Privacy Policy

Access keys (OldMurmur Pro)

If you enter an access key, the site uses two cookies that it needs to work: om_dev (remembers that this device is activated, 180 days) and om_pass (a short pass for the card design files, 24 hours). In the browser storage the site keeps om-device (a random device number) and om-access (a hint whether access is active).

On our server (Cloudflare) we keep a fingerprint (hash) of the key, not the key itself; a fingerprint of the device number; a short description of the browser (for example “Chrome · Windows”); and the dates of activation and of the last visit. Your IP address is not stored: only a one-way fingerprint of it is used for a short time to limit repeated attempts.

Your own spells stay in your browser and are not sent to the server.

Account and sign-in with Google

You can sign in with Google. Sign-in is handled by Google: we only receive your email address and a Google account identifier. We do not receive or keep your name, photo, password or Google tokens.

On our server we keep: your email address, the Google account identifier, the keys added to your account, a list of your devices (as one-way fingerprints with a short browser description such as “Chrome · Windows”) and the dates of sign-in and of the last visit.

Cookies: om_dev also remembers that you are signed in on this device (180 days); om_oauth is a temporary cookie used only during sign-in (10 minutes).

You can delete your account at any time with the “Delete account” button on your account page. Your email address, sign-in and device list are deleted; your keys stay valid and can be added to a new account.

Sign-in with email and password

If you create an account with an email and a password, your password never leaves your browser in readable form: the browser turns it into a one-way key, and our server stores only a further irreversible hash of that key. We cannot see or recover your password.

To check that a new password is not in known data leaks, the browser sends only the first 5 characters of a one-way hash of it to the Have I Been Pwned service. To protect the forms from bots, Cloudflare Turnstile checks your visit when you sign in, create an account or ask for an email.

Emails (confirmation and new password) are sent by Resend (USA) on our behalf; it receives your email address and the email text only to deliver it. Accounts whose email is not confirmed are deleted after 7 days.