Privacy Policy
What data WaifuCards collects, why it is needed, who it is shared with and how to delete it.
This Policy explains what data WaifuCards collects about you, why it is needed, who it is shared with and what you can do about it. It is written to be readable to the end — if a question remains, write to us; contacts are at the bottom.
1. Who processes your data
- Who
- the WaifuCards site administration
- Email for enquiries
- admin@waifucards.app
- Telegram
- @waifucards_manager
Questions about the processing of your data and requests to correct or delete it go to the address above or through the feedback form on the Site. We answer within 30 days.
2. What this covers
The site waifucards.app, its mirrors and subdomains (including waifucards.ru, pay.waifucards.app, wiki.waifucards.app), our Telegram mini app and the project's Telegram bot. All of that together is “the Site” below.
It does not cover third-party sites you follow links to (marketplaces, Telegram, sellers' shops) — those have rules of their own.
3. What data we process
3.1. You give it to us
- Only a username and a password are required to sign up. The password is stored as an irreversible hash (bcrypt) — not even we know it.
- Optional: email, Telegram handle, city, “about me”, avatar, profile background, links to your social pages and channels.
- Content you create: collections and card marks, listing prices, cardlists, chat messages and attachments, reviews, link submissions, uploaded card scans, support requests.
- Delivery details — only when you place an order: name, phone, address or pickup point, order note. Who receives them is in section 6.
3.2. Collected automatically
- Request metadata: IP address, browser and device type, language, referring page, time of the request.
- Device identifier: an anonymous marker in a cookie and in browser local storage. Used for security, rate limiting and abuse prevention (see 4.4).
- Actions on the Site: page, set and profile views, pack openings, in-game currency operations, sign-ins.
- Visit statistics via Yandex Metrica. The full file list is in the Cookie Policy.
3.3. Received from third parties
- Telegram — if you sign in or link your account through Telegram: numeric user id, username, first and last name from your Telegram profile.
- The payment service — the fact, amount and status of a payment. Card numbers and card details never reach us and are not stored by us: they are handled by the acquiring bank.
- Country lookup by IP address — from an offline database on our own server; for some service checks an external geolocation service may be used.
4. Purposes and legal bases
We process data only for the purposes below. The legal bases are your consent (given at sign-up and confirmed by your continued use of the Site), performance of the agreement between you and us (access to the Site and its features), and our legitimate interest in preventing abuse.
4.1. Account and Site operation
Sign-up, sign-in, account recovery, your settings, collections and purchases, synchronisation between devices.
4.2. Communication
Service notifications (chat messages, order statuses, support replies, subscription expiry) — on the Site, via browser push and via Telegram if you linked it. Push and Telegram notifications can be turned off in settings.
4.3. Marketplace, deals and reputation
Showing your listings to other users, placing and following up orders, reviews, sales statistics, dispute resolution.
4.4. Security and fair play
Protection against password guessing and abuse, enforcing the “one person — one account” rule, the “I am not a robot” check, moderation of uploaded content.
About second accounts. The Site rules allow one account per person, and we check that by technical means. The check is passive: it uses what the browser already sends during a normal visit, and only moderators see its result. No decision is made automatically — a human issues any ban, and it can be appealed (section 9). We do not disclose the details of the check itself: describing a protection is a manual for getting around it.
4.5. Paid features
Subscriptions and in-game currency purchases, delivery of what was paid for, operation history, refunds, accounting and tax records.
4.6. Improving the Site
Anonymous statistics on traffic and interface errors. We look at it to decide what to fix first. It is anonymous: it carries neither your name nor your messages.
5. What other people can see
The Site is a public service, and part of a profile is open by its very nature: username, avatar, frame and badges, sign-up date, your collections and listings, public cardlists, messages in open channels, reviews you left. That is the point of a showcase: buyers and sellers have to be able to find you.
Everything else is up to you in privacy settings: whether to show email, Telegram and city, whether to accept direct messages, whether to hide your online status. Your password, IP address, delivery details and payment data are never published.
Publishing a profile is distribution of personal data, and consent to it is a separate document: Personal Data Processing Consent. It can be withdrawn by making your profile private.
6. Who we share data with
We do not sell your data and do not share it for anyone else's advertising. Sharing happens only to the extent the Site needs:
- With other users — in a deal. By placing an order you yourself pass the seller your name, phone and delivery address: there is nowhere to send the parcel otherwise. We show them only to the seller you chose and warn them that the data may be used for that delivery and nothing else.
- Yandex Metrica (Yandex LLC) — anonymous visit statistics.
- Google reCAPTCHA — the “I am not a robot” check on sign-in, sign-up and form submissions; Yandex SmartCaptcha may be shown instead if reCAPTCHA fails to load. Without such a check accounts and forms are defenceless against bots, so it always runs.
- The acquiring bank and the payment service — to process a payment and issue a receipt. They receive the amount, the purpose of the payment and a contact for the receipt.
- Telegram Messenger — notification delivery and Telegram sign-in, if you use it.
- Affiliate networks (e.g. ePN) — only the fact that you clicked an affiliate product link. No personal data is passed to them.
- The hosting provider whose servers the Site runs on, and the mail service used to send emails — to the extent needed for storage and delivery.
- Authorised state bodies — upon a reasoned request, where required by law.
7. Where data is stored and for how long
Some of the services above (Google, Telegram) process data on their own servers outside Russia; in that case you consent to cross-border transfer, which happens only within the purposes described here.
- Account data — while the account exists.
- Messages, deals and reviews — while the other party needs them and disputes may be raised; they have a second participant, so your decision alone does not delete them.
- Payment records — for the periods required by tax law.
- Technical logs and view records — no longer than needed for anti-abuse and statistics.
8. Your rights
- learn what data about you we process;
- correct or complete it — almost everything is editable in profile settings;
- withdraw consent: for profile publication, by making the profile private; for processing as a whole, by writing to us (this ends access to the Site, because an account cannot work without data processing);
- request deletion of your account and the data tied to it;
- object to processing and lodge a complaint with a supervisory authority — in Russia that is Roskomnadzor, in the EEA the authority of your country.
How to delete an account. Write to us through the feedback form or to admin@waifucards.app from the contact listed in your profile.
If the account has no deals, payments, channels of its own or wiki articles, it is deleted in full. If any of those exist, full deletion is not possible: those records are not yours alone (a deal has a second party) or must be kept by law (payments). In that case we close access to the account and anonymise the profile — username, avatar, description and contacts are wiped, and the related records stay without a reference to you.
9. Age
The Site is not intended for people under 14. By signing up you confirm that you are at least 14. If you are between 14 and 18, use paid features only with your parents' consent. If we learn that an account belongs to a child under 14, we delete its data.
10. How we protect data
- traffic to and from the Site goes over HTTPS;
- passwords are stored irreversibly hashed and cannot be recovered even by us;
- access to data is limited by administrator roles, and their actions are written to a log;
- sensitive deal fields (address, phone, payment details) are behind a separate permission in the admin panel.
Risks inherent to the internet cannot be eliminated completely. Should a breach happen, we will report it as the law requires.
11. Cookies
The full list of files the Site stores in your browser, their lifetimes and how to opt out is a separate document: Cookie Policy.
12. Changes
This Policy may be updated unilaterally. The current version always lives at waifucards.app/legal/privacy, with the date at the top, and takes effect when published. If the scope of data or the purposes change, we may additionally ask you to accept the new version — there is a banner on the Site for that.
13. Contacts
For any question about processing your data:
- email: admin@waifucards.app
- Telegram: @waifucards_manager
- the feedback form on the Site — the reply arrives in your support chat
Requests are answered within 30 days of receipt.