Privacy Policy

About the Service

MAC Cards Online is a web platform for working with metaphorical associative cards in individual and group formats. The service is available through the following supported domains:

• app.makcards.online
• board.journalingapp.app

Sessions can be opened through either supported domain.

This policy describes what data we collect, how we use it, and how we protect it.

Our Principles

• Minimal data collection. We collect only what is necessary to operate the service.
• Privacy by default. Work without registration, private notes visible only to you.
• Temporary storage. Sessions and messages are stored for a limited time and automatically deleted.
• Transparency. We openly explain how the platform works and what happens to your data.

What Data We Process

Device Identification

• Cryptographic keys: On first visit, your browser generates a key pair (public and private) using the ECDSA P-256 algorithm. The private key stays in your browser and is never sent to the server.
• Device identifier: The server issues a random ID to authenticate requests.
• Public key fingerprint: Used to verify request authenticity.

Session Data

• Session code: 6-digit code for participant connections.
• Canvas state: Position and state of cards, selected deck and room.
• Participants list: Names (chosen by users or random) and connection status.
• Chat history: Last 100 messages in the session.

Notes

• Private notes: Stored only in your browser, never synced with the server.
• Public and anonymous notes: Synced with the server and visible to other session participants.

Account Data (When Authenticated)

You can optionally sign in via Google OAuth to create a persistent account and link multiple devices. Yandex OAuth is also supported on the Russian domain.

When you authenticate, we collect and store:

• Email address from OAuth provider
• Display name from OAuth provider
• OAuth provider type and external ID
• Avatar URL (if provided by OAuth)
• Account creation date
• Linked devices: List of your devices (device IDs and last seen timestamp)
• Premium subscription status and expiration date (if active)
• Achievement badges (Team/MOD, PRO, Contributor - if granted)
• Promo code activation history
• Notification history (last 50 notifications, stored for 30 days)
• Pearl balance (in-platform virtual currency)
• Gifts received counter
• Inventory of collectible items purchased or received as gifts

OAuth tokens are encrypted and stored securely. We never receive or store your OAuth password.

Technical Data

• IP address and User-Agent: Used for abuse protection and rate limiting.
• WebSocket connection metadata: Timestamps, connection status.
• Analytics on public informational pages: Page views, referrer, browser and device metadata, and interaction analytics such as clicks, scroll depth, and session replay on public informational pages where such tools are enabled.

Card of the day in Telegram and MAX

If you start our card-of-the-day bot in Telegram or MAX, we process the data needed to reply and to deliver the morning card you request:

• Platform and external user identifier: used to link repeat requests to one anonymous daily-card record.
• Chat identifier: used to deliver the card to your conversation.
• Delivery settings: selected hour, timezone offset, morning-delivery status, last delivery date, and the command the bot is waiting for.
• First-start source: a technical label from the link used to open the bot.

We do not keep the text of your ordinary bot messages in your profile or analytics. The text is used only to perform the command, such as choosing a delivery time. Telegram and MAX process account and message data under their own policies.

Premium Subscriptions and Achievements

• Premium status: Whether you have an active Premium subscription and its expiration date.
• Achievement badges: Team (Moderator), PRO (Verified Professional), or Contributor status.
• Grant history: When Premium or achievements were granted and through what method (promo code, manual grant).

Premium can be activated via promo codes or purchased with Pearls (in-platform currency).

Promo Codes

• Activation history: Which promo codes you activated, when, and what benefits were granted.
• Code details: For audit purposes, we store code type (Premium days, achievements) and creator.

Pearl Transactions

• Transaction log: All Pearl balance changes are recorded in an immutable audit log (purchases, spending, rewards, refunds).
• Transaction details: Amount, type (purchase, spend, reward, refund), description, and timestamp.
• Order history: Pearl Shop purchase orders with status and package details.

Inventory and Collectible Items

• Item inventory: List of collectible items you own, with quantities and gifted counts.
• Gift history: Records of items gifted to session hosts.

