Privacy Policy
Version 2026-09-25 · Last updated 25 September 2026
Slabfolio is a private trading-card collection tracker. This policy explains what personal data we collect when you visit the site or create an account, why, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR) and similar laws.
1. Who is responsible for your data
The data controller is Slabfolio, operated by an individual (no registered company). For anything related to your personal data, contact us at privacy@slabfolio.org.
2. What we collect, why, and on what legal basis
| Data | Why we use it | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account data: display name, email address, and a salted hash of your password (never the password itself). If you sign in with Google, GitHub or Discord we receive your email address from that provider — nothing else. | Creating and running your account, signing you in, sending verification and password-reset emails. | Performance of a contract (Art. 6(1)(b)). |
| Your collection content: cards, values, purchase prices, dates and locations, notes, tags, want list, sold records, price-history snapshots and any photos you upload. | Providing the service you signed up for. It is private to your account unless you turn on the public showcase link. | Performance of a contract (Art. 6(1)(b)). |
| Consent record: the version of these documents you accepted and when. | Proving that you accepted the Terms and this policy. | Legal obligation / legitimate interest in accountability (Art. 6(1)(c), (f)). |
| Technical data: IP address, session cookie, last-active time, failed-login counts. | Keeping you signed in, detecting brute-force attacks (rate limiting), security and abuse prevention, operating and debugging the service. | Legitimate interests (Art. 6(1)(f)) in a secure service. |
| Subscription data (only if you subscribe): plan status and Stripe customer/subscription identifiers. We never see or store your card number. | Managing your paid plan. | Performance of a contract; legal obligation for accounting records. |
| Analytics data (only if you click “Accept” on the cookie banner): pages viewed, approximate location, device and browser information collected by Google Analytics. | Understanding how the site is used so we can improve it. | Consent (Art. 6(1)(a)). You can withdraw it at any time. |
We do not sell your data, we do not use it for advertising, we do not send marketing emails (only account emails such as email verification and password resets), and we do not make automated decisions that have legal or similarly significant effects on you.
3. Cookies and similar storage
Strictly necessary (no consent needed, always on):
portfolio_session— keeps you signed in. HTTP-only cookie; it lasts 30 days and is renewed while you keep using the app. Deleted when you log out.slabfolio-consent-v1andpokemon-portfolio-theme(browser local storage) — remember your cookie choice and light/dark theme. Short-lived cookies are also used during Google/GitHub/Discord sign-in to complete the login.
Optional (only with your consent): Google Analytics cookies (_ga, _ga_*), used to measure site usage. Nothing from Google Analytics is loaded or stored until you accept. We configure it with advertising features and Google signals switched off. You can change or withdraw your choice at any time through Cookie settings; withdrawing removes the analytics cookies.
4. Who we share data with (processors and recipients)
We only share data with service providers that are needed to run Slabfolio. They act on our instructions:
- Fly.io — hosting of the application and database (London, United Kingdom region).
- Resend — sending account emails (verification, password reset). Receives your email address and the email content.
- Stripe — payment processing for paid plans, if you subscribe. Stripe is an independent controller for payment data.
- Google — (a) if you choose “Sign in with Google”, and (b) Google Analytics, only if you consent.
- GitHub / Discord — only if you choose to sign in with them.
- jsDelivr (CDN) — serves the in-browser text-recognition library used by the card scanner; your browser contacts it directly, so it sees your IP address. Card images shown in your collection are loaded from public card-database image servers, which likewise see your IP address.
When you look up a card, we send only the card name, set/number or product link to price and card databases (PriceCharting, TCGdex, TCGplayer). No account or personal data is sent to them. Photos you upload for scanning are processed on our server and are not sent to third parties.
If you switch on the public showcase in your account settings, anyone with the link can see your active collection (not purchase prices, notes or photos). You can turn it off or regenerate the link at any time.
5. International transfers
Our hosting is in the United Kingdom, which the European Commission recognises as providing adequate data protection. Some providers (for example Google, Stripe, Resend) may process data in the United States. Where they do, the transfer relies on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
6. How long we keep data
- Account and collection data: until you delete your account.
- When you delete your account, your account, collection and photos are removed straight away. As protection against accidental deletion, a safety backup is kept for 30 days and then automatically deleted.
- Sessions: expire after 30 days without use.
- Failed-login / rate-limit records: kept only briefly and cleared automatically.
- Payment and invoicing records: kept by Stripe and as required by tax and accounting law.
- Analytics data: retained by Google Analytics for the period configured in that service (no longer than 14 months).
7. Your rights
Under the GDPR you have the right to: access your data; have it corrected; have it erased; restrict or object to certain processing; receive your data in a portable format; and withdraw consent at any time (without affecting earlier processing).
- Export: use “Export collection” or a Full Backup from the collection tools menu in the app.
- Correct: edit your name, password and cards in the app.
- Delete: delete your account from your account settings.
- Anything else, or if you cannot use the app: email privacy@slabfolio.org. We reply within one month.
You also have the right to lodge a complaint with your national data protection supervisory authority (in the EU, the authority of the country where you live or work; a list is available from the European Data Protection Board).
8. Security
Passwords are stored as salted hashes, connections use HTTPS, sessions are HTTP-only cookies, login attempts are rate-limited, and each account can only access its own data. No system is perfectly secure; if a breach affecting your rights occurs we will notify you and the authorities as the law requires.
9. Children
Slabfolio is not intended for anyone under 16. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.
10. Changes to this policy
If we change this policy materially we will update the version and date above and, where appropriate, tell you in the app or by email.