Privacy

Last changed 13 October 2026

The short version: we keep what the game needs to work, we don't sell it, we don't show ads, and we don't use trackers. You can download everything we hold about you, or delete it, from your settings.

What we keep

• Your account: email address, username, and your password stored as a one-way hash (we can't read it). If you sign in with GitHub or Google, the ID they give us for you.
• Your game: the cards you've found and on which site, your sealed packs, trades, wanted cards, favourites, notifications, and how your binder looks.
• If you make a deck: its cards and pictures, the pack design, the sites it's on, and counts of packs opened there.
• Security records: sign-ins, sign-ups and password resets, with the IP address they came from. Kept for 90 days, then deleted. We use them to stop abuse and to email you when your account is signed in from somewhere new.
• Short-lived counters: to stop abuse we count requests per IP address and per account for a few minutes to a day. These live in memory and expire by themselves.
• Reports: if you report a page, we keep the page, what you wrote, your username if you’re signed in, and your IP address, so we can act on it and spot floods of fake reports.

Collecting without an account

If you open a pack before signing up, we make a guest collection tied to a cookie in your browser. It holds the same game data as an account, without an email. Clearing your cookies loses it; making an account or signing in keeps it.

Cookies and storage

• One cookie that keeps you signed in (or holds your guest collection). Nothing else.
• The pack on other people's sites stores “don't show again” in that browser's local storage, if you choose it. It sets no cookies on their site.
• When it's switched on, Cloudflare's captcha on the sign-in forms may set its own cookie.

The browser extension

It checks the pages you visit for a Wanderlust pack and nothing else. It doesn't read or send the page's contents or your browsing history. When you open a pack it tells us which site you were on, so the card knows where it was found.

Who else handles it

We don't sell or share your data. These services run parts of Wanderlust for us and only process it to do that:

• Our hosting, database and file storage providers (your data and card pictures live there).
• Resend, to send emails.
• Cloudflare, which protects the site and runs the captcha.
• GitHub or Google, only if you choose to sign in with them.

What others can see

Your username, and the decks you make, are public. Your binder is private until you make it public; then other collectors can see your cards and offer trades. Your email is never shown.

Your choices

• Download your data, change your password, or turn emails off in settings.
• A picture you replace or remove is deleted from our storage within a couple of days.
• Delete your account in settings. It's deleted straight away, with your game data and decks; the pictures you uploaded are removed within a couple of days. Copies in backups disappear as those backups expire.

Questions

Write to hello@wndrlst.cards.