Privacy Policy

About this policy

This policy explains how information is handled by Basket Card Lab and its community feature, MY STARTING 5. It covers card browsing, accounts, profiles, favorite cards, lineups, comments, likes, and in-app notifications.

Accounts and sign-in

When you sign in with Google or X, the service supplies an account identifier and an available display name. We store the identifier to recognize your account on this site and use the display name as your initial nickname. Google/X account identifiers are not displayed as public profile fields.

We do not collect or store your Google or X password. The current sign-in flow does not obtain a Google/X email address for storage in your site account, and does not store the external service's access or refresh tokens in our database. The sign-in flow does not publish posts to X.

For a new account created through X, we retrieve the initial profile image and copy the image data to this site for use as your starting picture. An illustrated icon is used if the image cannot be retrieved. Later X sign-ins do not overwrite a picture you have changed. Google sign-in does not import your Google profile image as your starting picture.

For email registration, we process your email address, nickname, and optional profile details. The initial registration request does not collect a password. You choose your password after opening the verification email. It is stored as a salted hash, not as a readable password. The email address and hash are used for email-account verification, sign-in, and password reset. Your email address is not displayed in public profiles or posts.

Profiles, content, and visibility

Your nickname, picture, bio, favorite team, and favorite player appear on your public profile. Profile settings let you choose an illustration or upload your own picture. The upload interface crops the center to a square and saves a resized image.

Saved lineups include the selected cards, lineup name, catchphrase, creator, and creation or update information. They are public, including to people who are not signed in. Public pages and social sharing images also reflect information about the lineup and its creator. Sharing services and people who receive a URL may view or save it.

Comments and replies store their text, language, author, and posting time and appear in public threads. A lineup creator can close comments or hide individual comments. Hiding is different from deleting stored data: the lineup creator can still view hidden comments. Replies beneath a hidden parent comment are also excluded from the ordinary public view.

Favorite cards saved while signed in are stored in your account. Your favorites list is private by default and is displayed on your profile if you make it public. Favorites saved while signed out are stored in that browser.

Lineup likes are stored as a relationship between an account and a lineup. Like counts are public. In-app notifications for likes, comments, and replies include the actor's nickname and picture, the relevant lineup, a link to a related comment, timestamps, and read status. They are displayed within the intended recipient's account. This notification feature does not send email or web push notifications.

Authentication, browser storage, and abuse prevention

An authentication cookie keeps you signed in. The server stores a hash of the session token and an expiry time. Signing out invalidates that session. Blocking cookies may prevent features that require sign-in from working.

Browser storage may hold signed-out favorites and information needed to resume an action selected before sign-in. Clearing browser data may remove information saved only in that browser.

Authentication processing uses hashed values derived from information such as IP addresses and entered email addresses, together with attempt counters, to limit sign-in attempts and email requests. These controls help prevent abuse; a value is not treated as anonymous merely because it is hashed.

Authentication email

We use Resend to deliver email registration, verification, and password reset messages. This delivery flow sends Resend the sender, recipient email address, subject, and message body. The body includes a verification or reset link. It does not include your password, bio, or comment text. Resend privacy policy

Analytics, translation, and other external services

Pages with Google Analytics 4 (GA4) enabled use cookies and related technology to send page views and shop-link interactions to Google for usage analysis. Shop-link events include the destination shop and card identifier. A link click does not establish a purchase or affiliate commission. Google privacy policy

If a translation service is connected and you request a comment translation, the comment text and target language are sent to the configured translation service. When translation is not connected, the original is shown. If you choose “Open Google Translate,” the displayed comment text and language parameters are sent to Google. Translations are shown separately from the original.

Pages that load Google Fonts connect your browser to Google. Loading and playing the official YouTube player also connects your browser to YouTube. Following shop links or using social sharing can take you to external services, which process information under their own arrangements. Review Google/X's policies for information those services handle when you sign in. Google / X

Information you can change in the interface

Profile settings let you change your nickname, bio, favorite team, favorite player, and picture. You can add or remove favorite cards, change your favorites list's visibility, and edit or delete lineups you created. For your own lineups, you can manage whether comments are accepted and displayed.