WealthFamePower

Privacy Policy

How we handle your data

WealthFamePower ("we", "us", "the site") is a fan-made One Piece TCG database. This privacy policy explains what data we collect, how we use it, and your rights regarding that data. We are committed to keeping your information safe and being transparent about our practices.

Data We Collect

Discord Authentication

If you choose to sign in, we use Discord OAuth to authenticate your identity. We receive and store the following from Discord:

  • Discord user ID
  • Username
  • Avatar URL

We do not store your Discord password, email address, or access your Discord messages.

Watchlist and Preferences

When signed in, we store your watchlist cards and price alert targets in our database, associated with your Discord user ID.

Local Storage

We use your browser's localStorage to remember your preferences locally on your device. This includes your language preference (English or Japanese), card grid layout preference (grid or list view), and recently viewed cards (last 20). This data never leaves your browser.

Card Scanner

When you use the card scanner, your photo is processed on your device first. If the on-device match is not confident enough, a downscaled copy of the photo is sent to our server. It is held in memory only, discarded as soon as the server responds, and never written to disk. If you are signed in, your scan history stores which card was matched, never the photo itself.

Cookies

If you sign in with Discord, we set a single HTTP-only session cookie to maintain your login session. This cookie contains a session identifier (not your personal data) and expires after 30 days. Google Tag Manager / Google Analytics and, when enabled, PostHog set their own first-party analytics identifiers to distinguish returning visitors -- see Third-Party Services below for what each collects. We do not use third-party advertising cookies.

Third-Party Services

We use the following third-party services:

  • Vercel -- Hosts our frontend. Vercel Speed Insights collects anonymous Core Web Vitals performance metrics.
  • Cloudflare -- Provides our backend tunnel and analytics beacon. Cloudflare Web Analytics collects anonymous visitor metrics without using cookies or tracking individuals.
  • Discord -- Used for authentication. When you sign in, Discord's own privacy policy governs the data they collect during the OAuth flow.
  • Card pricing data provider -- We fetch daily card sales and pricing data from a third-party market data feed. No user data is sent to that service.
  • Google Tag Manager / Google Analytics (GA4) -- Used to measure site traffic and usage patterns (page views, referrers, device/browser type). Google Analytics may set its own cookies to distinguish visitors; see Google's privacy policy for details.
  • PostHog (when enabled) -- Records page views (which pages you visit, and the page you came from) plus the specific product events described below (searches, card views, watchlist/portfolio additions, price alerts, outbound link clicks, language changes). When enabled, PostHog also captures session recordings (screen replays of your visit); everything typed into a form field is masked before a session recording ever leaves your browser. All PostHog traffic -- including session recordings -- is routed through our own domain (a reverse proxy), so no request goes directly to a PostHog-owned domain.

Server-side event logging -- In addition to the above, we log the same small set of product events directly to our own server (not a third party) so we retain reliable analytics even if a browser extension blocks third-party trackers. These records are kept for 90 days and then automatically deleted.

Data Retention

Login sessions expire after 30 days. Watchlist data is retained as long as your account exists. We do not sell, share, or transfer your personal data to any third party for marketing or advertising purposes. Server-side product analytics events (searches, card views, watchlist/portfolio additions, and similar) are retained for 90 days before automatic deletion.

Your Rights

You can remove cards from your watchlist at any time. You can clear your browser's localStorage to remove locally stored preferences. If you would like your account data deleted entirely, please contact us via our Discord server.

Changes to This Policy

We may update this privacy policy from time to time. Any changes will be reflected on this page with an updated date.

Last updated: August 2026