Effective date: [Effective date] · Operated by [Legal entity name]
FiveColorFolio ("we", "us", or "our") is a Magic: The Gathering collection-tracking service operated by [Legal entity name]. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have over it.
By creating an account or using FiveColorFolio, you acknowledge that you have read and understood this policy.
We collect the following categories of personal data:
Account data — your email address and hashed password when you register.
Collection data — the card names, set codes, finishes, quantities, condition notes, and acquisition records (purchase price, cost basis, acquisition date) that you enter into the app.
Usage and analytics data — pages visited, features used, timestamps, and error events. This data is collected in aggregate and is used to improve the product.
Session data — a session cookie (or token) is set when you log in and is used to authenticate subsequent requests. We do not use third-party advertising cookies.
Communications — if you contact us by email, we retain that correspondence.
We use the data we collect to:
Provide and operate the service — storing your collection, computing cost-basis and market-value estimates, and displaying your portfolio.
Send transactional email — account verification, password resets, subscription receipts, and service notifications.
Process payments — billing is handled by Stripe on our behalf (see Subprocessors below). We do not store payment-card numbers.
Improve the product — aggregate usage analytics help us understand which features are used and where errors occur.
Comply with legal obligations — we may retain or disclose data where required by applicable law.
We do not sell your personal data. We do not use your collection data for advertising.
We share data with the following subprocessors solely to operate the service:
Stripe — payment processing and subscription management. Stripe receives your email address and billing information. Stripe's privacy policy is available at stripe.com/privacy.
Resend — transactional email delivery. Resend receives your email address and the content of system-generated emails sent to you.
Railway — cloud infrastructure provider. Your account data and collection data are stored on Railway's infrastructure. Railway's data processing addendum is available at railway.app.
Scryfall and MTGJSON — card metadata (names, set codes, oracle text, imagery) is sourced from these publicly available databases. No personal data is transmitted to them.
TCGplayer and Card Kingdom — market price data is fetched from these services to generate portfolio estimates. No personal data is transmitted to them.
We do not authorize subprocessors to use your data for any purpose beyond providing their services to us.
We set one first-party session cookie when you log in. This cookie is strictly necessary for authentication and expires when your session ends or when you log out.
We do not use third-party tracking cookies, advertising pixels, or persistent fingerprinting.
If we add optional analytics cookies in the future, we will update this policy and, where required by law, seek your consent.
We retain your account and collection data for as long as your account is active.
If you delete your account, we will delete your personal data promptly (usually no later than 30 calendar days after deletion is confirmed), except where we are required to retain it for legal or tax compliance purposes (for example, billing records, which we may keep for up to 7 years).
Anonymized or aggregated analytics data (which cannot identify you) may be retained indefinitely.
Depending on your jurisdiction, you may have the right to:
Access — request a copy of the personal data we hold about you.
Export — download your collection data in machine-readable format via the in-app export feature.
Correction — ask us to correct inaccurate data.
Deletion — request that we delete your account and associated personal data.
Objection or restriction — object to certain processing or ask us to restrict it.
To exercise any of these rights, email us at info@foddy.store. We will respond no later than 30 days after receiving your request. We may need to verify your identity before acting on a request.
FiveColorFolio is not directed at children under 13 (or under 16 where applicable law requires a higher age threshold). We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us at info@foddy.store and we will delete it promptly.
FiveColorFolio is operated from the United States and our infrastructure (Railway) is hosted in the United States. If you access the service from outside the United States, your data will be transferred to and processed in the United States, which may have different data-protection laws than your home country.
By using the service, you acknowledge this transfer. We take reasonable steps to ensure your data is handled securely in accordance with this policy.
We may update this policy from time to time. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you by email.
Your continued use of FiveColorFolio after a policy update constitutes your acceptance of the updated policy.
Questions or concerns about this Privacy Policy can be sent to info@foddy.store.