Privacy policy

Last updated: 6 October 2026

The principle

My Larp Wallet is designed to work without collecting your content. Mockup rendering happens entirely in your browser.

What we process

• Account: your email address and a password, held by Supabase, our authentication provider. The password is stored hashed: we never see it. Both are required to open your wallet and to restore your access if you sign in from another device. If you create your account within 24 hours of opening an affiliate's link, that affiliate's code and the time you opened the link are kept with your account, so that a purchase you make within those 24 hours from another browser or device is still attributed to that affiliate. They are used for nothing else. If you choose Continue with Google, Google confirms your email address instead of a code, and sends us your email address, your name and your profile picture link. We use the email address for your account; we don't use the name or the picture, and we never see your Google password.
• Purchase: your email address and billing details are processed by Stripe, our payment provider. We keep your email and the transaction id in order to attach your access to your account and to honour a refund. If you pay for lifetime access in crypto, Whop processes the payment instead of Stripe: we send Whop your email address, your account id and, if you came through an affiliate link, that affiliate's code. Whop sends us back the amount paid, the transaction id, and the email address, user id and username of your Whop account. We use that email only when the purchase does not already carry your address from here: to attach the purchase to your account, and to check that the affiliate code used is not your own. The user id and username only reach our logs, and only when nothing else identifies you, so that we can attach the purchase by hand. The wallet you pay from is handled by Whop; we never ask for it. If your bank declines a card payment, we may send a one-time email to your account's address about an hour later. For each declined card payment we keep a note with your account: why it was declined, whether we emailed you about it, and whether you paid afterwards.
• Licence: the plan, the creation date and the expiry when the plan has one. It is attached to your account: there is no key to send and nothing to type in.
• Wallet configuration: saved twice: in your browser's local storage, and with your account at Supabase, so the same wallet reopens on another device. It holds what you composed: tokens, amounts, account name, colours, and any avatar or token icon you uploaded, carried as image data inside the configuration.
• Audience measurement: daily counters, described in full in the next section.
• Session recordings: on some public pages, and only for visitors outside Europe, through Microsoft Clarity. Described in full in the section "Session recordings" below.
• Price testing: the price group your browser was placed in, a random identifier for this browser, and what you did on this site from then on. Described in full in the section "Price testing" below.
• Payment options test: whether your browser and your account see the option to pay for lifetime access in crypto. Described in the section "Payment options test" below.

A demonstration wallet is not in that list, because we do not process it. On /demo the wallet you compose, and a count of the changes you have made, are kept in your browser's local storage and nowhere else. They are never sent to us, they are attached to no account, and we cannot read them. Where session recordings run on that page (see below), the wallet is masked in your browser before anything is sent, so its content does not leave your device that way either. If you open an account later in that same browser, that wallet is carried into it once and the local copy is deleted.

The free tools are not in that list either. On /tools/crypto-portfolio-calculator the quantities you type are kept in your browser's local storage so they are there next time, and nowhere else. Like every page, it sends the anonymous counts listed under Audience measurement below; apart from those, its only request is for public market prices, the same for every visitor, and it carries no quantity. The Clear button deletes the quantities. Its "See it as a wallet on your phone" button copies the SOL, ETH, BTC, HYPE and USDC quantities into the demonstration wallet described above, in the same browser. On /tools/screenshot-size-calculator a screenshot you check is read by your browser, which looks at its first bytes for the size and format; the file is never uploaded.

Audience measurement

We count how the site is read, because we have to decide what to write next. Here is the entire list of what a page sends, and nothing else is sent:

• The path of the page you are on (/blog, /login). Never the query string, never the part after #.
• The domain of the site you arrived from (google.com, reddit.com) or the word direct. Never the full address of that page: a search query or a private thread has no business being in our statistics.
• One of three screen shapes: mobile, tablet or desktop. Worked out from the size of your window, not from your browser's user agent.
• The country your connection comes from, as a two-letter code (us, fr). Our host works it out from the request; the IP address itself is not kept.
• Which of a fixed list of buttons you clicked. The list is written into our code; a name that is not on it is thrown away.
• How far down you scrolled, rounded to one of four marks: 25%, 50%, 75%, 100%.

Alongside those, we count a visit once per browsing session, and a visitor once per browser per day. To avoid counting you twice, your browser keeps two small values: a flag that lasts as long as the tab is open, and today's date. That date is the same for everyone visiting today: it identifies nobody, and it never leaves your device.

