Privacy

Updated: 2026-10-29

Card-a-mon is a card game editor looked after by one person — Dalius Dobravolskas, trading as ffff.lt. This is what is collected, where it is kept and what is done with it.

What is collected

• Your email address. It is the account: you sign in with a link sent to it, so there is no password to store.
• What you make. Your projects: their names, the card set documents — card sizes, fields, text, colours and layout — and every image you upload as artwork. A project kept on this computer is not among them: it never reaches the server; see the browser's storage, below.
• Work brought across from your browser. Projects made before there were accounts live in the browser that made them. The first visit to your projects offers to bring them here; they are copied only if you accept, and nothing is removed from the browser.
• Feedback you send, if you send it. The projects page has a form asking how you use Card-a-mon. What you write in it is emailed to Dalius, with your address as the reply address so that an answer can be written back. Nothing else goes with it — not your screen size, not your browser — and nothing is remembered on the server: the email is the whole of it.
• What goes wrong in the editor. When the editor runs into an error, it reports it so that it can be fixed: the error's message and where in the editor's code it happened, what the editor was doing, the address of the page and the browser it ran in (its user agent), with your account and its email address, so that you can be written to about it. Nothing on your cards goes with it. The first report of an error is emailed to Dalius. Reports are kept 90 days, and are deleted with the account before then.
• AI assistants you connect, if you connect one. You can let an AI assistant such as Claude work on your projects. For each one you approve, the server keeps the name the assistant gave itself, the address it asked to be sent back to after you approve it, when you approved it and when it was last used, and digests of the tokens it signs in with — never the tokens themselves. Assistants that register but are never approved are forgotten within a day.
• Payments, if you subscribe to a paid plan. The plan, whether it is paid monthly or yearly, when it renews, and the identifier Stripe, who takes the payment, gives you as its customer. Your card details, and the name and billing address Stripe asks for, go to Stripe and are never sent to Card-a-mon.
• Images an assistant fetches from a link. When an assistant asks for an image to be added from a web address, the server downloads it and keeps it with your project like any image you uploaded. Nothing else about the request is kept.
• When you first exported, and how often. PDFs, PNGs and zips are made in your browser, so the editor tells the server when one is done; it keeps the time of your first of each kind and a count, and nothing about what was in it. It is part of your account and is deleted with it. Sign-in links are also counted per email provider and day (gmail.com, icloud.com…) without the address, to see whose mail is not arriving; those counts are nobody's in particular.
• What kind of project you start. When a project is made from the new project form, kept on this computer or in an account, the server notes the day, the card size and shape, the templates picked, whether it is two-sided, where it is kept and whether its maker was signed in. Never its name or anything on its cards, and nothing that says whose it is: like the sign-in link counts, it is nobody's in particular.
• A note of each AI call, if you use AI. For each call made for you to Claude: when it was made, for which project and conversation, the model, how it ended or what went wrong, how much it read and wrote, what it cost, how long it took, and the provider's id for it. Never what was said. It is there to look into what went wrong when something does, and is kept 90 days.

That is the whole of it. There is no profile, and no name, address or card details kept here.

Where it is kept

Each account's projects and artwork sit in a SQLite file of their own — not in a shared table with other people's rows. The server is rented from Hetzner Online GmbH and stands in Germany, in the European Union, and the data does not travel out of it. The connection from the browser is HTTPS.

Cookies and the browser's storage

One cookie — cardamon_session — holds your sign-in session and lasts 30 days. It is HttpOnly, sent only over HTTPS, and without it there is no way to be signed in. There are no analytics, advertising or third-party tracking cookies, because there is no analytics, advertising or tracking here at all.

The browser's storage holds a few of the editor's settings, which are never sent anywhere: whether you have seen its tour, which sections you folded and how large the image library's pictures are.

A project kept on this computer is in the browser too, never on the server: its files in the browser's own private storage, or in a folder you picked, and the list of these projects, with each folder's permission, in IndexedDB. Clearing the site's data deletes the ones in the browser and forgets the folders, which stay as they are. What reaches the server from such a project is only what the editor asks of it: the icons it fetches from the library, the errors it reports, and the cards you send to The Game Crafter yourself, which the server passes on without keeping. Files picked to import are held in IndexedDB only until the next page opens them.

A browser may also still hold the work it made before accounts existed, in IndexedDB, put there by an older version of Card-a-mon.

Sign-in links and your IP address

A sign-in link is good for fifteen minutes and works once. What the database holds is not the link but its cryptographic digest. Your address is capped at five links an hour, and a client address at ten; the IP address that counts is held in the server's memory only and is never written to the database.

The server log records what was done, not who did it: an email address appears there as the first bytes of its SHA-256, never as the address. Those logs are rotated and the old ones discarded.

Third parties

The server's landlord, Hetzner Online GmbH, whose machine runs the application, the database files, the mail server and the font server. The sign-in emails come from that same machine rather than through somebody else's sending service.

Typefaces are not fetched from anybody else. The site's own come from this server, and the fonts cards are set in from fonts.cardamon.lt, which is Card-a-mon's too and runs on the same machine: it sets no cookies and keeps no log of who fetched what.

The AI assistant you connect, if you connect one. This is the one case where your work leaves the server, and it happens only at your request: once you approve an assistant, whatever it reads from your projects — names, card text, layout, images — goes to the company that runs that assistant (for Claude, Anthropic), and what it does with it is governed by that company's terms and privacy policy, not these. That company may be outside the European Union. Card-a-mon sends an assistant nothing it does not ask for, and nothing from anybody else's account. You can disconnect it at any time on the account page.

Stripe, if you subscribe to a paid plan. Checkout and the page where a subscription is changed or cancelled are Stripe's own pages: what you type into them — card details, name, billing address — goes to Stripe, which takes the payment. What Stripe does with it is governed by Stripe's privacy policy. Stripe may handle it outside the European Union, under the safeguards that policy describes. Nobody who does not subscribe has anything sent to Stripe.

haiku.lt, the accounting service Card-a-mon's invoices are kept in, if you pay for a plan. Each payment's invoice is issued there, with the name, billing address, VAT number and email address given at Checkout, and kept for as long as tax law requires invoices to be kept.

Anthropic, if you chat with Claude about a project in the editor. Your messages, and what Claude reads of the project to answer you (its cards, their layout, its brief), are sent to Anthropic, whose Claude models answer them, through its servers in the United States, with an id that stands for your account and says nothing else about you. Under its commercial terms Anthropic does not train its models on what is sent through its API, and keeps it only a limited time, to keep its service safe, as its privacy policy says. Nothing is sent to it unless you send a message. A chat is kept with the project for 12 months after its last message, to be read again.

Websites an assistant fetches images from. The download is made by the server, so the site hosting the image sees the server's address, not yours, and nothing about your account is sent with it.

There is nothing else: no analytics, no advertising, no tracking services, no backups in somebody else's cloud. Your work is not sold, not passed to advertisers, and not given to anybody to train models on by Card-a-mon. What an assistant you connect does with what it reads is up to its provider's terms, which is worth reading before you connect one.

Deletion

You can delete the account yourself on the account page. The database file holding your projects and their artwork is deleted with it, along with your sessions, any unused sign-in links, every connected AI assistant and its tokens, the notes of the AI calls made for you, and the reports of errors in your editor. An assistant can also be disconnected on its own, on the same page. There is no way to bring it back. More about your rights on the GDPR page.