Privacy and cookies
Last updated 19 October 2026.
CardVault is an educational project built for a Code Institute course. It keeps as little personal information as it can, never sells or shares it, and shows no adverts.
What we store
- Your username. It is shown next to your reviews.
- Your password, stored only as a scrambled, one-way hash. Nobody, including us, can read it.
- The cards on your My Cards list (owned or wanted, quantity and notes) and the reviews you write.
Your account needs no email address, real name, home address or payment details.
If you contact us
The Contact page asks for your name, your email address and your message. We use them only to reply to you, never for marketing, and delete them once your enquiry has been dealt with. To stop the form being flooded by bots, the site counts how many messages each visitor sends in an hour; it keeps a scrambled, one-way version of your IP address for that hour, never the address itself.
Your age
You must be 13 or older to create an account. When you register we ask for your date of birth, check it, and then throw it away. It is never stored.
How long we keep it
Until you delete your account. Deleting it removes your account, your My Cards list and your reviews straight away, and it cannot be undone.
Log in, then use the "Delete my account" link at the bottom of any page.
Stopping password guessing
When you log in or register, CardVault notes your IP address and the time, so it can pause logging in after too many wrong passwords. Each note stops counting after an hour at most and is used for nothing else. Old notes are deleted from the database whenever the site is updated, and whenever enough new notes build up.
Cookies
CardVault uses only the two cookies it needs to work. Because they are strictly necessary, the law does not require us to ask before setting them, so there is no cookie banner. There are no analytics, advertising or tracking cookies.
| Cookie | What it does | How long it lasts |
|---|---|---|
sessionid |
Keeps you logged in and carries one-off messages such as "Welcome back". | 2 weeks, or until you log out |
csrftoken |
Protects every form from being sent by another website pretending to be you. | 1 year |
Stored in your browser
Two small notes are kept in your browser's own storage (local storage), so the site remembers your choices. They are not cookies, are never sent to our server, and contain nothing about you.
| Name | What it does | How long it lasts |
|---|---|---|
cardvault-theme |
Remembers light or dark mode, if you chose one with the sun/moon button. Without it, the site follows your device's setting. | Until you clear your browser's site data |
cardvault-intro-seen |
Remembers that you have seen the welcome animation on the home page, so it only plays once. | Until you clear your browser's site data |
You can remove both at any time by clearing this site's data in your browser's settings.
Other services
- CardVault is hosted by Heroku (Salesforce) in its European region, with the database on Heroku Postgres.
- Card pictures are loaded from the Pokémon TCG API's image server (images.pokemontcg.io). Like any website, that server sees your IP address when your browser fetches a picture. It sets no cookies on CardVault.
Your rights and questions
You can delete your account and everything in it at any time. If you have a question about your data, or think something is wrong, open an issue on the project's GitHub page, without including any personal details. Security problems should be reported privately, as described in the security policy.