Privacy

Draft of 28 October 2026, for the site owner to review before it is final. It is not legal advice.

This page says what Runeshelf keeps about you, why, for how long, and who else sees anything. You can browse and search the catalogue without signing in, and then the site keeps nothing about you.

Who runs this site

To be filled in by the site's owner: who runs the site, as a person or a business, and so who is responsible for your data.

To be filled in by the site's owner: how to contact them about your data.

To be filled in by the site's owner: where the site and its database are hosted, and by whom.

What we keep when you sign in

• The accounts you sign in with. For each account at Discord, Google, or Twitch that you sign in with or connect, its id there. From the one you signed in with last, your display name (or your username if you have no display name) and the address of your avatar picture, refreshed each time you sign in. And the date your account here was made. We use them to show who is signed in and to keep your collection yours. An account's id is kept until you disconnect that account, and all of it until you delete your account here.
• Your collection. Your folders and the cards in them (which printing, its finish, language, condition, and how many), your lists and the cards they need, whether each folder and list is public, and the random link id in each one's address. For each folder and list we also keep a fingerprint of the last file or deck you imported into it, so the same import is not added twice. All of it stays until you delete it or your account.
• Your quick adds. Each card you add on the Quick add page, so it can be undone. An add is removed the next time you add a card on Quick add once it is a day old, not after exactly a day, so if you stop using Quick add it stays until you delete its folder or your account.
• Your sessions. Signing in starts a session that lasts 30 days. We keep a one-way fingerprint of its key, never the key itself, when it ends, which provider you signed in with, and the choices the add forms remember: the folder, list, set, finish, language, and condition you used last. Signing out deletes the session; expired ones are deleted when anyone next signs in. Deleting your account ends all of yours.
• A sign-in in progress. While you are at Discord, Google, or Twitch to sign in or to connect an account, for up to 10 minutes, we keep a fingerprint of the sign-in's state, a one-time code that proves the sign-in is yours, which provider it is at, the page to return to, and for a connect which account here it connects to. It is deleted when you come back, or when a later sign-in finds it expired.

We don't keep your email address (we don't ask any of them for it), your password there, or the access token they give us, which is used once to read your profile and then dropped. We don't take payments.

Cookies

The site sets two cookies, both only to sign you in, and none for analytics or advertising:

• session keeps you signed in, for 30 days or until you sign out.
• signin_state ties a sign-in to the browser that started it, for 10 minutes, and is sent only to the sign-in pages.

Both are sent only over secure connections and can't be read by the page's scripts. They are not sent with requests that other sites' pages make in the background, or with forms they submit here.

Your browser's storage

A few choices are remembered in your browser's own storage. They stay in your browser and are never sent to the site. Clearing the site's data in your browser removes them.

• intro-dismissed: you closed the introduction above search.
• onboarding-dismissed: you closed the getting-started steps.
• list-view: whether lists open as text or as images.
• quick-beep: whether Quick add beeps on each add.

Server logs

The site writes errors to its server's log: the address of the page that failed and what went wrong, such as a database error, or which address of a sign-in provider answered unexpectedly during a sign-in. It doesn't log IP addresses, sign-in keys, or what you search for. One exception: if the server crashes while answering a request, the web server it is built on logs the address the request came from.

To be filled in by the site's owner: whether the hosting provider or anything in front of the site keeps access logs with IP addresses, and for how long.

Backups

Before the site changes how its database is laid out, it saves a full copy of the database beside it. A copy holds everything above as it was at that moment.

Copies are kept for up to 30 days, then deleted, so data from an account deleted after a copy was made can remain in that copy until then.

To be filled in by the site's owner: whether the host keeps any other backups, and for how long.

Who else sees anything

• Discord. Signing in with Discord, or connecting it, sends you to Discord, and the site then asks Discord for your profile, with the identify permission only. Discord's own privacy policy covers what happens there.
• Google. Signing in with Google, or connecting it, sends you to Google, and the site then asks Google for your profile, with the openid and profile permissions only. Google's own privacy policy covers what happens there.
• Twitch. Signing in with Twitch, or connecting it, sends you to Twitch, and the site then asks Twitch for your profile, with no extra permission. Twitch's own privacy policy covers what happens there.
• Image servers. Pictures load straight from other companies' servers, which see your IP address and browser, and that the request came from this site: your avatar from the image server of the provider you signed in with last, which is not told the page (Discord's cdn.discordapp.com, Google's lh*.googleusercontent.com, Twitch's static-cdn.jtvnw.net), and card pictures from Riot Games' (cmsassets.rgpub.io), TCGplayer's (tcgplayer-cdn.tcgplayer.com), and RiftHunt's (rifthunt.com).
• Anyone with a link. A folder or list you make public can be seen by anyone with its link, with your display name. The link is random, so it can't be guessed, and a public folder or list isn't listed or searchable anywhere: nothing on the site lists it, and search engines are asked not to index it. Private ones are seen by you alone.

Nothing is sold or shared for advertising, and there is no analytics or tracking.

What you can do

• Download everything you own, as JSON or as a Piltover Archive CSV, from your account.
• Delete your account, from the same page. It deletes everything listed above that is yours at once, and signs you out everywhere. The exception is a backup copy made before then, which can hold it for up to 30 days, as described above.
• Make a public folder or list private again, or sign out, at any time.

To be filled in by the site's owner: how to ask a question or make a request about your data, and how quickly it will be answered.