Privacy policy
Last updated: July 26, 2026
pickacard.lol is a free tool that requires no account, run from Quebec. This page states exactly what is collected and what is not. It is written for Quebec’s Law 25 and Canada’s PIPEDA.
Short version
No account required, no tracking cookies, no photo uploaded. Your camera frames are read on your device and never leave it. Analytics are anonymous and hosted on my own server. Nothing is sold or shared with advertisers.
Your camera and your cards
The scanner reads the number printed at the bottom of the card right in your browser (local OCR). No image and no video stream is sent to a server — which is why the scanner keeps working offline once the site is installed. Camera permission is handled by your browser and can be revoked at any time.
What stays on your device
Your pack history, your collection, your display currency and the fact that you dismissed the install prompt live in your browser’s local storage (keys ripper-history-v2, currency-v1, pwa-install-dismissed). That data stays on your device and disappears if you clear the site’s data. It reaches my server in exactly two cases, both started by you: collection backup and sharing a pack, both described below.
Collection backup (optional)
You can turn on an online backup so your packs follow you to another device. It unlocks with a passkey — your face, your fingerprint or your device PIN — so there is no email, no password and no name. What my server stores: a random identifier, your passkey’s public key, and your list of packs. Nothing else, and nothing that could tell who you are. The "Delete my data" button on the Collection page erases the backup and the passkey server-side, permanently.
Analytics
I use Umami, an analytics tool I host myself at analytics.monsilaro.ca — nothing is sent to Google or any other third party. What gets recorded, in aggregate: page visited, referring site, country, device type, browser, language, screen size, page-performance metrics, and a few usage events (a scan started, a card recognized, a pack finished with its card count and value). Umami sets no cookie and does not store your IP address: it is only used to compute a hash salted with a value that rotates daily, which makes it impossible to follow you from one day — or one site — to the next.
Cookies
No advertising cookie, no social pixel, no third-party tracker — and the analytics work without cookies at all. Two strictly necessary ones exist, and only if you turn on collection backup: pak_session (your signed session, unreadable by the browser, 180 days) and pak_chal (5 minutes, just long enough to verify your passkey). They open your backup and do nothing else. That is why there is no consent banner: Law 25 requires consent for identification, location or profiling technology, and these two only deliver a service you asked for yourself.
Shared packs
If you choose to share a pack — and only then — that pack’s card list (numbers and finish, nothing else) is stored on my server so the link works. No device identifier, no data about you, no frozen prices. Shared packs are deleted automatically after one year.
Third parties
Card images are served by TCGplayer’s CDN: as with any image on the web, their server sees your IP address when it loads. Prices come from TCGCSV, Face to Face Games and 401 Games, but my server fetches them once a day — your browser never contacts those sites. No other third-party service is loaded.
Retention
Aggregate statistics are kept as long as they help track how the site evolves; they cannot identify you. Your collection backup stays until you delete it. Shared packs expire after a year. Web server access logs (IP address, page, timestamp) are kept for 30 days and then deleted — they exist for security and troubleshooting.
Your rights
Quebec law gives you the right to access the personal information held about you, to have it corrected or deleted, and to file a complaint with the Commission d’accès à l’information du Québec. In practice: with no backup enabled, I hold nothing about you — no account, no email, no profile. With a backup, everything I hold is erased by the "Delete my data" button on the Collection page. Write to me anyway if you have a question or a request.
Privacy officer
The person responsible for protecting personal information is the operator of pickacard.lol, reachable at the address below. That is who to write to for any question, access request or deletion request.
Changes
If this policy changes, the date at the top changes with it. Nothing retroactive: what was not collected cannot be collected after the fact.
Questions or requests: