Privacy policy

Controller

ARTIO Mining GmbH, Chapfstrasse 58, 8625 Gossau ZH, Switzerland, UID CHE-443.857.465, e-mail: info@holofoilx.com. This policy covers the processing of personal data under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

Data we process

Account data (name, e-mail, password hash, language, currency, time and version of the terms you accepted), collection data you enter (cards, purchase and sale prices, notes, storage locations, uploaded photos and receipts), scan photos (linked to your account, not anonymised), usage data (sign-ins with IP address and device, scans, alerts), billing data (handled by Stripe; we store invoice metadata only) and support messages. We also process your lists and settings in the app: watchlists, the wishlist (with target prices), deck lists (with the pasted text), how many copies you keep for the trade list, your grading submissions (grading company, service, submission number, status with a date per step, costs, tracking numbers, notes, an optional reminder and, per card, the result, grade and certificate number) and whether you hid the start checklist on the dashboard – and, only if you switch them on, push notifications (your device's address at the push service and its keys), the weekly summary by e-mail, your public collection profile (handle, display name, what you share) and its participation in the trade board. Reports about public profiles are handled as support requests.

Purposes and legal bases

Providing the service and your account (contract), security and abuse prevention (legitimate interest), aggregated statistics on the use of the service without reference to individual people (legitimate interest), billing and statutory retention (legal obligation), optional product e-mails and optional retention and use of scan photos for improving recognition (consent, revocable at any time). Publishing your collection profile, its participation in the trade board and the weekly e-mail summary (consent, revocable at any time by switching them off). Reserving former profile handles and handling reports about public profiles (legitimate interest: protection against impersonation and abusive content).

Processors and transfers

Hosting of the web app: Vercel Inc. (USA), server functions in Frankfurt (Germany), delivery through Vercel's global network. Database: Databricks, Inc. (USA), parent company of Neon, LLC (Neon service), data centre in Frankfurt (Germany). Background processing and object storage (photos, receipts, backup copies): Railway Corporation (USA), data centres in Amsterdam (Netherlands). E-mail delivery: Hostpoint AG (Switzerland). AI image analysis, only when AI recognition is enabled and only for scans, grading checks and reading a sports card from a photo that you start: Google Cloud EMEA Limited (Ireland) with onward transfer to Google LLC (USA), Gemini API service, and, once enabled, Anthropic Ireland, Limited (Ireland) with onward transfer to Anthropic PBC (USA). For scans, the photo can also be converted into a numerical image fingerprint to compare it with the card catalogue. We use both providers as paid services under their commercial terms: they do not use the images to train or improve their models. Google logs requests for a limited period solely to detect misuse and may process them temporarily in other countries where it operates facilities. Payments (only once paid plans are offered): Stripe Payments Europe, Limited (Ireland), with onward transfer to Stripe, LLC (USA). Stripe processes payment data on our behalf; for fraud prevention, legal checks (e.g. identity verification and anti-money-laundering) and its work with banks and payment providers, Stripe is itself responsible.

Reading a sports card from a photo (“Sports cards” page, only when you start it): the photo of the front and, if you wish, the back is sent to the AI provider that reads the card’s details – Google (Gemini API, used only as a paid service) and, if that service is unavailable, Anthropic (Claude). Before that we remove the photo’s metadata (EXIF, e.g. the location where it was taken) and scale it down. The photo is processed in memory only and then discarded: we do not store it and no scan record is created. The result only pre-fills the form; nothing is saved until you check it and save it. Each reading counts as one scan towards your monthly scan quota.

Searching sports cards in the CardSight AI catalogue and showing their market value (“Sports cards” page and the card page of a linked sports card, only when you search or open the page): your search details (e.g. player name, year, manufacturer, product, card number) and the ID of the linked card are sent to CardSight AI (USA, cardsight.ai), which returns the matching cards and sale prices. No photos are sent, and we do not use CardSight’s image recognition. We do not send any details of your account or collection; CardSight receives the requests from our servers, not from your browser. We store only the card’s ID with your sports card; search results and prices are cached for at most 24 hours.

Card images are loaded directly from the servers of the data providers (Scryfall, TCGdex, Lorcast), which therefore receive your IP address and browser details. This also applies to the example card on the home page. Push notifications (only if you turn them on) are delivered through your browser vendor's push service (e.g. Google, Mozilla, Apple, Microsoft); the content of a notification (title, text and link) is transmitted encrypted and cannot be read by the push service.

