A card is five letters and a count.

What a counter stores

The shop name, the reward, the number of notches it takes, the wait between notches, whether new cards are open, a public join code (the one printed on the sign) and when the counter was made, changed and last opened. A counter opens only from its private link, which ends in a 20-character code; the site stores a fingerprint (a SHA-256 hash) of that code, never the code itself.

What a card stores

Its five-letter code, which counter it belongs to, how many notches it has, how many visits and rewards it has had, when it was last notched and when it was made and last seen. Like a counter, a card opens only from its own private code, kept as a fingerprint. For each notch, redeem or undo the counter keeps a line (card, kind, how many, when) so the shop's numbers and Undo work.

Private codes never in an address

A counter link looks like /c#… and a card link like /k#…. Browsers do not send the part after # to any server. The page posts the code once in a form, and the site then keeps the counter or the cards open in that browser with a private cookie: __Host-nc_counter (counter, up to 400 days) and __Host-nc_cards (up to 8 cards on one phone, up to 400 days). Closing the counter or removing a card removes it from the cookie. While a page is open, the browser sends that cookie with each request so the page can be shown; the code is used for that request and is not written to any table or log.

What the shop can see

The shop sees card codes and counts only. It cannot see who holds a card, what phone it is on, or any other shop's cards on the same phone.

How long things are kept

A counter that nobody opens for 400 days is deleted with all its cards and history. Counter history lines older than 400 days are deleted. A card that never gets a notch is removed after 7 days. A shop can delete a single card, its unused cards or its whole counter at any time. This site's own nightly database copies, and the copies taken on the server at each deploy, are kept for 14 days, so deleted counters and cards are gone from them within 14 days.

Cookies

Pages with a form (the start form, the counter, the join page, your cards page) set a security cookie (__Host-nc_csrf) that stops other sites from submitting forms in your name. The counter and card cookies are described above. There is no analytics, advertising or tracking cookie, and pages load nothing from other sites.

Limits on misuse

To stop abuse, the site counts how many counters, cards and tries come from each connection. It keeps only a salted hash of the address (IPv6 by its /64 network) with a count per hour or day, and those counters are deleted within three days.

Server logs and backups

Like every web server, the host keeps access logs (address, time, page, browser) for operating and securing the server; the 20-character private codes are never in them. Addresses on the counter (after a notch or a look-up) and the first Your cards page after joining can carry five-letter card codes, so those can appear in the logs; a card code alone opens nothing. WeldonPC also backs up the whole server, and keeps copies of this site's deploy backups on its own computers, so copies there can outlive the 14 days above.

Payments

Payments are not switched on (preview). When they are, PayPal will handle them; this site will never see card numbers.

Version of October 31, 2026. Questions: Contact WeldonPC. Please never send a counter or card link: anyone with it can open the counter or the card.