Privacy & storage.
Updated 2 October 2026
Who operates ArtRift
ArtRift is an independent Riftbound fan project. For privacy questions or requests, contact artrift@proton.me.
Voting and site security
We store a random browser identifier, your card votes, ranking scale, and the time each vote was updated in Cloudflare D1. This lets you view and change your votes and helps limit repeat voting. Public rankings contain totals, not browser identifiers. We rely on our legitimate interests in providing reliable rankings and protecting the site against abuse.
Cloudflare hosts the site and processes connection information such as IP addresses and request metadata to deliver it and apply security and rate limits. Turnstile processes browser and connection information for anti-bot checks when voting requires verification. Our signed verification cookie contains your browser identifier, IP address, and verification expiry. These security functions work regardless of your analytics choice. See Cloudflare’s privacy policy and Turnstile privacy notice.
Optional analytics
After you accept analytics, we load PostHog through its EU endpoint to measure page visits, app language and language changes, and diagnose application errors. Temporary identifiers stay in memory. Error reports include error types, messages, stack traces, and build identifiers; messages may contain data involved in an error. We do not deliberately capture votes, contact messages, or search terms. Page URLs omit query strings and fragments. Automatic interaction capture, person profiles, session replay, surveys, and console error capture are disabled. IP storage is disabled in the SDK, although PostHog receives an IP address when your browser connects. Analytics and error tracking rely on your consent.
Choosing essential only means PostHog is not initialized on a fresh page. Withdrawing stops further analytics and clears browser analytics identifiers; it does not automatically erase events already received by PostHog. Contact us for a deletion request. Because analytics identifiers are temporary, we may be unable to link historical events to you. See PostHog’s privacy policy.
Cookies and browser storage
| Name | Purpose | Lifetime |
|---|---|---|
| artrift-language | Local storage remembering your selected language | Until you change it or clear browser storage |
| art_diff_visitor | Signed, HttpOnly cookie to recognize your voting history | 365 days; deleted when you delete your votes |
| __Host-artrift_verified | Signed, HttpOnly anti-bot verification cookie | 30 minutes |
| artrift-consent | Local storage recording analytics choice, notice version, and timestamps | 180 days before we ask again |
| artrift-posthog-consent | Local storage mirroring your analytics permission for the SDK | Mirrors your choice; removed on the next page load |
| PostHog identifiers | Optional page-visit analytics held in memory | Until page reload/close or withdrawal; no persistent analytics cookies |
Display preferences are held in memory and reset when you reload. Your language choice is saved locally until you change it or clear browser storage. You can clear browser storage using your browser’s settings. Clearing a voting cookie does not delete votes already stored on the server; use the deletion control first.
Retention and service providers
Individual votes are removed automatically once they have not been updated for 365 days, with a daily cleanup. This also removes their contribution to public totals. Your privacy choice is renewed after 180 days. PostHog analytics events are retained for up to 3650 days under our configured retention policy. Provider security-log retention depends on the security service settings; contact us for the current periods and any applicable backup retention. Contact correspondence is kept as needed to answer the request and meet applicable legal obligations.
Cloudflare and PostHog provide hosting, security, database, and analytics services. Contact emails are handled through Proton Mail. These providers may process data outside the EEA, including through support and subprocessors. EU analytics hosting alone does not exclude international transfers. You can request details of the applicable transfer safeguards and processor arrangements using the contact above.
Your rights
You may request access, correction, erasure, restriction, and, where applicable, portability of your personal data. You may object to processing based on legitimate interests and withdraw analytics consent at any time without affecting earlier lawful processing. You may complain to your local data protection supervisory authority. We normally respond to rights requests within one month; we may need proportionate verification to locate your data safely.
The controls below apply to votes recognized by this browser. For another browser, lost cookies, contact emails, analytics data, or other requests, email us. We do not use your data for advertising or automated decisions producing legal or similarly significant effects.