Privacy

The short version

Foilstat is a free price reference for Pokémon cards and sealed product. You can browse everything without an account. For people who just visit we only count page views, anonymously and without cookies: no advertising, no tracking cookies, and nothing is sold or shared for marketing.

What we store if you create an account

• Sign-in details: your email address, your name, and a hashed password. If you use Google sign-in, we receive the name and email address Google shares and no password.
• Favorites: the products you favorite and any colour marks and names you give them.
• Portfolio: the items you add or import, the purchases, sales and expenses you enter, and each item's price history.
• Collectr import: if you link a Collectr showcase, we store that username and read your public showcase about once a day to keep your portfolio in step. Nothing is sent to Collectr.
• Share links: if you create one, a random link token. Anyone with the link can see your items and their current market prices until you turn it off; it never shows what you paid, your sales, your expenses or your name.

We use this only to run the features you asked for. We don't read your portfolio for any other purpose.

Cookies

Signing in sets the cookies needed to keep you signed in. Choosing "Hide values" on the Portfolio page sets one cookie that remembers that choice. Choosing List or Tiles on a tab, or a row size, sets a cookie that remembers that layout. Another cookie remembers your display currency; on your first visit it is picked from your country, which is read from your connection or browser language and not stored. There are no advertising or analytics cookies, which is why there is no cookie banner.

Who processes it

• Vercel hosts the site and processes requests, including IP addresses, to deliver pages. Its Web Analytics counts page views: the page, the referring site, and your country, browser and device type. It sets no cookies, and visits are told apart by a hash that is discarded each day, so you are not followed between days or across other sites.
• Neon hosts the database and the sign-in service, and sends the account emails (verification and password reset).
• Google, only if you choose Google sign-in.

These providers may process data outside your country. Prices, exchange rates and product pictures are all fetched by our server and served from this site, so your browser never contacts any other service while you browse.

How long we keep it, and your choices

Your data stays until you delete it. You can remove individual items at any time, and Account settings deletes your account together with your portfolio, purchases, sales, expenses, favorites, marks, Collectr link and share link, immediately and for good.

You can also ask us for a copy of your data, to correct it, or to delete it, by emailing the address below. Depending on where you live you may have further rights under laws such as the GDPR, UK GDPR, PIPEDA or the CCPA, including the right to complain to your data-protection regulator. We don't sell personal information.

Children

Accounts are for people aged 13 and over (16 where local law requires it). We don't knowingly collect data from younger children; tell us if you believe we have and we'll delete it.

Security

Passwords are stored hashed, connections are encrypted, and each account can only read its own data. No system is perfectly secure; if something goes wrong that affects your data we will tell you.

Changes

If this notice changes in a way that matters, we'll update the date above and say so on the site.