Privacy Policy

1. Who We Are

Chestfolio is a product of DevFruit LLC, an Iowa limited liability company. We make tools for collectors. This policy describes how we handle information in connection with the Chestfolio website at chestfolio.com and the Chestfolio app at app.chestfolio.com.

Contact: hello@chestfolio.com

2. What We Collect

Information you provide

• Account information. Your email address, used to identify your account and send you sign-in links. If you sign in with Google, we also store the account identifier Google provides. We never receive your Google password, and we do not store your name, profile picture, locale, or any other Google profile field.
• Year of birth. We ask for your birth year once, to confirm you meet the age requirements in Section 9. We store the year only, not your full date of birth.
• Collection data. Your card inventory, want list, chests, binders and goals, and anything you enter alongside them: notes, where a card is kept, purchase prices, purchase dates, grading details, and records of cards you sell, trade, give away or lose. This data belongs to you, and you can export it at any time in CSV or JSON format, free of charge.
• Username. An optional username, which you choose only to share a chest or binder or to join someone else's. We keep the date you last changed it, to apply the 30-day limit in Section 5.
• Activity history. A record of changes to your chests and binders: which card was added, moved, removed, sold, traded or given away, by whom, and when, and who joined or left a shared chest or binder. Section 5 says who can see it.
• Reports. If you report a username, a note or a shared page, we keep what you sent and which account sent it, so we can review it.
• Notices and agreement. When we email you a legal notice, we record that it was sent and when. When you agree to updated terms in the app, we record which version you agreed to and when.

Information collected automatically

• Scan counts. A monthly tally of how many cards you have scanned, used to apply the scan limit shown in the app.
• Retailer link clicks. When you follow a link from Chestfolio to a retailer, we record which card it was for and when. Where you are signed in, that record may be associated with your account.

What we do not collect. We do not store your IP address, browser user agent, referring page, device identifier, or location. We use no analytics, advertising, tracking, telemetry, or error-reporting services of any kind. Section 6 describes the third parties your browser contacts directly, which do see your IP address.

Stored on your device

Chestfolio works offline, so some data is held in your browser on each device you use:

• A sign-in cookie. One cookie that keeps you signed in for seven days. It is strictly necessary for the service to work, cannot be read by scripts, and is never used for tracking or advertising. We set no other cookies.
• An offline copy of your collection. Your inventory, want list, chests and binders, plus card catalog data, stored so the app works without a connection.
• Card photos you add. If you add your own photo for a card that has no image, it is stored only in your browser on that device. It is never uploaded to our servers or shown to anyone else.
• Your preferences. Choices such as which section you last used and which binder new cards go to, so the app opens the way you left it.

You can remove all of it at any time by clearing site data for Chestfolio in your browser settings.

3. How We Use Your Information

• To provide and operate the Chestfolio app and services.
• To show the chests and binders you share to the people you share them with, and to the visitors of any public link you turn on (Section 5).
• To send transactional messages you request, such as sign-in links, and service notices, such as notice of changes to this policy.
• To check usernames for offensive or misleading names, and to review reports.
• To respond to support inquiries sent to hello@chestfolio.com.
• To understand how the product is used and improve it.

We do not use your data for advertising profiling or sell it to third parties for marketing.

4. We Do Not Sell or Share Your Personal Information

We do not sell, rent, trade, or share your personal information with third parties for their own marketing purposes, period. We share data only with service providers who help us operate Chestfolio (see Section 6), only to the extent necessary to do so, and with the other collectors you choose to share with (see Section 5).

5. Your Collection Data Is Yours, Including What You Share

Your card collection, want list, and scan history belong to you. You can export your full collection as CSV or JSON at any time, free of charge. This will never be a paid feature. We saw what happened when TCG Card Dex was shut down in 2023: we are committed to making sure that never happens to your data with us.

Sharing is your choice. Nothing in your collection is shared unless you share it. You can share a chest or binder with other Chestfolio accounts by invitation, and later by a view-only public link. You approve each person who joins, and you can stop sharing at any time.

What members see. Each person you invite becomes a member, with "Add cards" or "Only view" access. Members see:

• the cards in the chest or binder, their prices, and its goal progress;
• what each copy cost, unless its owner turns on "Hide what I paid" for that chest or binder;
• notes, and where each card is kept;
• each member's username, and the activity history: who added, moved, removed, sold, traded or gave away which card, and when;
• who has claimed a missing card, where claims are used.

Members never see your email address, your other chests and binders, or card photos stored on your device. Chestfolio has no messaging between users.

Gift binders. If you place a card you own into a gift binder, the app gives it away once you confirm. It leaves your collection and counts in no one's collection, and the history keeps who gave it and when.

Leaving. Each shared chest or binder has a leave setting, chosen by its owner and shown before you join. When a member leaves or is removed, their copies either go with them, stay and pass to the owner, or the member chooses. If an owner deletes a shared chest or binder, each member's copies return to that member's own collection.

Public links (coming later). Public links are off unless you turn one on, and only account holders 18 or older can create one. Anyone with the link can view that chest, binder or collection without an account. Visitors see the cards and goal progress; values, notes and your username appear only if you turn each one on. Visitors never see what you paid, the activity history, members, your email or your device photos. On a binder others add to, only its owner can create a public link. Public pages are kept out of search engines, we count only their total views, and turning a link off removes the page.

