Privacy Policy

FiveColorFolio ("we", "us", or "our") is a Magic: The Gathering collection-tracking service operated by Foddy LLC. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have over it.

By creating an account or using FiveColorFolio, you acknowledge that you have read and understood this policy.

We collect the following categories of personal data:

Account data — your email address and the authentication/session records needed for passwordless sign-in. FiveColorFolio does not collect an account password.

Collection data — the card names, set codes, finishes, quantities, condition notes, and acquisition records (purchase price, cost basis, acquisition date) that you enter into the app.

Operational data — request timestamps, feature events, errors, and performance diagnostics used to secure, operate, and improve the service.

Session data — a session cookie (or token) is set when you log in and is used to authenticate subsequent requests. We do not use third-party advertising cookies.

Communications — if you contact us by email, we retain that correspondence.

We use the data we collect to:

Provide and operate the service — storing your collection, computing cost-basis and market-value estimates, and displaying your portfolio.

Send transactional email — magic sign-in links, email-change confirmation, subscription messages, and service notifications.

Process payments — billing is handled by Stripe on our behalf (see Subprocessors below). We do not store payment-card numbers.

Improve the product — aggregate usage analytics help us understand which features are used and where errors occur.

Comply with legal obligations — we may retain or disclose data where required by applicable law.

We do not sell your personal data. We do not use your collection data for advertising.

We share data with the following subprocessors solely to operate the service:

Stripe — payment processing and subscription management. Stripe receives your email address and billing information. Stripe's privacy policy is available at stripe.com/privacy.

Resend — transactional email delivery. Resend receives your email address and the content of system-generated emails sent to you.

Railway — cloud infrastructure provider. Your account data and collection data are stored on Railway's infrastructure. Railway's data processing addendum is available at railway.app.

Better Stack — error monitoring. Better Stack receives scrubbed error diagnostics, including stack traces, request paths without query strings, and internal user IDs. We configure error reports to exclude email addresses, cookies, request headers and bodies, and collection data.

Scryfall and MTGJSON — card metadata (names, set codes, oracle text, imagery) is sourced from these publicly available databases. No personal data is transmitted to them.

Card-market data providers — catalog datasets may include prices attributed to TCGplayer and Card Kingdom. No personal data or collection records are sent to those marketplaces.

We do not authorize subprocessors to use your data for any purpose beyond providing their services to us.

We set one first-party session cookie when you log in. This cookie is strictly necessary for authentication and expires when your session ends or when you log out.

We do not use third-party tracking cookies, advertising pixels, or persistent fingerprinting.

If we add optional analytics cookies in the future, we will update this policy and, where required by law, seek your consent.

We retain your account and collection data for as long as your account is active.

If you delete your account, we will delete your personal data promptly (usually no later than 30 calendar days after deletion is confirmed), except where we are required to retain it for legal or tax compliance purposes (for example, billing records, which we may keep for up to 7 years).

Anonymized or aggregated analytics data (which cannot identify you) may be retained indefinitely.

Depending on your jurisdiction, you may have the right to:

Access — request a copy of the personal data we hold about you.

Export — download your collection data in machine-readable format via the in-app export feature.

Correction — ask us to correct inaccurate data.

Deletion — request that we delete your account and associated personal data.

Objection or restriction — object to certain processing or ask us to restrict it.

To exercise any of these rights, email us at info@foddy.store. We will respond no later than 30 days after receiving your request. We may need to verify your identity before acting on a request.

FiveColorFolio is not directed at children under 13 (or under 16 where applicable law requires a higher age threshold). We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us at info@foddy.store and we will delete it promptly.

FiveColorFolio is operated from the United States and our infrastructure (Railway) is hosted in the United States. If you access the service from outside the United States, your data will be transferred to and processed in the United States, which may have different data-protection laws than your home country.

Scrubbed error diagnostics sent to Better Stack are processed in the European Union.

By using the service, you acknowledge this transfer. We take reasonable steps to ensure your data is handled securely in accordance with this policy.

We may update this policy from time to time. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you by email.

Your continued use of FiveColorFolio after a policy update constitutes your acceptance of the updated policy.

Questions or concerns about this Privacy Policy can be sent to info@foddy.store.