Privacy Policy

1. Who We Are

Chestfolio is a product of DevFruit LLC, an Iowa limited liability company. We make tools for collectors. This policy describes how we handle information in connection with the Chestfolio marketing site at chestfolio.com and, when it launches, the Chestfolio app.

Contact: hello@chestfolio.com

2. What We Collect

Information you provide

• Account information. Your email address, used to identify your account and send you sign-in links. If you sign in with Google, we also store the account identifier Google provides. We never receive your Google password, and we do not store your name, profile picture, locale, or any other Google profile field.
• Year of birth. We ask for your birth year once, to confirm you meet the age requirement in Section 9. We store the year only, not your full date of birth.
• Collection data. Your card inventory, want list, and anything you enter alongside them — notes, purchase prices, purchase dates, and grading details. This data belongs to you and you can export it at any time in CSV or JSON format, free of charge.

Information collected automatically

• Scan counts. A monthly tally of how many cards you have scanned, used to apply the scan limit shown in the app.
• Retailer link clicks. When you follow a link from Chestfolio to a retailer, we record which card it was for and when. Where you are signed in, that record may be associated with your account.

What we do not collect. We do not store your IP address, browser user agent, referring page, device identifier, or location. We use no analytics, advertising, tracking, telemetry, or error-reporting services of any kind. Section 6 describes the third parties your browser contacts directly, which do see your IP address.

Stored on your device

Chestfolio works offline, so some data is held in your browser on each device you use:

• A sign-in cookie. One cookie that keeps you signed in for seven days. It is strictly necessary for the service to work, cannot be read by scripts, and is never used for tracking or advertising. We set no other cookies.
• An offline copy of your collection. Your inventory and want list, plus card catalog data, stored so the app works without a connection.
• A layout preference. Which section you last used, so the app opens where you left off.

You can remove all of it at any time by clearing site data for Chestfolio in your browser settings.

3. How We Use Your Information

• To provide and operate the Chestfolio app and services.
• To send transactional messages you request, such as sign-in links.
• To respond to support inquiries sent to hello@chestfolio.com.
• To understand how the product is used and improve it.

We do not use your data for advertising profiling or sell it to third parties for marketing.

4. We Do Not Sell or Share Your Personal Information

We do not sell, rent, trade, or share your personal information with third parties for their own marketing purposes — period. We share data only with service providers who help us operate Chestfolio (see Section 6), and only to the extent necessary to do so.

5. Your Collection Data Is Yours

Your card collection, want list, and scan history belong to you. You can export your full collection as CSV or JSON at any time, free of charge. This will never be a paid feature. We saw what happened when TCG Card Dex was shut down in 2023 — we are committed to making sure that never happens to your data with us.

6. Third-Party Processors

We use the following categories of third-party services. Each has its own privacy policy.

• Cloud hosting. Our servers and static files are hosted on cloud infrastructure in the United States.
• Sign-in with Google. If you choose to sign in with Google, Google provides us your email address and an account identifier. We request only basic profile and email access, and we receive no password, contacts, or other Google data. Google's own privacy policy governs their handling of your sign-in.
• Email delivery. Sign-in links and other transactional email are sent through Microsoft 365. Microsoft processes the recipient address and message content in order to deliver it.
• Card data and image APIs. Card information and thumbnail images are retrieved from permitted third-party APIs (TCGdex). We do not store full-resolution card art.
• Card recognition. The scanner sends your card photo directly from your browser to a third-party recognition service (Ximilar) to identify the card. Because that request comes from your device rather than our servers, Ximilar receives your IP address and browser user agent. We do not keep the photo.
• Retailer links. Links from Chestfolio to retailers (TCGplayer, through the Impact affiliate network) are ordinary links. When you follow one, your browser contacts that retailer directly and they receive your IP address, browser user agent, and the fact that you arrived from Chestfolio. We may earn a commission on purchases made through these links, at no additional cost to you.

7. Data Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect your information against unauthorized access, disclosure, alteration, or destruction. These include encrypted connections (HTTPS), access controls, and standard industry practices for secure data handling.

However, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security of your information. If you become aware of a security concern, please notify us at hello@chestfolio.com.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you the service and fulfill the purposes described in this policy. When you close your account or submit a deletion request, we will delete or anonymize your personal information within a reasonable time, except where we are required to retain it by law (for example, for tax or legal compliance purposes).

Collection data that you have exported remains on your device and is your responsibility. Backups may persist for a limited period after deletion as part of our standard backup rotation before being fully removed.

9. Age Requirement — 16 and Over

Chestfolio is intended for users who are 16 years of age or older. We do not knowingly collect personal information from anyone under 16. If you believe a person under 16 has provided us with personal information, please contact us at hello@chestfolio.com and we will delete it promptly.

10. California Residents

If you are a California resident, you may have the following rights regarding your personal information under California privacy law. To exercise any of these rights, email us at hello@chestfolio.com with the subject line "California Privacy Request." We will respond within 45 days.

• Right to know. You may request that we disclose the categories and specific pieces of personal information we have collected about you, the purposes for collection, and the categories of third parties with whom we share it.
• Right to delete. You may request that we delete personal information we have collected about you, subject to certain exceptions (such as legal obligations).
• Right to correct. You may request that we correct inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing. We do not sell or share your personal information for cross-context behavioral advertising. There is nothing to opt out of in this regard, but you may submit a request to confirm this in writing.
• Right to limit use of sensitive personal information. We do not use sensitive personal information for purposes beyond those necessary to provide the service. You may request confirmation of this limitation.
• Right of non-discrimination. We will not discriminate against you for exercising any of these rights. Exercising your privacy rights will not result in denial of service, different pricing, or reduced quality of service.

We extend these rights to everyone who uses Chestfolio, not only California residents. To delete your account and the data associated with it, email hello@chestfolio.com from the address on your account, with the subject line "Delete my account." We handle these requests manually and will confirm within 45 days. Deletion removes your account record, your inventory, and your want list from our servers. Data you have already exported, and the offline copy held in your browser, remain yours to remove.

11. Pricing Data Disclaimer

Card prices displayed in the Chestfolio app are sourced from third-party APIs and market data aggregators. Prices are estimates provided "as is" for informational purposes only. They are not financial, investment, or tax advice. We do not guarantee accuracy, timeliness, or completeness of any pricing data.

12. Changes to This Policy

We may update this policy as the product evolves. The effective date at the top of this page reflects the most recent revision. For material changes affecting your rights, we will notify registered users by email before the changes take effect. Continued use of Chestfolio after changes are in effect constitutes your acceptance.

13. Contact Us

For any questions about this policy or how your information is handled: