Privacy
How Holo Folder uses information when you browse the website, track your collection or use the app.
Last updated: 8 November 2026
About
Holo Folder is a trading name of SYNCAURA LIMITED, registered in the United Kingdom with company number 10319246. For privacy questions, access requests or deletion requests, email contact@holofolder.com. This notice covers the Holo Folder website and collection app.
Information you provide
When you create an account, we process your email address and authentication information. We also store the information you save: binders, owned and wanted cards, language and finish choices, settings, saved appearances and uploaded binder artwork. Features may save collection activity, recent card history, price checks and purchases you record at a show. If you contact us, we receive your message and the details you include. If you subscribe, Stripe processes your billing and payment details. Holo Folder stores your Stripe customer and subscription references, subscription status and paid-through date to manage access; card details are entered on Stripe’s checkout.
Information on your device
The app uses cookies for sign-in and remembering the last opened binder, and browser storage for settings, cached cards, images, prices, offline collection copies and queued edits. Some history and saved designs can sync with your account. Unsynced edits and local-only designs can be lost if you clear browser data, so sync or export them first. Shared devices may retain cached information until it is cleared. Google Analytics also sets cookies to measure visits; you can block or delete them in your browser settings.
Camera and artwork
Camera access is optional and requested by your browser. Quick Scan reads a card’s name and collector number on your device, then sends lookup text to the card search service. OCR software may download on first use. Binder Studio can keep draft artwork on your device and upload saved artwork for account synchronization. Only upload images you are entitled to use, and avoid including personal information in them.
How we use information
We use account and collection information to provide the features you request, synchronize devices, support partners and share links, and respond to you. We also process technical information to keep the service secure, diagnose problems and understand performance. Depending on the processing and applicable law, our basis is providing the requested service, our legitimate interests in running and protecting it, or consent where required.
Signed-in usage and acquisition
When you sign in, we use your existing account and collection-owner identifiers to understand app use, collection activation and subscription conversion. We record daily app opens, successful-save milestones, upgrade views, created checkouts and verified payment or cancellation events. Supabase stores these observations. We attach only approved campaign, source and medium labels, without email addresses, full URLs, card names, tokens or free-text event data. Partner activity is identified separately from the collection owner’s own return visits. These observations are best effort, and Stripe remains the source of truth for billing.
Usage retention and source storage
An approved source label may remain in this tab’s session storage for up to two hours across sign-in, then is cleared after a successful account observation. It contains no anonymous identifier. Granular usage events are kept for 90 days and removed through an explicit maintenance action. First-save, activation, first-paid and first-touch account records remain until account deletion so milestones and attribution do not reset. Account deletion removes these records. Aggregate website analytics are separate. Contact contact@holofolder.com about your account data or the choices described below.
Sharing you control
A partner you invite can access and edit the owner’s shared collection and binders. A read-only share link lets anyone who has the link view the shared binder without edit access. They may copy the link or capture what they can see. You can disable a share link in the app. Information already copied by someone else cannot be recalled by disabling a link.
Pricing sources and your personal data
Holo Folder combines pricing and comparison information from independent third-party sources. Depending on the card and feature, sources may include TCGdex, TCGplayer, Cardmarket, PokePulse, TCGcsv, eBay, SoldComps and public price archives hosted on GitHub. Currency conversion may use European Central Bank reference rates. These data sources are not affiliated with, sponsors of or endorsers of Holo Folder. Naming a source does not imply a partnership.
As part of automated pricing lookups, we never send your personal account data to these pricing-data sources: this includes your name, email address, Holo Folder account ID, sign-in credentials and private binder records. Requests contain card or product identifiers, card names, set/number/finish details and market parameters. They are made by our servers or background sync jobs using our service credentials. We do not forward your browser’s IP address or Holo Folder session cookies in those requests.
This applies to automated data lookups, not a visit to another website. If you open a marketplace, listing or other external link, your browser connects directly to that provider, which may process your IP address, cookies or information you give it under its own privacy policy. The hosting, authentication and other suppliers that process data to run Holo Folder are described in our Privacy notice.
