Privacy Policy
Effective date: Oct 23, 2026
This page explains what information RiftHunt collects, why, who else is involved, and what you can do about it. It applies to the website at rifthunt.com and its subdomains, the card data API, and the Discord bot.
RiftHunt is an independent fan site operated from the United States. "We" and "us" below refer to the people who run RiftHunt.
At a glance
- Searching, browsing, the API and the bot all work without an account. Signing in is only needed to add community tags with the tagger.
- Tagger logins (email, Discord or Google) are handled by Clerk. RiftHunt never sees or stores your password or sign-in credentials.
- RiftHunt doesn't show ads.
- Google Analytics tells us how the site is used. TCGplayer affiliate links earn a commission that keeps RiftHunt free. Cloudflare delivers and protects the site.
- The Discord bot looks at messages only to find card lookups, and doesn't save them.
- We never sell your information.
Information RiftHunt receives
Request data. Every time a browser loads a page or an app calls the API, the request passes through our servers and Cloudflare. That exposes standard details: IP address, browser and operating system, device type, the page or endpoint requested, the time, and the referring page. API clients also send a User-Agent header. This is used to deliver the service, spot and stop abuse, and see how RiftHunt is being used.
Cookies. Some are set by RiftHunt and some by partners. They're covered in their own section below.
Discord messages the bot can see. When the bot is in a server, Discord passes it messages from channels it has access to, along with server, channel and user IDs, so it can catch card names typed in {{double braces}} or [[square brackets]] and post a reply. Message text is used only for that and isn't stored. No conversation history or user profiles are kept. The bot holds onto short-lived operational logs (request counts and errors) and simple per-server settings, such as whether square-bracket lookups are on.
Tagger sign-in. If you log in to the tagger, the login is handled by Clerk, a third-party authentication service. Depending on how you sign in, Clerk processes your email address or the basic profile details Discord or Google share with your permission (such as your name, email address and profile picture). Clerk keeps your login data; RiftHunt doesn't store passwords, one-time codes or Discord and Google access tokens. RiftHunt receives an account ID and display name from Clerk so it can link tags to the person who added them. Tags, and the display name of who created them, are public on the site and through the API.
Emails you send. If you contact [email protected], your message and address are kept so we can reply.
Things we never collect. Login credentials stay with Clerk, so RiftHunt never holds your password. We don't handle payments, so card details never reach us. We don't collect ID numbers, precise location or sensitive personal data. Purchases on TCGplayer or Cardmarket happen entirely on those sites.
Cookies
Cookies are small files a site saves in your browser. Here's what you may find on RiftHunt:
| Type | Set by | Purpose | Lifespan |
|---|---|---|---|
| Essential | RiftHunt, Cloudflare, Clerk | Security, bot protection, keeping the site running, and keeping you signed in to the tagger | Session to 1 year |
| Preferences | RiftHunt | Remembering choices like search and display options | Up to 1 year |
| Analytics | Google Analytics | Counting visits and seeing which pages are popular, where visitors come from, and roughly which country they're in | Up to 2 years |
| Affiliate | TCGplayer and its affiliate network | Noting that you arrived from a RiftHunt link so a purchase can be credited | Set by TCGplayer, often around 30 days |
Partner cookies. Google and TCGplayer control their own cookies under their own privacy policies. We can't see what those cookies record about you.
Your consent. Visitors from places that require it, such as the EU, UK and Switzerland, see a cookie banner and analytics only runs after they agree. You can revisit that choice from the banner at any time. Wherever you are, your browser lets you block or clear cookies, though blocking essential ones may stop some features from working.
Browser privacy signals. Where the law treats a Global Privacy Control signal as an opt-out, we follow it. "Do Not Track" has no agreed meaning, so we don't act on it.
Services we work with
These companies receive some information when you use RiftHunt. Each one handles it under its own policy.
Google Analytics. Shows us which pages are visited, for how long, from which sites, and the general location and type of device. IP anonymisation is switched on where Google supports it, and nothing that directly identifies you is sent to Google. Read more in how Google uses data from partner sites and Google's Privacy Policy. The Google Analytics opt-out add-on blocks it entirely.
TCGplayer. Provides the daily market prices shown on RiftHunt and runs the affiliate programme RiftHunt is part of. TCGplayer links from the site, the API and the bot are affiliate links; following one may let TCGplayer set a cookie so any purchase is credited to RiftHunt. Your activity on TCGplayer is covered by TCGplayer's Privacy Policy.
