What this site stores

Card Arena stores the email and display name you register with, a bcrypt hash of your password, and hashed session tokens. It does not store the raw password or the raw session cookie.

Player cards store public Epic display names and the statistics returned by the configured stats provider, plus the time that snapshot was captured. Favorites and votes are stored so your collection and the community rating work on the server.

Report notes are encrypted in the database with AES-256-GCM. The application can still read them so moderators can review reports. That is field encryption, not end-to-end encryption.

Passwords, sessions, and database contents also depend on HTTPS in the browser and encrypted disks and backups on the server. Those infrastructure controls have to be enabled on the host. A compromised server or a stolen application secret can still read data the application is able to process.

Recent player views are kept in a cookie on your browser and contain only public card links. The site does not use browser local storage for accounts or sessions.

You can delete your account from the collection page. Deleting it removes the account, its sessions, favorites, and votes.