Exactly what RKing Industries (rkingindustries.com) does with your data. No filler.
Effective: 15 Sep 2026 ยท Applies to darts.rking / online_darts / offline_darts / circuit tool on rkingindustries.com
01Data We Collect
Here's the literal table of what's stored against your account, straight from the schema. Nothing here is inferred or hidden behind vague language.
Field
What it is
Why we have it
username
Your chosen handle
Login + public identity
email
Your email address, unique per account
Login, verification, notices
password_hash
Argon2 hash of your password
Auth. Plaintext password is never stored.
is_verified
Whether you completed email verification
Gate access to login
suspended
Account suspension flag
Moderation
verification_code
6-char one-time code
Expires 15 min after signup, then wiped
friend_code
Randomly generated 20-char ID
Lets others add you without exposing email/username
created_at
Account creation timestamp
Record-keeping
If you add an address (optional, e.g. for shipping), we also store: address line 1 & 2, town/city, region, postcode, country code, and whether it's your default. This is only collected if you explicitly submit it - there's no address field on signup.
Session data - created every time you log in or verify your account:
Field
What it is
token
Random session token (32-byte, URL-safe)
device_type
A coarse category - Desktop, Mobile, Tablet, Bot, or Unknown - parsed from your User-Agent header, not your actual device model or OS version
created_at / expires_at / last_active
Session lifecycle timestamps
What we do not collect: we don't log your IP address in the app layer, we don't fingerprint your browser beyond the coarse device-type check above, and we don't track you across other sites. (Standard infrastructure-level request logs from hosting/network providers may still exist outside this app's control - that's normal for any server on the internet, not something this codebase does deliberately.)
02Cookies & Sessions
Cookie
Purpose
Lifetime
Flags
session_token
Keeps you logged in
30 days, or 365 if "stay logged in" is checked
httponly, samesite=lax
verify_token
Ties your browser to a pending email verification
15 minutes
httponly, samesite=lax
Both cookies are httponly, meaning client-side JavaScript can't read them. We don't set any advertising, analytics, or cross-site tracking cookies.
03Third Parties
Have I Been Pwned (password check)
When you set a password, we take a SHA-1 hash of it and send only the first 5 characters of that hash to the HaveIBeenPwned API to check it against known breach data. Your actual password, and the rest of the hash, never leave our server. This is the standard "k-anonymity" method - HIBP has no way to reconstruct your password from what we send.
Google Gemini API (circuit diagram tool)
If you use the /circuit tool, whatever you type is forwarded directly to Google's Gemini API to generate a response. That means your prompts and any content you paste into that specific tool are sent to Google and processed under Google's own terms - this doesn't apply to darts, your account, or anything else on the site, only the circuit diagram feature.
We don't sell, rent, or otherwise share your account data (username, email, password hash, address) with anyone else.
04Security
Passwords are hashed with Argon2 before storage - never stored or logged in plaintext.
Passwords must be 12-128 characters, include upper + lower case and a symbol, and can't match a known breached password (via the HIBP check above).
Session tokens are cryptographically random (secrets.token_urlsafe).
Sessions are invalidated immediately on logout, suspension, or account deletion.
05Your Rights
Access - everything tied to your account is listed in section 01 above, nothing extra is hidden.
Deletion - deleting your account with your password permanently removes your user record, addresses, and all sessions. Cascades automatically, no "soft delete."
Logout everywhere - logging out clears your current session token from the database and your cookie.
Correction - contact us to correct inaccurate account or address info.
06Changes to This Policy
If what we collect or how we use it changes materially, we'll update this page and adjust the effective date at the top. Continued use after that point means you accept the update.