These counters set no cookie and keep no identifier. No IP address is recorded in them, and nothing here can follow you to another site. Apart from the Microsoft Clarity cookies described under "Session recordings" below, which are only set for visitors outside Europe, the only cookie this site sets is the price-testing cookie described in the section "Price testing", which is separate from these counters.

These counters do not run inside the wallet itself, and they do not run on these legal pages. Price testing, described below, does.

Affiliate links. When you arrive through an affiliate's link (mylarpwallet.com/r/…), that affiliate's counters go up by one, at most once a day per browser. Next to that count we keep, per affiliate and per day, the same kind of totals as above: the platform you came from (TikTok, YouTube, Google, other or direct), your country as a two-letter code, and your screen shape. When a link is opened inside an app such as Instagram or TikTok, which usually hide where a visitor came from, the platform is read from the name that app gives its built-in browser; only that platform name is kept. The affiliate sees these totals on their dashboard and nothing else: no address, no identifier, nothing that tells them who clicked.

If you would rather not be counted at all, open mylarpwallet.com/?mesure=off once in this browser. It sets a flag that stops every measurement on the site, session recordings included, on every page, until you open /?mesure=on. The flag stays on your device and is never sent to us. If your browser blocks local storage, the flag cannot be saved: the address then keeps ?mesure=off, which does the same job for as long as it stays in the address bar.

Separately, page views are also counted by Vercel Web Analytics. Its script is served from this domain, sets no cookie, and builds no profile. Unlike the measurement described above, it runs on every page, including the wallet and these legal pages, and it records the path it was loaded on. Your wallet is served at mylarpwallet.com/your-name, so that address is the path it sees.

Session recordings

We work with Microsoft Clarity to see how some of our public pages are used: where people click, how far they scroll, where they hesitate, through behavioural metrics, heatmaps and session replay. We use it to find what is confusing and fix it.

• Where it runs: the home page, About, Contact, the demo, the download page, the socials page, the blog, the guides, the comparison pages, and the examples and "for" pages. It does not run in your wallet, on the sign-in and sign-up page, in the clip library, on the affiliate pages, on the page shown after a payment, on the free tools, or on these legal pages.
• Who it runs for: it is not loaded at all when your device is set to a time zone of the European Economic Area, the United Kingdom or Switzerland. Microsoft also withholds its cookies from visits coming from those countries unless consent has been given.
• What it records: mouse movements, taps, clicks, scrolling and the page as it is displayed, with technical details such as your screen size, browser and approximate location. Anything typed into a form field is masked in your browser and never sent. On the demo, the wallet you compose is masked the same way.
• Price group: each recording is labelled with the price group your browser was placed in (see "Price testing"), so we can compare how each group reads the pricing.
• Cookies: Clarity sets two cookies on this domain, _clck (keeps the same visitor id between visits) and _clsk (joins the pages of one visit into one recording), and Microsoft sets cookies on its own domains (CLID, MUID and related ones), which Microsoft also uses for its own analytics and advertising purposes.
• Retention: recordings are available to us for 30 days after they are made.

Microsoft processes this data under the Microsoft Privacy Statement. To stop it in your browser, open mylarpwallet.com/?mesure=off once, as described above. Blocking cookies is not enough on its own: Clarity then still records, it simply cannot join your pages into one visit.

Price testing

We test prices for new customers. The first time you open the site, your browser is placed at random in one price group, and it stays in that group, so the prices you see in that browser do not change from one visit to the next. Once you have an account and are signed in, you see your account's prices on every device. Another browser, an app's built-in browser, a private window, or a browser whose site data was cleared starts without that record. If it connects through the same network as a browser already placed in a group (the same home Wi-Fi, for example), it joins that group, so your devices at home show the same prices; on another network it may show other prices until you sign in. The group is drawn at random. The one exception is a browser or an account that already knew our prices before the test: it keeps those prices. Apart from that, nothing about you, your device or your location decides your group.

To keep your prices stable we store:

• a cookie named mlw_ab, set by our server, holding your price group, a random identifier created for this browser, and the date it was created. It lasts up to 400 days;
• the same three values in your browser's local storage, with your account's identifier once you sign in, a note of your first visit (the page, the domain you came from, your screen shape, the affiliate code of the link you used, if any) and the day of your last visit;
• once you create an account, your price group on your account, so you see the same prices on every device once you are signed in;
• so that the other devices on your network get the same prices: a one-way code computed from the network your visit came from (your public IP address, or its network part for IPv6), never the address itself, with the price group first seen on that network and a count of the new browsers seen on it. It is deleted 30 days after the last visit from that network. A network where many new browsers appear, such as an office or a mobile carrier, stops being used this way;
• for 15 minutes, a cookie named mlw_ab_r, set by our server on the first page of a browser that has no group yet, holding the group of its network.

