Privacy Policy
FoilVault (“we”, “us”) makes a Magic: The Gathering collection and deck-building app and website (the “Service”). This policy explains what information we collect, how we use it, and the choices you have. By using the Service you agree to this policy.
Information we collect
- Account information. When you sign in with Google or Apple, our authentication provider (Google Firebase Authentication) gives us your email address and a unique account identifier, and may provide your name.
- Access requests. If you request beta access on our website, we keep the email address and note you submit, along with your IP address and browser type to prevent abuse, and use them only to send your invite. The request is delivered to us by email through our email provider, Resend.
- Profile. A handle, and any display name, bio, and card-art avatar you choose. Profiles are public by default; you can make yours private in settings.
- Content you create. Your collection (cards, quantities, conditions, languages, and any purchase prices you record), wishlists, decks, trade binders, ratings, comments, and likes.
- Trading activity. Your home-store preferences, trade records you log, and messages you send in trade deals.
- Card scanning. If you use the scanner, camera images are processed on your device to recognize cards. We do not upload or store your photos; only the resulting card match is added to your collection.
- Notifications. If you enable push notifications, we store a device push token so we can send them. You can turn them off at any time.
- Diagnostics. Basic server logs (such as request and error information) used to operate and secure the Service.
- Product analytics. We use PostHog to understand how the app is used. It records which screens you view and when the app is opened or backgrounded, and — once you are signed in — associates that activity with your account identifier and email address. We do not record taps, keystrokes, or screen contents.
- Crash and error reporting. We use Sentry to capture crashes and errors. A report can include the error itself, a stack trace, and technical details about your device, app version, and the request that failed.
How we use information
- To provide and maintain the Service and your account.
- To sync your collection, decks, and trading data across your devices.
- To power social features you opt into (public profiles, published decks, follows).
- To send notifications you have enabled.
- To secure the Service, prevent abuse, and debug problems.
How information is shared
- Publicly. Your public profile and any decks you publish are visible to other users and on the public web. Private profiles and unpublished content are not.
- Service providers. We use Google Firebase (authentication), Google Cloud and Neon (hosting and database), PostHog (product analytics), Sentry (crash and error reporting), and Resend (email delivery) to run the Service. They process data on our behalf under their own terms.
- Card and price data. Card information and prices come from third parties such as Scryfall and TCGplayer. Links you tap may take you to those sites, which have their own privacy policies.
- We do not sell your personal information, and we do not show third-party advertising.
- We may disclose information if required by law or to protect the Service and its users.
Data retention and deletion
We keep your information for as long as your account is active. You can permanently delete your account at any time from the app (Settings → Account) or the website (Profile). Deleting your account removes your profile, collection, decks, trading data, and other account data from our database. Some information may persist briefly in backups or be retained where required by law.
Your rights
Depending on where you live, you may have rights to access, correct, export, or delete your personal information. You can exercise most of these directly in the app, or contact us at the address below.
Children
The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.
Security
We use industry-standard measures to protect your information, including encrypted connections and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Changes to this policy
We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide a more prominent notice.
Contact
Questions about this policy? Email us at support@foilvault.cards.