Persistent Sessions

• Saved session state: For Premium/PRO users who save sessions, we store the full canvas state (cards, notes, game pieces, collectible items) in PostgreSQL.
• Session metadata: Room, deck, and configuration at time of save.

Leaderboard

• Public display: Your display name, masked email, avatar (if visible), achievement badges, and Premium status may appear on the public leaderboard page.
• Metrics: Gifts received count, decks created count, rooms created count, accepted invites count.

Notifications

• In-app notifications: We store your last 50 notifications for 30 days.
• Notification types: Promo code activations, Premium grants, achievement awards, system announcements.
• Read status: Whether you've read each notification.

User-Generated Content

When you create custom decks or rooms using the editors, we store:

• Uploaded images: card images, deck covers, group back images, room backgrounds, and tile patterns.
• Word card text: text entries you add as word-only cards.
• Metadata: deck and room names, descriptions, language versions, and configuration settings (dimensions, colors, slot positions).
• Submission status: draft, private, submitted, approved, or rejected status and moderation history.

Voice and Video Chat (Air)

Air is an opt-in voice and video chat embedded in a session. When you turn it on:

• No recording. Voice and video are transmitted in real time through our media server (LiveKit, self-hosted on our infrastructure) and are not stored anywhere. We do not produce recordings, transcripts, or archives.
• Metadata we keep: participation start and end timestamps, your display name as shown to other participants, premium status (yes/no), and the session this participation belongs to. This is used to enforce weekly usage limits and to count concurrent participants.
• Camera and microphone access is requested by your browser only at the moment you choose to «Go on air», not when you open the Air panel.
• Anonymous users cannot use Air – an account is required so we can count weekly minutes per user.
• Retention: participation metadata is deleted when you delete your account (cascade with account data).

Moderation Data

Users with the "Team" achievement have access to moderation tools. We log:

• Moderator actions: Promo code creation, notification sending, user lookups.
• Action timestamps and affected users.
• Audit trail: All moderator actions are logged for accountability.

AI Access and Integrations – What We Process

When you use the Public REST API (your own integrations or third-party AI agents that you authorize), we process the data described below. Details about the API itself are in the user docs (Public REST API).

• Request log (pub_api_logs, 90 days): account ID, endpoint, HTTP status, request ID (UUID v7), credential ID (API-key row or OAuth consent), client IP, user-agent, latency. Used for operations, debugging, rate-limit enforcement, and security investigations. Older than 90 days – purged.
• Draw log (pub_api_draws, 365 days): for every card returned by /draw or fetched directly from an image endpoint, we record account ID, deck ID, card ID, source (draw_endpoint or direct_image), timestamp. Retention is longer because the data is the primary signal for detecting bulk-scrape attempts and investigating IP-protection incidents. Older than 365 days – purged.
• OAuth-connected apps (when this feature ships): we store the client app's name, the scopes you granted, the time of consent, the IP address from which consent was given, and the refresh-token hash (never the plaintext token). You can list and revoke connections in your profile; revoked rows are kept for 30 days for audit purposes, then anonymized.
• Local stdio MCP servers: if you run our MCP package on your own machine (npx @maccards/mcp-style usage in the future), the conversation between you and your local AI does not flow through our servers. We only see the REST API calls the MCP server makes on your behalf with your API key – those calls are logged under the rules above. The chat content itself stays on your machine.
• Crypto secrets: we store API keys as salted hashes; revocation is soft-delete (revoked_at) so the audit trail in pub_api_logs stays referenceable. Hard deletion happens on account deletion or on explicit GDPR / РФ-152-ФЗ erasure request – both the key hash and the linked audit rows are wiped.

Intellectual Property Claims Data

When processing copyright claims, we collect and store:

• Formal Copyright Notices: Complainant's name, email, address, phone number; description of the copyrighted work; URL of the infringing content; legal statements; power of attorney (for RF claims)
• Counter-notifications: User's name, email, address, phone number; justification; legal statements
• Statements of Reasons: Moderator decisions, justifications, dates, and redress options
• User Reports: Reporter's name/email and description of suspected infringement
• Copyright strike history: Record of provisional and final strikes linked to your account
• Rights confirmation artifacts: Timestamped records of your rights confirmations when publishing or enabling content for sessions, including IP address and user agent for evidentiary purposes

We DO NOT collect:

• Browsing history and data from other sites
• Content of cards you select (processed only on the client)
• Content of your private notes
• Payment card details (processed by third-party payment providers, not stored on our servers)

How We Use Data

• Service operation: Synchronizing canvas state between participants in real-time via WebSocket.
• Session management: Creating, connecting, and disconnecting participants.
• Chat: Sending and receiving messages between session participants.
• Authentication: Linking devices to your account, managing OAuth sessions.
• Premium and achievements: Managing subscription status, displaying badges.
• Notifications: Delivering in-app notifications about important events.
• Promo codes: Validating and activating promotional offers.
• Moderation: Enabling Team members to manage promo codes, send notifications, and review user-submitted decks and rooms.
• Pearl economy: Processing Pearl purchases, tracking balances, and managing virtual item transactions.
• Session persistence: Saving and restoring session states for Premium/PRO users.
• Leaderboard: Displaying aggregated user statistics on the public leaderboard page.
• Analytics and improvement of public informational pages: Measuring visits, understanding traffic sources, and improving navigation and content on public informational pages.
• Abuse protection: Rate limiting, blocking malicious devices.
• Technical support: Troubleshooting and service improvement.
• Copyright claim processing: Handling formal copyright notices, counter-notifications, and appeals.
• Statements of Reasons: Creating and delivering legally required explanations of content restriction decisions (DSA Art. 17).
• Data exchange in copyright proceedings: Sharing relevant complainant data with content owners during takedown, and user data with complainants during counter-notification (DMCA §512(g)(2)(B)).
• Repeat infringer tracking: Maintaining a record of copyright strikes for our repeat infringer policy.

We DO NOT use data for:

• Advertising or targeting
• Training AI models
• Selling to third parties
• Spam or unsolicited marketing

General Legal Bases (GDPR/UK GDPR Where Applicable)

Where GDPR, UK GDPR, or similar laws apply, we rely on one or more of the following legal bases for processing personal data:

• Performance of a contract or steps at your request: Operating sessions, account features, Premium features, persistent sessions, invite codes, and other service functionality you choose to use.
• Legitimate interests: Securing the platform, preventing abuse and fraud, improving the service, moderating user-generated content, keeping audit records, and measuring traffic to public informational pages.
• Legal obligations: Keeping records required by tax, accounting, payment, consumer, or intellectual-property law, and responding to lawful requests from authorities.
• Consent or provider authorization where applicable: Using optional OAuth sign-in flows and any analytics or similar technologies where consent is required by law.

Legal Basis for IP Claims Data (GDPR)

For users in the European Union, we process intellectual property claims data under the following legal bases:

• Formal Copyright Notices: Legal obligation (DMCA §512, DSA Art. 16, 149-FZ Art. 15.7)
• Counter-notifications: Legal obligation (DMCA §512(g))
• Statements of Reasons: Legal obligation (DSA Art. 17)
• Copyright strike history: Legitimate interests (platform safety, repeat infringer policy)
• Rights confirmation artifacts: Legitimate interests (evidence for legal defence)
• User Reports: Legitimate interests (platform safety)

Access Control for IP Claims Data

• Full formal notices (including complainant PII): Team moderators and administrators only
• Notice summary (without complainant PII): Content author (in takedown notification)
• Counter-notifications: Team moderators and the original complainant (when forwarded)
• Statements of Reasons: Content author and Team moderators
• Strike history: Account owner (their own strikes) and Team moderators

