Can someone steal my game account using the information on my profile page?
TL;DR: If you don't want to show your cards but still want to use the tracker, you can set your profile as private.
From the very beginning of the development of the website, we always made sure that you can use all our features without showing them to the public. Which means that most of them don't require to be logged in on the website, and if you want to track your cards, you can set your profile as private. A private profile is only visible by you.
Sharing cards collection, or even friend IDs, are common practices within the LLSIF community, and not only on our website.
The KLab account retrieval procedure requires a little more information than just the friend ID and the collection of cards: the last time you logged in your game account, the networks you are often connected with, all the devices that you used with this account, … Those are information that you can't easily give if you aren't the actual owner of the account.
As small as they can be, we can't deny that there are actual risks. But so far, we haven't encountered any case of a stolen account using the data shown on our website, since they're not sufficient for account recovery. And, as mentioned previously, showing the cards you own to the community, either by posting your screenshots on Facebook/Twitter/Reddit, or by sharing them on School Idol Tomodachi, is entirely your choice and not a requirement.
We hope that this helps you understand our position in this matter. Feel free to ask if you have more questions!