Recipients are located in Switzerland, the EU and the USA. Transfers to the USA rely on the Swiss-U.S. Data Privacy Framework, under which Vercel Inc., Databricks, Inc. (for Neon, LLC), Railway Corporation, Google LLC and Stripe, LLC are certified, and in addition on the EU standard contractual clauses recognised by the FDPIC with the adaptations for Switzerland; transfers to Anthropic rely on these standard contractual clauses.

Retention

Account and collection data: until you delete your account. Scan photos: 90 days after the scan; with your consent at most 24 months. Security log (sign-ins with IP address and device): 12 months, also after an account is deleted. Error logs: 90 days. Expired sessions: deleted continuously. Invoices: 10 years (Swiss Code of Obligations art. 958f). Reserved profile handles: 180 days after the handle was changed or removed; after an account deletion only the handle itself is kept until expiry, without any link to your account. Support requests and profile reports: 2 years after the request was completed (counted from the last message or status change), then they are deleted automatically; on account deletion the link to your account is removed, while the e-mail address and content of the request remain until this period ends. Wishlist, deck lists, grading submissions and settings: until you delete them or your account.

Your rights

You can access, correct, export (Settings → Privacy) and delete (Settings → Privacy) your data, object to processing and withdraw consent. You may lodge a complaint with the FDPIC or your local supervisory authority.

Security

Encrypted transport (TLS), hashed passwords, optional two-factor authentication, encrypted storage of API secrets, role-based access for staff and an audit log of security-relevant actions.

Affiliate links and links to providers

On card, set, collection, watchlist and grading pages we show links to eBay (search results and listings) and to the websites of grading companies (PSA, CGC, Beckett, SGC, TAG). A click opens that provider’s website in a new tab. From then on, that provider is responsible for processing your data: eBay may record the click and your visit with cookies and similar technologies under the privacy policy of eBay or of the respective provider.

Once HoloFoilX takes part in the eBay Partner Network, the eBay links are affiliate links and are labelled “Ad · affiliate link”. If you buy on eBay after such a click, HoloFoilX may receive a commission; your price does not change. The link then contains our campaign ID and an identifier of the place where it is shown (e.g. “card page”), but no information about you, your account or your collection. The links to grading companies are not affiliate links; there is no partnership with these companies.

Click counting: when you click one of these links, your browser sends a short notice to HoloFoilX. We use it to count per day how often which destination (e.g. ebay.ch or a grading company) was clicked from which type of page. Only the count is stored – no user ID, no IP address, no card and no cookie; as with every page request, our hosting provider processes the IP address only technically. The counters are deleted after 400 days. Legal basis, where the GDPR applies: our legitimate interest in measuring the use of our links (Art. 6(1)(f) GDPR).

Cookies and storage in your browser

HoloFoilX only sets its own cookies: no third-party cookies, no analytics or advertising cookies and no tracking. The cookies and browser storage below are technically necessary or keep a setting you choose yourself. They are not used for advertising and are not passed on to third parties, which is why we do not ask for consent. On www.holofoilx.com the names of the sign-in cookies also start with “__Secure-” (sent over HTTPS only).

Sign-in (technically necessary; set only once you sign in, not readable by scripts, SameSite=Lax): “holofoilx.session_token” keeps you signed in – 14 days, extended daily while you use the service; without “Stay signed in” only until you close the browser. “holofoilx.session_data” holds a signed copy of the session details so that not every page has to query the database – 60 seconds. “holofoilx.dont_remember” remembers that you did not choose “Stay signed in” – until you close the browser.

Two-factor sign-in (technically necessary, only if you have enabled it): “holofoilx.two_factor” links the two steps of the sign-in – 10 minutes. “holofoilx.trust_device” only if you choose to trust the device for 30 days: on this device we do not ask for a code for 30 days.

Account view by support (technically necessary, only for staff with administrator rights): “holofoilx.admin_session” keeps the staff member’s own session while an administrator views a user account to help. The view ends after 30 minutes at the latest, and the cookie is deleted when it ends.

