This policy explains what personal data folio.fyi collects when you use the website folio.fyi or the folio mobile app, why, on what legal basis, for how long, who processes it and how to exercise your rights. It is written under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).
In short: we collect what the service needs, we do not sell your data, we do not use it for advertising, and our database is hosted in the European Union (Paris).
1. Who is responsible for your data
The controller of your personal data is Hugo Bonnet EI (entrepreneur individuel), 9 rue des Colonnes, 75002 Paris, France, SIREN 929 830 560, the publisher of folio.fyi (see the Legal Notice).
For any question about your data, write to contact@folio.fyi or to the postal address above.
2. What we collect, why, and for how long
For each use of your data, here is what we collect, why, the legal basis under Article 6 of the GDPR, and how long we keep it.
Your account
- Data
- Your email address and your password, which our authentication provider stores in encrypted (hashed) form and which we never see; or, if you sign in with Google (or Apple, in the app), the information that service sends us: email address, name and profile picture. Your pseudonym and profile address (generated automatically, and which you can change), your avatar, your preferred currency and the layout of your dashboard.
- Purpose
- Create and secure your account, sign you in on the website and in the app, and sync your data between your devices.
- Legal basis
- Performance of the contract, that is the Terms of Use (Article 6(1)(b)).
- Retention
- As long as your account exists. If you have not signed in for 3 years, we warn you by email, then delete the account one month later if you still have not signed in.
Your collection
- Data
- The cards and products you add (quantity, version such as raw or graded, purchase price, date added), the sales you record (price, date and notes), your favorites, your price alerts, the ratings you give to sets and the daily history of your collection's value.
- Purpose
- Provide the service: value of your collection, profit, statistics and alerts.
- Legal basis
- Performance of the contract (Article 6(1)(b)).
- Retention
- As long as your account exists, or until you delete them.
Your public profile
- Data
- Your pseudonym, avatar and profile address, the games and languages you collect, the date you joined, and statistics computed from your collection: number of cards owned per set, set completion, the days on which you added cards, and your ratings of sets. Your purchase prices, your sales, your favorites, your alerts and the list of your cards are never public.
- Purpose
- Show your collector profile to other visitors, a feature of the service.
- Legal basis
- Performance of the contract (Article 6(1)(b)).
- Retention
- As long as your account exists.
Premium subscription
- Data
- For purchases on the website: the information about your subscription that Stripe and our subscription service RevenueCat give us (plan, amounts, dates, status and transaction references), tied to your account's email address; your card or bank details are collected by Stripe and never reach us. For purchases in the app: an identifier linking the purchase to your account, the product, dates, status, store, country and currency, sent by Apple or Google through RevenueCat; the stores do not give us your name or your payment details.
- Purpose
- Give you access to Premium, manage renewals, cancellations and refunds, and keep our accounts.
- Legal basis
- Performance of the contract, that is the Terms of Sale (Article 6(1)(b)); legal obligation for accounting records (Article 6(1)(c)).
- Retention
- For the duration of your subscription. Accounting records: 10 years from the end of the financial year (Article L123-22 of the French Commercial Code).
Messages you send us
- Data
- Your email address and the content of your message, when you write to contact@folio.fyi.
- Purpose
- Answer you and handle your requests, including requests to exercise your rights.
- Legal basis
- Our legitimate interest in answering you (Article 6(1)(f)); legal obligation for requests to exercise your rights (Article 6(1)(c)).
- Retention
- 3 years after our last exchange.
Operation and security
- Data
- IP address, browser, operating system and device type, pages and resources requested, date and time, error details.
- Purpose
- Deliver the pages, keep the site and the app secure, limit abuse (number of requests per IP address, protection against bots), diagnose and fix errors, and suggest the language of the site from your country (deduced from the IP address, not stored).
- Legal basis
- Our legitimate interest in providing a secure service that works (Article 6(1)(f)).
- Retention
- Server logs: 30 days at most. Error reports: 90 days at most. Rate-limiting counters: less than a minute.
Audience measurement without cookies
- Data
- Pages viewed, referring site, country, region and city, browser, operating system, device type and loading performance. Visitors are counted with an anonymous identifier computed from the request and discarded after 24 hours. Nothing is stored on your device.
- Purpose
- Measure the audience and the speed of the site in order to improve it.
- Legal basis
- Our legitimate interest (Article 6(1)(f)). Because this measurement only produces anonymous statistics and places nothing on your device, it runs without asking for your consent, in line with the conditions set by the CNIL for audience measurement.
- Retention
- Anonymous identifier: 24 hours. Then aggregated statistics only.
Google Analytics
- Data
- Pages viewed, how you reached the site, approximate location, device and browser, through the cookies described in section 4. Google Analytics does not store IP addresses; Google signals and ad personalization are turned off.
- Purpose
- Understand how the site is used and where its visitors come from.
- Legal basis
- In Europe (European Union, EEA, United Kingdom, Switzerland): your consent (Article 6(1)(a) of the GDPR and Article 82 of the French Data Protection Act), which you can withdraw at any time. Elsewhere, where local law does not require consent: our legitimate interest in measuring our audience (Article 6(1)(f)), to which you can object at any time with the Cookie settings link.
- Retention
- Cookies: 13 months at most, not extended by later visits. Data in Google Analytics: 14 months at most.
Searches that return no result are recorded without any identifier (no account, no IP address) to help us complete the catalog. We never ask for sensitive data (health, opinions, and so on).
3. In the mobile app
The app uses the same account and the same data as the website. In addition:
- Camera and photos. The card scanner uses the camera, or a photo you pick, only while you use it. Recognition happens on your device: the image is never sent to us, only the recognized text (card name and number), to search our catalog.
