Honest numbers.Minimal data.

Supabase authentication uses first-party session cookies so you can remain signed in securely. An OAuth login also uses short-lived state and verifier values to finish the redirect safely. These are necessary for the account feature you choose to use.

Email signup can set a separate HttpOnly consent-intent cookie for up to 24 hours. Its timestamp and signature are bound to one account and the current Terms and Privacy versions, so the checkbox can be verified after email confirmation without revealing whether that email already has an account. It is cleared when the confirmation callback finishes.

Opening an account confirmation, password-recovery, or email-change link sets a separate signed HttpOnly action-intent cookie for up to ten minutes. The initial link visit does not complete the action. RuneFist verifies the one-time action with Supabase only after you press the confirmation button, which helps prevent automated email scanners from consuming the link.

A creator tool starts activation with random device and user codes plus a random device credential. RuneFist stores only domain-separated HMAC digests of those codes and credentials in short-lived server-only authorization state. The approval code expires after ten minutes; expired request rows are deleted after a further 24-hour cleanup window.

When email/password access is enabled, Cloudflare Turnstile loads on its signup, sign-in, confirmation-resend, and password-reset request forms, and when an email/password user reauthenticates before account deletion, to detect automated abuse. The browser receives a short-lived verification token that RuneFist passes to Supabase for validation. Google and Discord sign-in do not use this RuneFist Turnstile challenge.

The separate anonymous download-count cookie is described above. Stripe, Link, Google, or Discord can set their own cookies when you visit their checkout or sign-in pages; their notices govern those cookies. RuneFist does not currently use third-party advertising cookies or sell personal information.

Account details and current entitlements remain while the account is active. Self-service deletion is available from the Account page after any Stripe membership has fully ended. It removes the RuneFist authentication account, profile, and library mapping, including member-uploaded profile images; Stripe, Link, or RuneFist may retain transaction and security records when law, fraud prevention, disputes, or accounting duties require it.

If you upload a profile image, RuneFist converts it to a private square WebP for the signed-in account. The original upload and embedded image metadata such as EXIF or GPS data are not kept. Replacing or removing the image removes the previous stored version; removing it can reveal the current Google or Discord image as the account fallback. RuneFist does not use profile images for facial recognition, advertising, or engagement tracking.

Minimal processed webhook event IDs may be retained to prevent the same payment event being applied twice. Full Stripe webhook payloads are not deliberately stored in the RuneFist database. Turnstile challenge tokens are not deliberately stored in the RuneFist database. Auth-mail delivery diagnostics and hosting security logs follow the relevant provider's retention rules.

Update preferences and their consent timestamps remain while your account is active so RuneFist can respect your latest choice. In-app read receipts remain with the relevant account. Notification delivery records retain only the limited status, attempt, provider reference, and error details needed to avoid duplicate email and investigate delivery problems; they are not used to profile reading behavior.

Authorized creator-tool installation records remain with the account until the account is deleted. Revocation marks an installation inactive so it cannot refresh access. These records contain random identifiers, rotating credential HMACs, plugin metadata, and activity and revocation timestamps—not the plaintext device credential. Blockbench stores that random plaintext credential and a signed, time-limited offline license locally on the installation so the tool can renew access and work during the displayed offline period. The license names the random device and product, not the account or its artwork.

While a member starts checkout, Upstash can temporarily hold a one-way account token plus a random checkout attempt ID or the pending Stripe Checkout session ID, so duplicate tabs cannot create duplicate subscriptions. The renewable coordination lock lasts about 90 seconds without a heartbeat, and pending checkout state expires after about 35 minutes. It is not used to profile activity across accounts or projects.

RuneFist does not knowingly invite a child who cannot legally manage an account to create one alone. A parent or guardian can contact RuneFist about an account created without the required permission.