Privacy Policy

1. Who we are

RelicFolio (relicfolio.com) is a personal trading card cataloguing service. For any questions about this policy or your data, contact admin@relicfolio.com.

2. What we collect

Account information. When you register, we collect your email address and username. Your password is handled by our authentication provider (Supabase Auth) and is never stored by us in plain text.

Content you add. Photos and details of cards you catalogue, the sets and collections you create, and any notes, condition ratings, or “want” flags you attach to them.

Public profile information. If you choose to make a profile, set, or collection public, its contents (card images, set names, completion stats) become visible to anyone who visits that page — including people without an account.

Cookies and similar technology. We use two cookies:

• A Supabase authentication session cookie, which keeps you signed in. This is strictly necessary for the site to function and isn’t optional.
• cartophile_grid_size, which remembers how many columns you prefer in card grid views. This is a convenience preference, not tracking — it stores a number, nothing else — and expires after one year.

We do not use analytics, advertising, or third-party tracking cookies of any kind.

3. Why we collect it

We process your data to: create and secure your account; store and display the collection you build; let you control what’s public vs. private; and send you account-related emails (see Section 6). We don’t use your data for advertising, and we don’t sell it to anyone.

4. Who we share it with

We use a small number of service providers to run RelicFolio, each of which processes data on our behalf under their own security commitments:

• Supabase (database, authentication) — hosted in the EU (Ireland).
• Cloudflare R2 — stores and serves uploaded card images.
• Resend — delivers transactional emails (see Section 6), routed through infrastructure in the EU (Ireland).
• Vercel — hosts the website itself.

We do not sell or rent your personal data to third parties, and we don’t share it for marketing purposes.

5. Catalogue reference data

Some catalogue entries use publicly available reference images sourced from Scryfall (a Magic: The Gathering card database) for cards you haven’t photographed yourself. These are third-party images used for reference/cataloguing purposes and are not personal data.

6. Emails we send

We send account-related emails only: signup confirmation, password reset, and email-change confirmation. We do not currently send marketing or newsletter emails. If that changes, this policy will be updated and you’ll be given the ability to opt out.

7. How long we keep your data

We keep your account and content for as long as your account is active. If you delete your account, we will delete your personal data and uploaded content within 30 days, except where we’re required to retain it for legal reasons.

8. Your rights

Under UK/EU data protection law, you have the right to: access the personal data we hold about you; correct inaccurate data; request deletion; export your data; and object to or restrict certain processing. To exercise any of these, contact admin@relicfolio.com. You also have the right to complain to the ICO (or your local data protection authority) if you believe your data has been mishandled.

9. Children

RelicFolio is not directed at children and we don’t knowingly collect data from anyone under 13 (16 in some EU jurisdictions).

10. International transfers

Our infrastructure is primarily EU-based. Cloudflare’s content delivery network may cache and serve images from edge locations outside the EU/UK as part of normal CDN operation.

11. Changes to this policy

We may update this policy from time to time. Material changes will be noted on this page with an updated “Last updated” date.

12. Contact

Questions about this policy: admin@relicfolio.com