diff --git a/src/pages/index.astro b/src/pages/index.astro
index 56eaaba..2bdc80c 100644
--- a/src/pages/index.astro
+++ b/src/pages/index.astro
@@ -14,9 +14,13 @@ if (!isLoggedIn(Astro.locals)) {
     return Astro.redirect("/login");
 }
 
-// Owner-scoping is enforced by the Directus permissions
+// Own cards only (the read permission also allows friends' collections,
+// which is what /friends/[username] uses — here we want just ours)
 const myCards = (await directus!.request(
-    readItems("mycards", { limit: -1 }),
+    readItems("mycards", {
+        filter: { user: { _eq: Astro.locals.user!.id } },
+        limit: -1,
+    }),
 )) as MyCardRecord[];
 
 // Fetch prices through the 24h-cached card endpoint
diff --git a/src/pages/mycards.astro b/src/pages/mycards.astro
index 56c7a6d..a0ea1fb 100644
--- a/src/pages/mycards.astro
+++ b/src/pages/mycards.astro
@@ -13,9 +13,14 @@ if (!isLoggedIn(Astro.locals)) {
     return Astro.redirect("/login");
 }
 
-// Fetch all user's cards (owner-scoping enforced by Directus permissions)
+// Own cards only (the read permission also allows friends' collections,
+// which is what /friends/[username] uses — here we want just ours)
 const myCards = (await directus!.request(
-    readItems("mycards", { sort: ["-date_created"], limit: -1 }),
+    readItems("mycards", {
+        filter: { user: { _eq: Astro.locals.user!.id } },
+        sort: ["-date_created"],
+        limit: -1,
+    }),
 )) as MyCardRecord[];
 
 const cardsWithPrice = await priceCollectionCards(myCards);