Cardmarket. Some card pages and API results link here. Its own privacy policy applies once you visit.
Cloudflare. Hosts and secures the website, API and image server, which means it handles request data including IP addresses. See Cloudflare's Privacy Policy.
Clerk. Runs sign-in for the tagger, including email, Discord and Google logins, and stores the login data itself. See Clerk's Privacy Policy.
Discord and Google sign-in. If you choose to log in with Discord or Google, that company confirms your identity to Clerk and shares the profile details you approve. Their privacy policies cover what they do with your data.
Discord. The bot runs on Discord, which sends it message and server data as described above. How Discord itself treats your data is set out in Discord's Privacy Policy.
Riot Games. Riot owns the card content RiftHunt displays. None of your information is passed to Riot.
No selling, no marketing lists. We don't sell personal information or give it to anyone for their marketing. Some privacy laws count analytics or affiliate cookies as "sharing"; the section on your choices explains how to opt out.
Why we use it
Information is used only to:
- Keep the site, API and bot running and deliver card data, images and prices
- Let you sign in to the tagger and credit tags to the person who added them
- Protect RiftHunt from abuse and enforce the API fair-use guidelines and Terms of Service
- Learn what's working and what needs fixing
- Answer emails
- Earn the affiliate commissions that keep RiftHunt free
- Meet legal requirements
For visitors covered by laws such as the EU and UK GDPR, the legal grounds are our legitimate interest in running and improving a free fan resource, providing the tagger when you choose to sign in, and your consent for analytics and other non-essential cookies where consent is required.
Your information isn't used for profiling or for automated decisions about you.
Your options
Limit tracking. Decline analytics in the cookie banner, block or clear cookies in your browser, install the Google Analytics opt-out add-on, or use a tracker-blocking extension.
Skip the affiliate links. They're never required. You can go straight to TCGplayer or
Cardmarket and search there, and API users can build plain links from the
tcg_id field.
Control the bot. Server admins can remove the bot or limit which channels it can read at any time. Individual users can simply not type the lookup syntax.
Your tagger login. Signing in is optional and only needed to add tags. You can sign out at any time. To find out what's linked to your account, change your display name, or delete your account, email [email protected]. Deleting your account removes your login from Clerk and your account record from RiftHunt; tags you added may stay in the dataset with your name removed. You can also revoke RiftHunt's access from your Discord or Google account settings.
Privacy rights. Depending on where you live, laws like the GDPR, the California Consumer Privacy Act and similar US state laws may give you the right to access, correct, delete or get a copy of personal information about you, including the details connected to your tagger login, to object to or restrict its use, to withdraw consent, and to opt out of the "sale" or "sharing" of your data. Using these rights won't affect how RiftHunt treats you.
Making a request. Email [email protected]. We may ask for details to confirm a request is genuine, and we'll reply within the time the law requires. People in the EU, UK or Switzerland can also complain to their local data-protection authority.
California. RiftHunt doesn't sell personal information. If analytics or affiliate cookies count as "sharing" under California law, you can opt out via the cookie banner, by enabling Global Privacy Control, or by emailing us. We don't knowingly sell or share information about anyone under 16.
Storage, security and other details
Retention. Server and API logs are deleted or aggregated within 90 days. Google Analytics data is kept for the period set in our Analytics account, currently up to 14 months. Tagger account records are kept while your account is open and removed when you ask us to delete it; Clerk keeps login data according to its own policy. Bot logs are kept for a few days. Emails are kept for as long as needed to handle them.
Security. All traffic uses HTTPS and runs through Cloudflare, we collect as little as possible, and access to systems holding data is restricted. No setup is completely secure, but if a breach ever affects your personal information, you'll be told as the law requires.
Children. RiftHunt isn't meant for anyone under 13, and we don't knowingly collect information from them. If you believe a child under 13 has sent us personal information, email us and it will be deleted.
International visitors. RiftHunt is operated from the United States, and providers like Cloudflare and Google may process data in the US and other countries with different privacy laws. Where required, the transfer safeguards those providers offer are relied on.
Updates. This policy may change as RiftHunt does. The effective date at the top shows the current version, and significant changes will be announced on the site. Continuing to use RiftHunt after an update means you accept it.
Contact
For anything privacy-related, email [email protected].