- Notifications. Price alerts are checked by the app in the background and shown as notifications created on your device, if you allow them. We do not use push notifications, so no notification token is collected. You can turn notifications off at any time in your device's settings.
- Device identifiers. The app does not collect advertising identifiers (such as the IDFA) and does not track you across other companies' apps or websites. Its requests include the version of the app and of your operating system.
- Storage on your device. Your session is kept in the system keychain; your settings (currency, grid layout) and a copy of your alerts are stored locally by the app.
- Purchases. Purchases on the website go through Link, a payment service of Stripe; in-app purchases go through Apple or Google. RevenueCat links them to your account (see section 5).
5. Who processes your data
Your data is only accessible to Hugo Bonnet EI and to the providers below. Most of them process it on our behalf and following our instructions (processors); Stripe (with its Link service), Apple and Google act as independent controllers for payments and sign-in. We never sell your data.
| Provider | What for | Location and safeguard |
|---|---|---|
| Supabase, Inc. (USA) | Database, authentication, account emails, image storage | Data hosted in the European Union (Paris). Access from outside the EU covered by the European Commission's standard contractual clauses. |
| Vercel Inc. (USA) | Hosting, page rendering, server logs, protection against bots, audience measurement without cookies | Servers in the European Union (Paris) and a worldwide content delivery network. EU-U.S. Data Privacy Framework. |
| Functional Software, Inc. (Sentry, USA) | Error reports | Data stored in the European Union (Germany). EU-U.S. Data Privacy Framework. |
| Upstash, Inc. (USA) | Limiting the number of requests per IP address | EU-U.S. Data Privacy Framework. |
| Our mailbox contact@folio.fyi (Google Workspace); Google Analytics, only with your consent | Ireland and USA. EU-U.S. Data Privacy Framework (Google LLC is certified). | |
| RevenueCat, Inc. (USA) | Management of subscriptions bought in the app or on the website | European Commission's standard contractual clauses. |
| Stripe and Sold through Link, LLC (Ireland, USA) | Reseller and merchant of record for purchases on the website ("Sold through Link"): checkout, payment, invoicing, taxes, refunds and payment support. Stripe acts as an independent controller under its own privacy policy. | Ireland (European Union) for payment processing; transfers to the United States under the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses. |
| Resend, Inc. (USA) | Sign-in emails and subscription emails (confirmation, cancellation, renewal reminder) | European Commission's standard contractual clauses. |
| Apple and Google | App Store and Google Play purchases; sign-in with Google or Apple if you choose it. They act as independent controllers under their own privacy policies. | Under their own policies. |
We may also disclose data when the law requires it, for example at the request of a court or of a competent authority.
6. Transfers outside the European Union
Some of our providers are established outside the European Economic Area, mainly in the United States. We only use them when the transfer is covered by:
- an adequacy decision of the European Commission: U.S. companies certified under the EU-U.S. Data Privacy Framework (Vercel, Sentry, Upstash, Google, Stripe);
- or the standard contractual clauses adopted by the European Commission (Supabase, RevenueCat).
Where we could, we chose European hosting: the database is in Paris, the site's servers run in Paris and error reports are stored in Germany. You can obtain a copy of the safeguards described above by writing to us.
7. Deleting your account
You can delete your account at any time: in the app, from your profile (Delete account button), or by writing to contact@folio.fyi from the email address of your account.
We then delete your account, your collection, your favorites, your alerts and your public profile within 30 days. Residual copies in the database's automatic backups disappear when those backups expire, within 7 days. We only keep what the law requires us to keep, such as accounting records (10 years).
Deleting your account does not cancel a subscription bought through the App Store or Google Play: cancel it first in your store settings (see the Terms of Sale).
8. Your rights
Under the GDPR and the French Data Protection Act, you have the right to:
- access your data and obtain a copy of it (Article 15);
- rectify inaccurate data (Article 16); you can edit most of it yourself in your account;
- erase your data (Article 17), see section 7;
- restrict the processing of your data, for example while we examine a request (Article 18);
- data portability: receive the data you gave us, such as your collection, in a structured, commonly used and machine-readable format (Article 20);
- object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest, and without giving any reason to direct marketing (Article 21);
- withdraw your consent at any time for processing based on it (Google Analytics), without affecting what was done before (Article 7);
- give instructions on what happens to your data after your death (Article 85 of the French Data Protection Act).
To exercise these rights, write to contact@folio.fyi. We answer within one month; this period can be extended by two months for complex or numerous requests, in which case we tell you why (Article 12). If we have reasonable doubts about your identity, we may ask you to confirm it, for example by writing from the email address of your account.
If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the authority of the EU country where you live or work.
9. Minimum age
You must be at least 15 years old to create an account. Under 15, an account may only be created with the joint consent of the minor and a holder of parental authority (Article 45 of the French Data Protection Act). If we learn that an account was created without it, we delete it.
A Premium subscription may only be purchased by an adult, or by a minor with the permission of a parent or guardian.
10. Security
We protect your data with encrypted connections (HTTPS), database access rules that limit each account to its own data, passwords that are never stored in plain text, and restricted access to administration tools. No system is completely secure: if a data breach is likely to put your rights at risk, we will notify the CNIL and, where required, inform you.
11. No automated decisions
We do not make any decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (Article 22).
12. Changes to this policy
We may update this policy when the service or the law changes. The effective date at the top of this page shows the current version. If a change is significant, we will tell you by email or by a notice on the site before it takes effect.
13. Contact
Hugo Bonnet EI, 9 rue des Colonnes, 75002 Paris, France. Email: contact@folio.fyi. See also the Legal Notice.