Privacy Policy

Foilio is built to work on your device by default. We do not run ads, and we never sell your data. This page explains, in plain language, exactly what is collected, why, and what control you have. Foilio is an independent, unofficial fan project.

The short version

• Your collection, watchlist and settings live in your browser (local storage), not on our servers, unless you choose to sign in and sync.
• The card scanner identifies a card and does not store the picture.
• An account is optional and only exists to sync across your devices and manage Pro.
• We take no payment details; subscriptions are handled entirely by Stripe.
• If you use Foilio Shops, your listings and storefront are public and your messages and order details are stored so buyers and sellers can complete a deal.
• No ads on Foilio. No data sales.

The card scanner

When you scan, your camera runs in your browser. To identify the card, Foilio sends the picture it needs for the match, the crop inside the camera guide, or your uploaded photo scaled down, to our matching service, which compares it against a catalog of known printings and returns the closest matches. Scanned images are not stored, logged, or used for anything other than returning your result. Your camera is only ever active while you are on the scan screen.

Your collection and settings

Cards you add, your watchlist, cost basis, table-tool state and preferences are saved in your browser’s local storage on the device you use. If you never sign in, that data never leaves your device, and clearing your browser data removes it.

Optional accounts and sync

You can create an account to keep your collection in sync across devices and to carry Pro with you. Sign in is by email magic-link, Google, or Discord, handled by our authentication provider (Supabase). If you sign in, we store your account email and your synced collection data against your user id, protected so only you can read it. You can request deletion at any time (see Your rights).

Payments (Pro)

Foilio Pro is billed through Stripe. When you subscribe, you enter your card details on Stripe’s secure checkout, not on Foilio. We never see or store your full card number. From Stripe we receive only what we need to grant and manage the subscription (for example your billing email and subscription status). Stripe’s handling of your payment data is governed by Stripe’s own privacy policy.

Foilio Shops: listings, messages and orders

Foilio Shops lets you run a free storefront and lets buyers contact you. It is a listing and messaging tool: for every card and item sold here Foilio never takes payment, never holds funds and takes no commission, so we do not process your money for a trade. The single exception is store credit bought by card: that payment runs through Stripe, our payment processor, which receives your card details directly (we never see or store a card number) and tells us only that a payment of a given amount succeeded.

What sellers publish. Your shop name, handle, description, location, delivery options and prices are public, as are the photos you upload for listings and your shop logo and banner. Anything you publish on a storefront should be treated as public.

Messages. Buyers and sellers exchange messages through Foilio to agree a deal. We store the text of those messages, and any photo you attach to one, so the conversation is there when you come back to it. Messages are readable by you, by the other party, and by our moderators when a message is reported or when we investigate abuse. They are not used for advertising and are never sold.

Order details, including your address. When you place an order, the delivery details you enter, including your postal address, are sent to the seller as part of your order message and are stored with that message. Foilio does not keep a saved address book: the address exists only inside the message you chose to send, and the seller receives it because they are the one shipping to you.

Card machines. If you use a shop’s card machine, each draw (the card drawn, its value and whether you kept or returned it) is shown in that room’s public “Latest draws” list under a masked alias (the first and last letter of your username).

Community posts and reports. Posts, comments and images on the community board are public. Images are reviewed before they appear. Anyone, signed in or not, can report a post, a listing or a storefront; a private message thread can be reported by either of its participants. We store the report so a human can act on it.

Deleting it. Ask us at privacy@foilio.net to remove your shop, your listings, your uploaded images or your messages. Note that a message you sent already reached its recipient, and we may keep a record of reports and moderation decisions for safety.

If you email us or sign up for updates

If you send feedback, ask about the Dealer tier, or join a mailing list, we keep the email address and message you provide so we can reply and, if you opted in, send occasional updates. You can unsubscribe or ask us to delete it at any time. If you ask for one of our free downloads (for example the Downtime Bingo card at foilio.net/downtime-bingo), we store your first name, your email address, your company if you give it, the campaign tags in the link you followed and the page you came from, in our own database. We use them to send you the download and a few short follow-up emails about it, and to see which links bring readers. Every one of those emails has a one-click unsubscribe.

Analytics

We use Google Analytics 4 to understand which features are used and to fix problems, and, once it is switched on, the Meta Pixel. Once it is switched on, we also use Microsoft Clarity to see where visitors click, scroll and leave a page (heatmaps and recordings of page activity), so we can fix what gets in their way. Clarity loads only after you choose “Accept”, never runs on private links, and does not capture what you type into forms or the content of your messages, orders or account pages. Google Analytics loads with analytics and advertising storage denied and sets no analytics cookies until you choose “Accept” in the cookie banner; the Meta Pixel does not load at all before you choose “Accept”. If you choose “Only essential”, neither sets a cookie, and the app keeps working either way. You can change or withdraw your choice at any time with “Cookie settings” at the bottom of every page; withdrawing does not affect what was processed before. We do not sell analytics data. Google, Meta and Microsoft process this data under their own privacy terms, and Meta may also use it for its own advertising.

Separately, when you open a shop or one of its listings, Foilio adds one to an anonymous daily count for that shop, together with one word for the kind of site you arrived from (for example Facebook, Google or a direct link). It sets no cookie and stores nothing on your device, and the count itself holds no IP address and nothing else that identifies you. The shop owner sees only the totals.

Third parties we rely on

To run Foilio we use: Vercel (hosting), Supabase (accounts and sync; it also stores Shops data: listings, storefront images, message threads and their attachments, and the free-download sign-ups), Stripe (payments), Resend (the order confirmation email: your email address and what you ordered, and the follow-up emails after a free download: your email address and first name), an email-list service (the waitlist, price-alert and newsletter sign-ups: the email address you enter and which form it came from), Google (Google Analytics 4) and, once switched on, Meta (the Meta Pixel) and Microsoft (Microsoft Clarity), and free card-catalog sources for prices and images (Scryfall, TCGdex, YGOPRODeck, Lorcast, the PSA public API and Cardmarket-reference data). Buy links may point to eBay or Amazon under our affiliate disclosure. Each processes data under its own privacy terms.

Your rights

Wherever you live, you can ask us to access or delete the data tied to your account, and object to a given use. If you are in the EU/EEA or UK, you have rights under the GDPR; in California, under the CCPA. The fastest self-serve deletion is to sign out and clear your browser data (for on-device data) and to contact us to remove any synced account. We do not sell personal information.

Children

Foilio is a general-audience hobby tool and is not directed at children under 14 (Bulgaria) or under the minimum age in your country; shop card machines are for adults only (18+). We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will remove it.

Changes

If this policy changes materially, we will update the date above and, for significant changes, note it in the app. Continued use after an update means you accept the revised policy.

Contact

Questions or requests: use the feedback link in the app, or email privacy@foilio.net. We aim to respond within a few days.