Foilbank

§ Legal

Privacy Policy

Last updated: July 2026.

Foilbank collects the minimum data needed to operate a personal card-collection tracker. This page explains what, why, and how to delete it.

What we collect

  • Account data — email address, display name, hashed password, and the year of your birth (used only to enforce our 13-and-over minimum; not stored as an exact date).
  • Collection data — the cards, quantities, printings, conditions, purchase info, grading records, notes, and photos you enter.
  • Usage logs — server-side logs of API requests (timestamp, endpoint, IP address, response status) for security and debugging. Kept 30 days, then deleted.
  • Session cookies — a signed authentication cookie so we know you’re logged in. No third-party advertising or tracking cookies.

What we don’t collect

  • No advertising identifiers. Foilbank shows no ads.
  • No analytics that identify individuals. No selling of any data to anyone, ever.
  • No exact date of birth beyond the year.
  • No payment information (there’s nothing to pay for).

How we use it

  • Your account data lets you sign in and use the site.
  • Your collection data powers your dashboard, price alerts, and exports.
  • Usage logs help us fix bugs and detect abuse.
  • Session cookies keep you logged in across visits.

Third parties involved

  • Vercel hosts the site and receives HTTP requests / logs incidentally.
  • Neon stores the database that holds your account and collection data.
  • Vercel Blob stores any photos you upload.
  • pokemontcg.io and TCGCSV provide card catalog and price data (we pull from them; they don’t see your data).

Your rights

  • Export — download all of your collection data at any time from Settings → Import / Export.
  • Delete — remove your entire account and all associated data from Settings → Danger zone. Deletion is immediate and irreversible.
  • Correct — edit any field on your profile or any card in your collection at any time.
  • Contact — for any other request (GDPR / CCPA), reach out via the Contact page.

Children under 13

Foilbank is not directed at children under 13 and we do not knowingly collect their data. Registration requires attesting you are at least 13. If we learn we’ve collected data from someone under 13, we delete it.

Data location

Data is stored in the United States. If you access Foilbank from the EU, UK, or elsewhere, your data may be transferred to and stored in the US.

Changes to this policy

We may update this policy as the service evolves. Material changes will be announced on the site.