Data Retention

• Sessions: Automatically deleted after 24 hours of inactivity.
• Chat history: Stored in Redis until session deletion (max 100 messages).
• Public and anonymous notes: Deleted with the session.
• Private notes: Stored only in your browser.
• Devices (anonymous): Stored until you clear browser data.
• Accounts (authenticated): Stored until you request deletion or account is inactive for 2+ years.
• Premium subscriptions: Active subscription data + 1 year after expiration (for potential billing inquiries).
• Achievements: Stored permanently unless revoked by administrators.
• Promo code activations: Stored permanently for audit and anti-fraud purposes.
• Notifications: Last 50 notifications, deleted after 30 days or when you delete them.
• Moderator action logs: Stored permanently for accountability and audit.
• Pearl transaction log: Stored permanently for financial audit and dispute resolution.
• Inventory data: Stored until account deletion.
• Persistent sessions: Stored until user removes them or account deletion. Unlimited retention while active.
• User-generated content (decks, rooms): Stored until you delete it or account deletion. Content removed by moderation is retained for the dispute resolution period (see Copyright Policy).
• Technical logs: Stored for up to 30 days for diagnostics.
• Telegram and MAX card-of-the-day bot data: Stored while you use the bot or until you request deletion. The Stop command ends morning delivery but keeps the settings for a possible later restart.
• Formal Copyright Notices: 3 years (limitation periods, legal compliance).
• Counter-notifications: 3 years (limitation periods, legal compliance).
• Statements of Reasons: 3 years (DSA Art. 17, audit trail).
• Copyright strikes (final): Until expiry (12 months) plus 1 year (repeat infringer policy).
• Copyright strikes (reversed): 12 months (audit trail).
• Rights confirmation artifacts: Lifetime of the content plus 3 years (evidence for legal defence).
• Content hash blocklist: Indefinitely (re-upload prevention).
• User Reports: 1 year (moderation queue).

Data Sharing

We do not sell or share your data with third parties for advertising or marketing.

We use trusted infrastructure providers:

• Hosting: VPS servers to host the platform.
• CDN: Cloudflare for content delivery acceleration.
• Analytics providers on public informational pages: Yandex Metrika on makcards.online and Google Analytics on journalingapp.app.
• OAuth providers: Google OAuth, and Yandex OAuth on the Russian domain, for optional authentication.
• Payment processors: Third-party payment providers for Pearl Shop purchases (fiat payments when available).
• Messengers: Telegram and MAX deliver channel and card-of-the-day bot messages. They process your account and messages under their own privacy policies.

These providers process data under their own privacy terms and, where applicable, under contractual or legal safeguards relevant to the service.

Moderator access: Users with Team achievement can view limited profile data (email, Premium status, achievements) for moderation purposes only. Moderators cannot access session content or private notes.

Security

• HTTPS/WSS encryption: All connections are protected with TLS.
• Cryptographic request signing: Protection against forgery and replay attacks (nonce).
• Rate limiting: Protection against DDoS and abuse.
• Automatic deletion: Sessions and messages are deleted after retention period.
• Private notes: Never leave your browser.
• IP claims data: All personally identifiable information in copyright notices and counter-notifications is encrypted at rest. Access to full notice data is restricted to Team moderators and administrators. Export or download of PII from the moderation interface is prohibited. All access to notice data is logged for audit purposes.

Your Rights and Choices

Depending on your location and applicable law, you may have the right to request access to, correction of, deletion of, restriction of, or objection to certain processing of your personal data, and to request a portable copy of data you provided to us.

• Work without registration: You can use the service anonymously.
• View your data: When authenticated, view your profile, Premium status, achievements, and notification history.
• Manage notifications: View and delete notifications in your profile.
• Disconnect OAuth: Unlink your OAuth account from this device (keeps device access but removes account sync).
• Delete browser data: Clear localStorage and cookies in your browser to remove device keys.
• Account deletion: Email us at [email protected] to delete your account and all associated data (Premium, achievements, promo history).
• Card-of-the-day bot: Send “Stop” to end morning delivery. To delete the linked Telegram or MAX record, email [email protected] and name the messenger.
• Data access and export: Request by email a copy of your data, including Premium history and promo code activations.
• Complaints: You may contact us using the details below and, where applicable, lodge a complaint with your local data protection authority.
• Leave session: Close the tab or leave the session – your private data stays in the browser.

