Legal notice

Publisher

OpenLore is published by “Gengar”, an individual acting in a non-professional and non-commercial capacity.

In accordance with Article 6, III, 2 of French Law no. 2004-575 of 21 June 2004 on confidence in the digital economy (LCEN), the publisher, who acts in a non-professional capacity, has chosen to remain anonymous. Their contact details have been provided to the host.

Contact: openlore@otby.fr

Publication director: Gengar.

Host

Dedicated universes, fan project and trademarks

Some OpenLore universes, called “dedicated universes”, pay tribute to existing works. They are fan tributes, free and non-commercial. OpenLore is not affiliated with any of their rights holders, nor approved or sponsored by them. The names, places and characters mentioned belong to their respective rights holders.

Trademarks mentioned, universe by universe:

• World of Warcraft: World of Warcraft®, Warcraft® and Blizzard Entertainment® are trademarks of Blizzard Entertainment, Inc. OpenLore is not affiliated with Blizzard Entertainment, nor approved or sponsored by that company.

Removal on request: any card and any set can be removed at the request of the holder of the rights to the work concerned, without any restriction. Just write to the site administrator at openlore@otby.fr.

Intellectual property

The OpenLore logo, the card frames, the card backs and the site design belong to the publisher. Illustration credits are shown on each card. The fonts and open-source software used are listed on the Credits page.

Set creators

A set creator (administrator, internal creator or affiliate creator) is responsible for the content of their set: images, texts, names and credits.

You are responsible for the content of your set. Open Lore may remove it if it breaks the law or if a rights holder asks for it.

An affiliate creator only creates in the "Original creations" universe: their own creations, or royalty-free works, always with their source. They tick this statement in their request for set creation access. To ask for content to be removed: openlore@otby.fr.

Personal data

OpenLore only collects the data needed for your account and the game. The data controller is the publisher (see “Publisher”).

Data stored

• Your account: email address, username (chosen after your address is confirmed) and the date it last changed, language, chosen mood, the dates your account was created and your address confirmed, and a hash of your password (argon2id) — never the password itself.
• If you link a Google or Discord account: the provider, your account identifier with them and the associated email address. When you sign up with Discord, your display name and username are only used to suggest a username and are not kept. Nothing else is kept.
• Your sign-in session: a random identifier tied to your account, kept for 30 days at most.
• Links sent by email (address confirmation, forgotten password): only their hash is stored, then deleted shortly after the link expires.
• The invitation code you used: it stays stored with your account (who used it and when), together with the note of the administrator who created it (who it was meant for), and is deleted with your account.
• Your participation in sets (creator, collaborator) and the images you upload in the editor: the original file is not kept, only converted copies without metadata are.
• If you request access to set creation: your project, the link you attach, the date of your request and the administrator's answer (accepted, refused with its reason, or withdrawn). Administrators read this request.
• Your IP address: OpenLore does not store it in its database. It is used to limit abusive attempts (sign-in, sign-up, email requests) and is held in the server's memory only, for a limited time. It does, however, appear, as on any website, in the technical logs of the web server that receives connections (the hosting relay), which are kept for a few weeks at most.
• Your collection: the boosters you open (the set and the date you opened it) and the cards you get from them, with their variant.
• If you enable notifications: the address of your subscription with your browser's notification service, the encryption keys that go with it, a device name taken from your browser (for example “Firefox · macOS”), the date of the last successful delivery and the number of failures. A subscription is deleted when you remove it from “My account”, or when your browser's service reports that it no longer exists.
• If you report a bug: your text (the title is taken from its first words) and your exchanges with the team, the page you report from, your browser, your device type, your language, and the screenshot you attach, if you attach one. The screenshot is converted to WebP without metadata and only you and the administrators can read it. It shows what is displayed on your page: do not leave anything you do not want to share. An email alerts the team to every new report.

Purposes and legal basis

This data is used to create and manage your account, sign you in, send you service emails (address confirmation, forgotten password), run the game, handle bug reports and protect the site against abuse.

The legal basis is the performance of the service you request by creating an account. Protection against abuse relies on the publisher's legitimate interest, and notifications, if you enable them, on your consent.

Recipients and processors

Your data is neither sold nor passed on. It is processed by:

• the host, OVH, in France;
• the provider that delivers service emails;
• Google or Discord, only if you link your account to one of them (under their own privacy policy);
• browser push notification services, only if you enable notifications.

Retention and deletion

Your data is kept as long as your account exists. There is no account deletion button yet: to delete your account and the data attached to it, write to openlore@otby.fr.

From the “My account” page you can already change your username (once every six months), language and password, and unlink a Google or Discord account.

Your rights

You have the right to access, rectify, erase and port your data, to object to its processing and to restrict it. To exercise these rights, write to openlore@otby.fr.

If you believe your rights are not being respected, you may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

No advertising, no tracking

OpenLore contains no advertising, no analytics and no third-party trackers, and sells no data. The fonts are served by OpenLore itself.

Cookies

OpenLore only uses cookies that are strictly necessary for the site to work, or that remember a choice you made. None of them is used to track you, so no consent banner is needed.

• openlore_session Lifetime: 30 days

  Keeps you signed in (random session identifier). Not readable by JavaScript (HttpOnly), SameSite=Lax, sent over HTTPS only (Secure).

• openlore_envoi Lifetime: 1 hour

  After an email sign-up, remembers the address the confirmation link was just sent to, to show it on the next page. HttpOnly, SameSite=Lax.

No CSRF protection cookie is used: that protection relies on checking the origin of requests.