Settings you choose (for display): “holofoilx-locale” stores the language if it differs from your browser’s language setting or if you switch it – 1 year. “holofoilx.theme” stores light, dark or “System” – 1 year. “holofoilx.intro” records with the value “1” that the logo intro on the home page has already been shown in this browser session – until you close the browser.

Browser storage: in sessionStorage (deleted when you close the tab), “holofoilx.scanMode” remembers whether you chose single card or batch scan, and “holofoilx.batchScan.v1” keeps the list of an ongoing batch scan with small preview images (at most 160 pixels) so that reloading the page does not lose it; the photos themselves are not stored, and the list is cleared once it has been added to the collection or deleted. In localStorage (kept until you clear it in your browser), “holofoilx.scanCollection” remembers the collection you last added a card to directly from the scanner, and “holofoilx.scanCamera” the camera you chose in the scanner (a device ID assigned by the browser). These entries stay on your device and are not sent to us. The full-resolution photo you inspect with the magnifier stays in your browser’s memory only; as before, we receive a reduced copy.

Effects, vibration and view (settings on this device): in localStorage, “holofoilx.haptics” records with the value “off” that you switched vibration off under Settings → Appearance – until you switch it back on. “holofoilx.setSeals” stores the IDs of the sets (at most 400) whose “Set complete” seal has already lit up on this device, so that it only shines the first time; if there are more than 400, the oldest drop out. “holofoilx.collection.columns” stores which columns you show in the table of your collection. In sessionStorage, “holofoilx.countUp” records that the portfolio figures have already counted up once in this session – until you close the tab. These entries stay on your device and are not sent to us.

eBay connection (strictly necessary, only when you connect your eBay account): “holofoilx.ebay_oauth” protects the return from the eBay sign-in against forgery – at most 10 minutes, only for addresses under /api/ebay, not readable by scripts.

App hints and push notifications: in localStorage, “holofoilx.installHint” records on how many days you opened HoloFoilX on this device, the last of those days and whether you closed the “Put HoloFoilX on your home screen” hint – so that it appears only from the second day of use and no longer after you closed it. “holofoilx.pushOptIn” records with the value “dismissed” that you closed the “Price alerts by push too?” offer on this device. Neither entry contains an identifier, and neither is sent to us. In the Android app from Google Play, “holofoilx.storeApp” in sessionStorage records with the value “android” that the page runs inside the app – no purchase buttons appear there – until the app is closed; this entry is not sent to us either. Only if you enable push notifications, your browser registers a HoloFoilX service worker that shows the notifications (it does not store page content); if the push service replaces your device's address, the service worker reports the new address to HoloFoilX and removes the old one. You can delete cookies and browser storage in your browser at any time; you are then signed out and your display settings are reset.

Public collection profile

Only if you switch it on in the settings (“Public profile”) do we publish a view of your collection under a handle you choose, so that you can share it; by default everything is off. Visible are: the handle, an optional display name (without it only the handle, never your account name), for each card its name, number, set, game, the catalogue image and the number of copies, the number of cards and sets and – only with a separate switch – the estimated total value in your display currency. Never visible are purchase prices, fees, purchase and sale data, notes, tags, the names of your collections, storage locations, serial and certificate numbers, photos, receipts, your e-mail address and cards you entered yourself (e.g. sports cards).

Trade list on the profile (separate switch, off by default): the cards you hold more copies of than you want to keep become visible, with the number, condition (e.g. NM) or grade (e.g. PSA 10) and – only with the value switch – the total value of these copies.

Anyone who has the link can view the page; during the closed beta only signed-in, invited people. Profiles are not listed in a directory and cannot be searched. The only exception: if you switch on “Can be found in the trade board”, members who look for one of your trade cards find your trade list in the trade board (see “Trade matches”). Search engines are excluded (noindex) unless you explicitly allow them; search engines may then store the page. Copies made by recipients, link-preview services or search engines are outside our control.

You can switch the profile off or remove it at any time; the page then immediately responds like an unknown address. We reserve a former handle for you for 180 days so that nobody can appear under your old link; only you can use it again during that time. When saving, we check handles and display names against a list of inadmissible terms; rejected names are not stored.

Report a profile: signed-in people can report a public profile. We store the report (reason, link to the profile and optional text) as a support request of the reporting person; internally the team sees which account is concerned. In case of violations an administrator can reset the profile (switched off, display name deleted, handle blocked for 180 days); this is recorded in the audit log.

