Privacy policy

Last updated November 5, 2026

This policy explains what Curiofoil ("we", "us") collects when you use the website and app at this address, and why. If something here is unclear, email us at hello@curiofoil.com.

What stays on your device

Without an account, everything you enter is saved in your browser's storage on your device: the cards in your collection and their condition, price paid and notes, your collections, wishlist, sold and traded records, and your settings. The app also keeps copies of prices, card pictures and exchange rates so it loads quickly and works offline. None of this is sent to us. Clearing your browser data, or using Delete all data in Settings, removes it.

If you sign in

Accounts are optional and let you sync a collection between devices. When you create one we store:

• your username;
• your password, kept only as a salted one-way hash (we can't read it);
• a copy of your collection data, so your other devices can download it;
• when the account was created.

A sign-in token is saved in your browser so you stay signed in. Signing out removes it from that device.

What the app requests from other services

To show card details, pictures and prices, your browser connects to our server and to a few public services. Like any website, each of them can see your IP address and basic request details (such as your browser type) when it answers:

• Netlify, which hosts Curiofoil and runs our server functions, which look up prices for the cards you view. It keeps standard server logs, and we use your IP address briefly to limit how many requests one visitor can make.
• TCGdex (api.tcgdex.net), for card search, card details and pictures. What you type in search is sent to TCGdex to find matching cards.
• TCGplayer's picture server (tcgplayer-cdn.tcgplayer.com), for some card pictures.
• Frankfurter (api.frankfurter.dev), for currency exchange rates.

Prices come from TCGplayer market data that our server downloads once a day. Your searches and collection are not sent to TCGplayer.

The card page links to other sites, such as eBay, PriceCharting and TickerMint, so you can check sales yourself. Those sites have their own privacy policies, which apply once you follow a link.

What we don't do

We don't show ads, use analytics or tracking tools, or set cookies. We don't sell, rent or share your personal information with anyone for their marketing.

How long we keep things

Account data is kept until you ask us to delete the account. Server logs are kept by Netlify for a short period under its own policies. Data on your device stays until you delete it.

Your choices

• Get a copy: Settings, Export CSV.
• Delete your data on this device: Settings, Delete all data.
• Delete your account and synced data: email us from any address and tell us your username. We'll confirm before deleting.

Depending on where you live, you may have other rights over your data, such as correcting it or objecting to how it's used. Email us and we'll help.

Children

Curiofoil isn't meant for children under 13, and we don't knowingly collect personal information from them. If you think a child under 13 has created an account, email us and we'll delete it.

Where data is stored

Our hosting provider stores account data in the United States. By creating an account you agree to your data being stored and processed there.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change affects how we use data you've already given us, we'll tell you in the app before it takes effect.

Contact

Questions or requests: hello@curiofoil.com.