Usernames. Your username is seen only by members of the chests and binders you share or join, and by visitors to a public link if you turn it on. There are no public profiles and no user search. You can change your username once every 30 days, and a username you stop using is held for 90 days before anyone else can take it. If a username is offensive or impersonates someone, we may reset it to a neutral one, such as collector_4821, and ask you to choose again.

6. Third-Party Processors

We use the following categories of third-party services. Each has its own privacy policy.

• Cloud hosting. Our servers and static files are hosted on cloud infrastructure in the United States.
• Sign-in with Google. If you choose to sign in with Google, Google provides us your email address and an account identifier. We request only basic profile and email access, and we receive no password, contacts, or other Google data. Google's own privacy policy governs their handling of your sign-in.
• Email delivery. Sign-in links and other transactional email are sent through Microsoft 365. Microsoft processes the recipient address and message content in order to deliver it.
• Username checks. When you choose a username, we send that username, and nothing else, to Sightengine, a content moderation service, to check it for offensive or misleading names. We do not send your email or any other account information.
• Card data and image APIs. Card information and thumbnail images are retrieved from permitted third-party APIs (TCGdex). We do not store full-resolution card art.
• Card recognition. The scanner sends your card photo directly from your browser to a third-party recognition service (Ximilar) to identify the card. Because that request comes from your device rather than our servers, Ximilar receives your IP address and browser user agent. We do not keep the photo.
• Retailer links. Links from Chestfolio to retailers (TCGplayer, through the Impact affiliate network) are ordinary links. When you follow one, your browser contacts that retailer directly and they receive your IP address, browser user agent, and the fact that you arrived from Chestfolio. We may earn a commission on purchases made through these links, at no additional cost to you.

7. Data Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect your information against unauthorized access, disclosure, alteration, or destruction. These include encrypted connections (HTTPS), access controls, and standard industry practices for secure data handling.

However, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security of your information. If you become aware of a security concern, please notify us at hello@chestfolio.com.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you the service and fulfill the purposes described in this policy. When you close your account or submit a deletion request, we will delete or anonymize your personal information within a reasonable time, except where we are required to retain it by law (for example, for tax or legal compliance purposes).

Collection data that you have exported remains on your device and is your responsibility. Backups may persist for a limited period after deletion as part of our standard backup rotation before being fully removed.

Shared chests and binders keep their activity history for as long as they exist. If you leave one, your past entries stay in its history. If you delete your account, your copies leave the chests and binders you shared or joined, and your entries in other members' histories read "former member" instead of your username.

A username you stop using is kept for 90 days, so no one else can take it during that time, and is then released. A username we reset is held for good, so no one else can take it. Records of the legal notices we send you and of your agreement to updated terms are kept while your account exists. Reports are kept while we review and act on them, and for up to 12 months after a decision, to handle repeat problems.

9. Age Requirements: 16 and Over, 18 for Public Links

Chestfolio is intended for users who are 16 years of age or older. We do not knowingly collect personal information from anyone under 16. If you believe a person under 16 has provided us with personal information, please contact us at hello@chestfolio.com and we will delete it promptly.

Public links are available only to account holders who are 18 or older, based on the birth year you give us. Users aged 16 and 17 can share by invitation only, and Chestfolio has no public profiles or messaging.

10. California Residents

If you are a California resident, you may have the following rights regarding your personal information under California privacy law. To exercise any of these rights, email us at hello@chestfolio.com with the subject line "California Privacy Request." We will respond within 45 days.

• Right to know. You may request that we disclose the categories and specific pieces of personal information we have collected about you, the purposes for collection, and the categories of third parties with whom we share it.
• Right to delete. You may request that we delete personal information we have collected about you, subject to certain exceptions (such as legal obligations).
• Right to correct. You may request that we correct inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing. We do not sell or share your personal information for cross-context behavioral advertising. There is nothing to opt out of in this regard, but you may submit a request to confirm this in writing.
• Right to limit use of sensitive personal information. We do not use sensitive personal information for purposes beyond those necessary to provide the service. You may request confirmation of this limitation.
• Right of non-discrimination. We will not discriminate against you for exercising any of these rights. Exercising your privacy rights will not result in denial of service, different pricing, or reduced quality of service.

We extend these rights to everyone who uses Chestfolio, not only California residents. To delete your account and the data associated with it, email hello@chestfolio.com from the address on your account, with the subject line "Delete my account." We handle these requests manually and will confirm within 45 days. Deletion removes your account record, your username, your inventory, want list, chests, binders and goals, and your activity history from our servers. In chests and binders shared with others, your copies leave with your account, and your entries in their histories read "former member". Data you have already exported, the offline copy held in your browser, and photos stored on your device remain yours to remove.

11. Pricing Data Disclaimer

Card prices displayed in the Chestfolio app are sourced from third-party APIs and market data aggregators. Prices are estimates provided "as is" for informational purposes only. They are not financial, investment, or tax advice. We do not guarantee accuracy, timeliness, or completeness of any pricing data.

12. Changes to This Policy

We may update this policy as the product evolves. The effective date at the top of this page reflects the most recent revision, and we review this policy at least once a year. For material changes affecting your rights, we will notify registered users by email and in the app before the changes take effect, and keep the previous version available. Continued use of Chestfolio after changes are in effect constitutes your acceptance.

13. Contact Us

For any questions about this policy or how your information is handled: