Privacy Policy

1. Who and what this covers

This policy describes the LARPay website, community gallery and desktop app. The operator determines how these services process personal data. The operator’s full legal identity, address and jurisdiction have not yet been supplied; they must be added to this policy. Meanwhile, send privacy requests to hello@larppay.com or through the form below.

2. Private previews and your device

Website preview images are processed locally and stay in memory until you reset the preview, leave or close the page. Desktop saved designs use local IndexedDB. These private designs are not uploaded merely because you preview or save them. Community publication is a separate, explicit action.

The desktop app uses USB to identify a trusted iPhone, detect Wallet card identifiers and apply artwork. Raw device logs are filtered locally. Card identifiers are not sent to the community. License verification sends the license proof and installation binding to the server; license secrets are protected using operating-system encryption when available.

For new license activations, we may send a one-time code to the original purchase or gift email. The code expires after 10 minutes and is bound to the requesting installation and device. We retain encrypted delivery records, attempt limits and short-lived approval records to prevent abuse. Existing authorized computer bindings remain valid without a code at each launch.

In desktop versions with server-prepared artwork, choosing Change skin sends the finished card image, the selected device and card identifiers, and a signed license proof over HTTPS to our processing service. The server verifies access and prepares the PNG and PDF files in request memory, then returns them for local USB writing. We do not write these images or generated files to server disks, object storage, databases or application logs. They are released after the request; ordinary service access logs and license/replay records contain operational metadata, not image contents. Information visibly included in your image is sent with it. This processing does not publish your image or add it to the community. Earlier desktop versions may prepare artwork locally.

3. What the community stores

When you publish, the service stores your image, public creator name, title, description, category, upload time, agreed policy version and a pseudonymous browser ownership identifier. It validates and re-encodes accepted images into WebP, removing original embedded metadata. Information visibly shown in an image is not removed.

The image and its public details are visible worldwide. Likes are linked to a pseudonymous browser identifier; the public gallery shows aggregate like counts, not the private identifier. Creator names are not verified. Clearing cookies does not remove already published work. Delete uploads first, or submit an ownership request through the form.

A report or support request stores the name, email, supplied URL, message, request type, submission time and review status. These details are private to operators and service providers that process the request. Relevant complaint details may be shared with the affected uploader, a rights holder or authorities where necessary to handle a dispute or meet legal requirements. Do not include unrelated sensitive information.

Designs credited to creators on cardart.cc show the creator’s public handle and a link to the original page, as already published there. We do not collect other information about these creators. A creator can ask us to correct or remove these details through the form.

4. Purchases and service providers

Stripe processes payments on its hosted checkout. LARPay uses order identifiers, payment status, purchase email, license records and installation bindings to deliver and validate access and resolve purchase issues. LARPay does not store your payment card number or CVC. Email delivery uses a server queue and the configured email provider. If you agreed to receive relevant offers through our website, Stripe or another documented consent process, we may send one email when your checkout expires or payment is canceled without a completed purchase. We may use the checkout or billing email supplied through Stripe, including Apple Pay. The email includes a personal, single-use 10% discount link valid for 24 hours; once the offer is displayed on our site, you have five minutes to continue to checkout. We encrypt the recipient email and store the consent source or its operator confirmation and offer details to prevent duplicates, honor unsubscribe requests and stop reminders after a purchase. This is not a newsletter subscription. Use the unsubscribe link or reply to withdraw consent.

Production website traffic passes through Google Firebase Hosting. Firebase/Google Cloud provides the API and database; the configured database is in Frankfurt, Germany. Stripe and email and infrastructure providers may process data in other countries. Their processing is governed by their applicable terms and safeguards. Specific transfer arrangements and the final operator contact details remain to be documented; no EU-only processing promise is made.

Hosting providers may process IP addresses, request information and security logs. The API uses IP-based request limits to reduce abuse. LARPay does not sell personal data. Optional advertising measurement on the website is described in section 5 and can be disabled in Cookie settings.

5. Cookies and browser storage

Session replay and diagnostics: PostHog EU Cloud records website interactions, masked page content, browser/device information and technical exceptions using pseudonymous browser and session identifiers. Input values and page text are masked; support conversations, license status and installation commands are blocked. Network headers, request/response bodies, console logs and canvas recording are disabled. URL queries and fragments are removed. Recordings are retained for 30 days under the current project setting. Usage events and technical errors continue without analytics cookies before consent and after Decline. In this mode PostHog uses a daily server-side hash of the project, IP address, user agent and hostname for audience measurement; no analytics identifier is stored in your browser. Accept enables masked session recordings and browser persistence. Decline stops recordings and clears that persistence while cookieless events continue. This website integration does not run in the private license site. New desktop builds use a separate PostHog integration for screen visits, action outcomes and renderer errors, marked as desktop events. Basic events do not use analytics cookies or persist identifiers. Optional masked recordings can be enabled in App diagnostics settings; disabling them clears analytics identifiers while basic measurement continues. File contents, artwork, license keys, phone identifiers and support conversations are excluded.

Website analytics: Google Analytics 4 loads automatically in every country unless you decline in Cookie settings. No consent banner opens automatically. It measures page views, product views, checkout starts, installer download starts, copies of the installation command, and general checkout or download errors. These events may include the operating system and app version. Confirmed purchases include the verified order amount, currency and a pseudonymous transaction identifier. A download start or command copy does not confirm a completed installation. Google processes browser and device information, approximate location and cookie identifiers such as _ga; data may be processed outside your country. We exclude checkout session IDs and private URL parameters, license keys, payment card details, email addresses, uploaded images and support messages from the events we send to Google Analytics. Google signals and advertising personalization are disabled. Analytics does not run in the desktop app or the private license-delivery site. Select Decline in Cookie settings to stop collection and remove Analytics cookies from this site. Your analytics choice is stored separately in this browser.

The necessary community cookie is HttpOnly and links likes and uploaded artwork to this browser for up to one year. The checkout cookie links payment to license delivery for up to 30 days. The private purchase site uses a separate Secure, HttpOnly cookie, valid for up to 30 days, to let this browser view purchased keys and request another email copy. Temporary access links expire after two minutes and can be used once. The language setting uses browser storage, and desktop saved designs use IndexedDB. You can clear these in your browser or app settings; doing so may remove access to upload management or purchase delivery in that browser.

AI support: when you send a question, Google Cloud Vertex AI processes your message and recent conversation to generate an answer from our support knowledge. LARPay does not save AI conversation transcripts or set chat cookies; the conversation stays in page memory and clears when you reload or choose New conversation. We store temporary usage counters and a daily pseudonymous connection identifier to limit abuse and usage. Do not send full license keys, payment card details, passwords or private purchase links. The assistant cannot access orders or contact staff for you. It is not included on our separate private purchase site or in the desktop app. Contact hello@larppay.com for personal support.

Advertising measurement: the website loads the Meta Pixel (Meta Platforms Ireland Ltd. and Meta Platforms, Inc.) and the TikTok Pixel (TikTok Technology Limited and its affiliates) to measure our ads. The pixels load automatically in every country unless you decline in Cookie settings. They record page views, viewing the product and pricing page, starting checkout and completed purchases, with the price and currency. They set or read cookies and identifiers such as _fbp, _fbc and _ttp, and send them together with your IP address, browser and device details and the page address to Meta and TikTok. Meta and TikTok may link this to your account on their platforms, use it for ad measurement and delivery under their own privacy policies, and process it outside the EEA. If the pixels were allowed when you started checkout and you complete the purchase, our server also reports that purchase directly to Meta and TikTok (through Meta’s Conversions API and TikTok’s Events API), so each platform can match it to an ad and count it once. That report contains the price and currency, a purchase event identifier, the identifiers above or an ad click ID, your IP address and browser details, and a one-way SHA-256 hash of your purchase email, never the email itself. Nothing is reported if you declined before starting checkout. License keys and payment card details are never sent to them. The pixels are never loaded on the private purchase site or in the desktop app.

To opt out, open Cookie settings in the website footer and select Decline. You can change your choice at any time; declining stops the pixels from loading and removes their cookies from this site. Your choice is saved in this browser’s storage. You can also clear site data or block third-party cookies in your browser, and manage ad preferences in your Meta and TikTok account settings.

How Google uses information from sites that use its services

6. Why data is used

Where GDPR or similar rules apply, processing needed to provide the service or fulfill your purchase is based on performance of a contract; fraud prevention, security and proportionate moderation rely on legitimate interests; required accounting and lawful disclosures rely on legal obligations. Website analytics and advertising measurement start automatically as described in section 5; you can disable them in Cookie settings. We do not use the upload checkbox as blanket consent for unrelated processing.

7. Retention and deletion

Published artwork and its metadata remain until removed by you or moderation. Deleting an upload removes its active image and gallery record. Private like records and abuse-control records may remain for abuse prevention, and purchase, support and complaint records may be needed for license support, dispute handling and legal obligations. Provider logs and backups follow their configured retention; copies obtained by others cannot be recalled.

Exact retention periods and scheduled cleanup for residual like records, reports, security logs and backups still need operator approval and configuration. We do not promise an automated deletion schedule that is not implemented. The operator must review necessity and remove data when no longer needed.

8. Security

The website and API use HTTPS. Browser identifiers and access tokens are stored as one-way hashes, license keys are stored encrypted, and browsers cannot read the database directly. Uploaded images are decoded and re-encoded on the server before they are shown.

No system is perfectly secure, so never put information you need to keep private into a public upload. If you find a security problem, please tell us through the form instead of testing it on other people’s data.

9. Your choices and rights

Depending on your location and applicable law, you may request access, correction, deletion, restriction or portability, object to processing, and withdraw consent for uses based on consent. You may complain to your local data protection authority. We may need reasonable verification before acting on a request. These rights may be limited by legal obligations or the rights of others.

Use the privacy option below, including the relevant artwork or order reference if available. Do not send full payment details, passwords or license keys. Uploads are intended for adults 18 and over. Report content or information concerning a child for review.

10. Changes to this policy

When this policy changes, we will update the date at the top of this page. For significant changes, or where the law requires it, we will also give notice on the site before the change takes effect.