Weekly summary by e-mail

Only if you switch it on under Notifications (off by default), we send you a summary of your collection on Sundays: value and change since the previous week, the biggest moves, wishlist cards that reached their target price, the progress of your sets, – depending on the plan – the number of grading candidates and, if you switched on “New in trade matches”, the number of new trade offers for cards on your wishlist (without profile names). It is built only from your data with us; without news we send nothing.

The e-mail loads no images from the internet – the logo at the top is contained in the e-mail itself – and it contains no tracking pixels, no click tracking and no affiliate links; it is sent through our e-mail provider Hostpoint AG (Switzerland). You can unsubscribe in the settings, through the link in every e-mail (with a confirmation) or directly in your e-mail program (one-click unsubscribe). The link contains a signed token that is valid for 90 days and can only switch the summary off. So that at most one e-mail arrives per week, we store a marker for each week.

Selling on eBay

Prepare a listing: on request, HoloFoilX creates a title, a description and a price suggestion from your collection data, which you copy and paste into eBay yourself. Nothing is sent to eBay; as soon as you open an eBay page, eBay’s privacy policy applies.

Connect your eBay account (optional): if you connect your eBay account, you sign in at eBay and allow HoloFoilX to create and end listings on your behalf, to read your selling policies (payment, shipping, returns) and to retrieve your eBay username. For this we store your eBay user ID and eBay username, the permissions granted, eBay’s access tokens (encrypted, never in the browser and never in logs), their expiry and the identifier of your item location at eBay.

Listings: for each listing we store the position in your collection, the eBay marketplace, the item number (SKU), eBay’s offer and listing number, status, price, currency, quantity and category. On your instruction we send eBay the title, description, price, quantity, item specifics and condition, for a slab the grading company, grade and certificate number, your own photos of the card, the selling policies you chose and the country, postcode and city of your item location (stored by eBay, not by us). eBay processes these data as a separate controller under its privacy policy, partly also outside Switzerland and the EU.

Purpose and legal basis: creating, showing and ending listings on your instruction (performance of the contract). For security we log connecting, disconnecting, listing and ending, without eBay identifiers.

Deletion: “Disconnect” in the settings revokes the access at eBay and deletes the connection. If you delete your HoloFoilX account, the connection and the listing records are deleted. If eBay notifies us that your eBay account was deleted, we delete the connection and the listing records as well. Backups contain deleted records until they are overwritten.

Trade matches

The trade board compares your wishlist with the public trade lists of other members. It is computed anew each time you open it; we do not build a directory for it. Your wishlist stays invisible to everyone: others do not learn who is looking for which card.

Your trade list can only be found if you switch on the profile, the trade list in the profile and “Can be found in the trade board” in the settings (“Public profile”) – all three are off by default. Signed-in members who have one of your trade cards on their wishlist then see your handle, your display name and, per card, the number of copies and the condition or grade – only what your profile shows anyway, and never values. If you switch one of these off, your trade list disappears from the trade board at once.

“New in trade matches” (separate switch, off by default): we tell you in the app when another member newly offers a card from your wishlist for trade; we do not send these messages by e-mail or push. So that the same card is not reported twice, the message stores the card and, instead of the offering member's account ID, a checksum that only applies to your messages.

HoloFoilX has no messaging feature and does not pass on e-mail addresses; you arrange how to reach each other outside HoloFoilX. If a profile seems dubious, you can report it (see “Report profile”). The legal basis is your consent; you withdraw it by switching the setting off.

Card recognition from confirmed scans

Only if you agreed that HoloFoilX may keep a scan photo (per scan or in general under Settings → Notifications), we additionally store a numerical image fingerprint of the photo when you scan (64 bits; the photo cannot be restored from it). If you confirmed the scan or corrected it to the right card, this fingerprint helps to recognise the same card better in later scans – including those of other members. Other members see neither your photo nor the fingerprint, nor that it comes from you.

So that wrong confirmations do not distort recognition, a fingerprint only counts once another account has confirmed the same card with a matching photo or our team approves it. For this review the team sees the photo and the card, but not which account the photo comes from; it can remove a fingerprint for good at any time.

If you withdraw your consent, delete your account or the photo's retention period ends (see “Retention”), the fingerprint is no longer used and is deleted together with the photo. The legal basis is your consent.