Service providers and external lookups
We use infrastructure suppliers to run the website and app. Unlike pricing-data sources, these suppliers may process or store personal information needed to provide their services. The reference below distinguishes account storage from data processed in transit or recorded in technical logs. Retention and processing locations depend on the service, its configuration and applicable provider terms. Stripe handles subscription payments and billing information through its hosted Checkout and billing portal.
Supabase · accounts, database and artwork
Supabase provides sign-in, the collection database and storage for saved binder artwork.
It stores account email addresses and user IDs; password hashes when password sign-in is used; session and authentication records; and the binder, collection, wanted-list, partner/invitation, settings, history and purchase information linked to an account. Uploaded binder artwork may also contain personal information if you include it. Authentication and security logging may include IP addresses and request metadata.
Vercel · app hosting and operations
Vercel runs the app, its API endpoints and background jobs.
Serving the app requires Vercel to process incoming requests, including IP addresses, request URLs, browser headers, authentication cookies and account or collection payloads when an endpoint needs them. Technical and security logs may retain request metadata and diagnostic information. Supabase, rather than Vercel logs, is the app’s primary account and collection database.
Vercel · usage and performance measurements
The app includes Vercel Web Analytics and Speed Insights to understand usage and loading performance.
These products record usage or performance data such as page information, browser/device characteristics and performance measurements. Vercel describes their analytics data points as anonymous and not linked to a named person or IP address. That is separate from hosting and security request processing, which may involve personal data.
Google Analytics · usage measurement
We use Google Analytics, provided by Google, to understand how visitors find and use Holo Folder, such as which pages are visited and how people move between them.
Google Analytics uses cookies or similar identifiers and collects information such as pages viewed, referrer, approximate location, browser and device details and interaction events. Google may process this information, including IP addresses, on its servers, which may be outside your country. We do not send your account details, email address or private binder records to Google Analytics.
Framer · marketing website
Framer hosts the public marketing website and its images and content.
Delivering the website involves processing visitor requests and network information, which can include IP addresses, requested pages, browser/device details, referrer information and security signals. Site analytics, where enabled, provide website-usage information. We do not connect the app’s account or private binder database to Framer for marketing-site hosting.
Cloudflare · card-image storage and delivery
Cloudflare R2 holds the app’s cache of public card images and associated object metadata.
The app accesses R2 from its servers. We do not store account records, private binders or uploaded personal binder artwork in this card-image bucket. Cloudflare can process technical request and security metadata for the services it provides; the data involved depends on those services and their configuration.
jsDelivr · optional OCR downloads
When Quick Scan needs Tesseract, the browser downloads OCR software and language assets from jsDelivr.
Those downloads expose normal connection/request information to the CDN, such as the visitor’s IP address and browser headers. The OCR recognition itself runs on the device; these software downloads do not send the camera image, recognized text, account email or binder records to jsDelivr.
Technical information and international processing
Hosting and analytics services may process request details, device or browser characteristics, page activity, performance information and network information. Service providers may process information in countries other than yours. Processing locations and transfer arrangements depend on the provider and hosting configuration. Contact us for details about the current arrangements relevant to your information.
How long information is kept
We keep account and saved collection information for as long as it is needed to provide the service, including account recovery and synchronization. You can remove collection entries and request account or data deletion by email. Support messages, security records and backups may need to be retained longer for troubleshooting, legal obligations or resolving disputes. Device caches and exported backups remain under your control.
Your choices and rights
You can update collection information and settings, control partner and share access, deny camera access, and use the available export or backup tools. Depending on the law that applies, you may have rights to access, correct, delete, restrict or transfer personal information, object to certain processing, or withdraw consent. Email contact@holofolder.com to make a request. You can also complain to your local data protection regulator; in the UK, this is the Information Commissioner’s Office at ico.org.uk.
Changes and contact
We may update this notice as the app and its services change. The date below identifies this version. Questions about privacy or your information can be sent to contact@holofolder.com.