how to remove it. It is written to be read rather than to be impressive.
RiftPocket is an independent project run by one person. For anything on this page, including requests to export or delete your data, write to bluefoxmobilegaming@gmail.com. Messages are answered by a human, usually within a few days.
Creating a binder stores your email address and an encrypted password, handled by Supabase, which provides the database and authentication for this site. If you sign in with a magic link instead, no password is stored at all. We never see your password in plain text.
Everything you record in the app is stored against your account:
Every row is tied to your account and enforced by the database itself, not by the web page. No other account can read or change it.
Clearing your browser data removes all three. It does not touch your collection, which lives on your account.
Photos never leave your device. When you scan a card, the image is cropped and read in your own browser and matched against the catalog already cached there. Nothing is uploaded, and the image is discarded when you close the tab.
Sharing is off unless you switch it on. When it is on, anyone holding your
/u/handle link can see which cards and sealed products you own and what is on your
wishlist, read only. Your notes and email address are never included: shared
binders are served by a separate database function that cannot return those columns. Switching
sharing off makes the link stop working immediately.
| Service | Why | What it receives |
|---|---|---|
| Supabase | Database and sign-in | Your email, password hash and everything in your binder |
| Netlify | Hosting | Standard web server logs, including your IP address |
| Riftcodex API | The card catalog | A request for public card data; nothing about you |
| Riot Games CDN | Card artwork | Image requests from your browser |
| TCGplayer CDN | Sealed product photos | Image requests from your browser |
| jsDelivr | The text reader, only if you use the camera tab | A request for a JavaScript file |
| Google Analytics | Which pages get read, only if you allowed it | The page address and an anonymised IP. Never anything about your collection |
There are no adverts on this site and no paid tier. There are two things, both optional and both harmless to you.
RiftPocket already links every card and sealed product to the exact page that sells it. Where a referral programme is set up, those links carry a referral code, and a purchase made after following one may earn RiftPocket a small commission.
There may be a link inviting you to support the project through a third-party donation service. Following it is entirely voluntary and takes you to that service, which handles the payment under its own privacy policy. RiftPocket never sees your payment details, and donating changes nothing about your account: there are no supporter-only features.
This site uses Google Analytics 4, and it runs on every page for every visitor. I use it to see which pages people actually read and where they arrived from, because otherwise I am guessing about what to build next. It loads when the page loads. There is no banner to accept and nothing to opt into, so this section is where you find out about it.
_ga and _ga_*) so returning
visits can be recognised as returning rather than newGoogle processes this data on its own servers, including in the United States, under its own privacy policy. You can read what Google does with it at policies.google.com/privacy.
If you would rather not be counted, any of these works and none of them breaks the site:
Google Analytics sets the cookies described above. Beyond those, RiftPocket sets no advertising, profiling or cross-site tracking cookies. Everything else it keeps in your browser is the sign-in token and the caches listed further up, all there to make the app work rather than to observe you.
If you are in the EEA or the UK, you also have the right to access, correct, port or restrict processing of your data, and to complain to your local data protection authority.
RiftPocket is not directed at children under 13 and accounts should not be created for them. If you believe a child has created an account, write to bluefoxmobilegaming@gmail.com and it will be removed.
If this policy changes in a way that affects what is collected or who receives it, the change will be described here before it takes effect.
RiftPocket is an unofficial fan project. It is not produced by, endorsed by, supported by or affiliated with Riot Games, Inc. Riftbound and League of Legends are trademarks of Riot Games, Inc. Card artwork remains the property of its owners.