With that identifier we record, for this browser: the first page you opened, the domain of the site you came from, your screen shape, the kind of browser (for example "Instagram's built-in browser"), your country as a two-letter code, which affiliate link you arrived through, if any, the days you come back, and a fixed list of steps: seeing a price or an offer, opening the sign-up or payment screen, clicking one of a fixed list of buttons, choosing a plan, starting a checkout, paying. This runs on every page of this site, including the wallet (recorded as /app, never as your wallet's own address) and these legal pages. When you create an account, these records are linked to it. We use them only to compare the price groups and choose our prices. They are never shared, never sold, and never used to follow you on another site.

The legal basis is our legitimate interest in setting our prices (Article 6(1)(f) GDPR). Records not linked to an account are deleted twelve months after the test ends; records linked to an account are kept with it, and those linked to a payment are kept with the billing records. You can object at any time by writing to contact@mylarpwallet.com: we delete your records and keep only what is needed to show you consistent prices. Opening mylarpwallet.com/?mesure=off stops these records in that browser: it is no longer registered, its network is not noted, and none of its steps are recorded. The cookie that keeps your prices stable remains, and a checkout started from your account is still recorded with that account.

Payment options test

We also test whether offering to pay for lifetime access in crypto changes what people buy. Half of the browsers see the crypto option (the "Card or crypto" label, the "Pay with crypto" button and the lines that mention it); the other half do not see it anywhere on the site. Prices are the same in both halves. Which half a browser is in comes from the random identifier described under "Price testing", so it stays the same in that browser; nothing about you, your device or your location decides it. When you sign in, the version you saw first is stored on your account (a single character), and from then on you see that version on every device where you are signed in. Your browser keeps the same character in its local storage, with your account's identifier. We compare the two halves with the steps already recorded for the price test: nothing else is collected for it, and the legal basis and your right to object are those of the price test.

Payment form

On the payment screen, the card form, Apple Pay and Google Pay are provided by Stripe and load from js.stripe.com inside this page. What you enter there goes straight to Stripe: your card number never reaches us. To prevent fraud, Stripe collects information about your device and your visit, including cookies and your IP address, under its own privacy policy. No other page of this site loads it.

What we don't do

• No advertising trackers, and no analytics that profile you or follow you from one site to another.
• No sale or sharing of data for commercial purposes.
• No request for a private key, a seed phrase or a wallet address: the service has no use for them and never will.

Retention

Licence data is kept for as long as the subscription is active, then for one year after cancellation so we can restore access if you come back. Your wallet configuration is kept with your account for the same period, and deleting your account deletes it. Billing records are kept for ten years, as accounting rules require.

The notes about declined card payments are kept with your account, and deleting your account deletes them.

If you created your account within 24 hours of opening an affiliate's link, that affiliate's code and the time you opened the link are kept with your account, and deleting your account deletes them.

Price-testing records follow the rules given in "Price testing" above.

A demonstration wallet composed on /demo is not kept by us at all: it exists only in the browser that composed it, until it is carried into an account, that browser's data is cleared, or seven days pass. There is nothing here to restore it from.

Your rights

You have rights of access, rectification, erasure and portability. Write to contact@mylarpwallet.com from the address used at purchase. You may also lodge a complaint with the French data protection authority (CNIL).

Video clips on the socials page

The socials page shows clips from our own channels. Until you tap one, nothing is requested from YouTube: what you see is an image served from this domain. Tapping a clip loads YouTube's player, and from that moment YouTube receives your request and can set its own cookies, under its own policy. We use the youtube-nocookie.com address, which is the most restrictive one they offer. No other page on this site contacts them.

Processors

• Stripe: payment processing.
• Whop: crypto payments for lifetime access (your email address and account id; in return, the amount, the transaction id and your Whop account's email address, user id and username).
• Supabase: account, licence and wallet configuration storage, audience counters, and price-testing records.
• Resend: sending our emails (account confirmation, password reset, and the one-time email about a declined payment).
• Vercel: hosting.
• Microsoft (Clarity): session recordings and heatmaps, on some public pages and only for visitors outside Europe.
• YouTube (Google): video playback, only on the socials page and only after you tap a clip.
• Google: sign-in, only if you choose Continue with Google.