Cookies and Local Storage

Landing pages and docs on makcards.online count visits with Yandex Metrica: how many people came, where from and which pages they opened. Metrica sets its own cookies (_ym_uid, _ym_d and others). Session recording (Webvisor) and the click map turn on only after you press "Allow" in the banner. "Turn off Metrica" disables Metrica completely; the choice applies from the next page you open and can be changed via the "Cookies" link in the footer.

Landing pages on journalingapp.app use Google Analytics only after you accept it in the banner.

Page view counting. On both domains and in the docs we count page views ourselves, to know how many people actually come: Metrica and Google Analytics only see part of the visitors. When a page opens, the browser sends our server the page address without parameters, a coarse kind of arrival (search, AI assistant, social network, other site, direct, within the site) and whether the page exists. The server reduces the address to a language and a page type and discards it at once. Only daily totals per site, language, page type, kind of arrival and country are kept. The country comes from the IP address via a local database; the IP itself is not stored and is used only while the request is handled, for the country and for rate limiting. The page address, the address you came from, cookies, identifiers and browser data are not kept, and nothing is written to your device. The totals are kept without a time limit. They cannot tell who opened a page, so this count works regardless of your choice in the banner.

We do not use cookies for advertising.

In the interactive service (app.makcards.online / app.journalingapp.app), signing in with Google or Yandex sets three strictly-necessary cookies for authentication. These do not require consent under GDPR (recital 30):

Cookie	Purpose	Lifetime
mko_session	Active session (HttpOnly)	15 minutes
mko_refresh	Session renewal (HttpOnly)	7 days
mko_csrf	CSRF protection	15 minutes

The cookies are scoped to your brand's domain (app.makcards.online or app.journalingapp.app) and do not cross between them. To sign out – click Logout in your Profile (cookies clear immediately) or clear cookies in your browser settings.

The interactive service also uses browser localStorage to store:

• Your device's cryptographic keys
• Interface settings (language, panel sizes)
• Your private notes

Analytics providers may also set their own cookies or similar identifiers on public informational pages, subject to their own policies. Data stored in your browser can be cleared in browser settings.

Card of the day on the landing

On the «Card of the day» page the card is picked by the service, not by the browser. To hand out three cards a day and show you the same layout when you return, the browser gets an anonymous device: the same mechanism the interactive service uses.

• When this happens: on the first press of «Draw a card». Before that press the page creates and stores nothing.
• What stays in the browser: an ECDSA P-256 key pair in IndexedDB (the private key is non-extractable and never leaves your browser), the device tokens, and a note of which positions you have already opened today.
• What goes to the server: the public key at registration, the position number and your timezone offset at the draw. No name and no email are requested.
• What the server keeps: the device record and a note of which positions are spent in your local day (about two days, then deleted automatically). The cards themselves are not stored: they are derived again from the device, the position and the date.
• Your answers to the card's questions stay with you: there is no field for them on the page and we do not collect them.

This needs no cookie consent: the storage appears only through your own action and is exactly what that requested action needs (GDPR/ePrivacy, strictly-necessary exemption). Landing analytics follow the rules described above in this section. To remove the device, clear the site data in your browser settings.

Children

The service is intended for users aged 13 and older. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact us for removal.

International Data Transfers

The service is available through the following supported domains:

• app.makcards.online
• board.journalingapp.app

Data may be processed through the infrastructure used to operate the service and is handled in accordance with applicable data protection laws.

Changes to This Policy

We may update this Privacy Policy as the service evolves. We will post changes on this page and update the "Last updated" date.

For material changes, we will notify you through the platform interface or on the relevant public page. Where required by applicable law, we will provide additional notice or obtain consent before a material change affecting personal data processing takes effect.

Contact

If you have questions about this Privacy Policy or want to exercise your rights, contact us:

Service operator / data controller: Dmitry Vadimovich Petrakov

Email: [email protected]