Privacy Policy

Last updated: June 2026

Holofire ("we", "us") is a real-time trading-card scanner and price tool. This policy explains what we collect, how we use it, and the choices you have. We collect as little as possible and we never sell your personal information.

What we collect

• Email and password. Email is used to log you in. Passwords are stored as Argon2id hashes — never in plain text. We never share your email with other users. If you sign in with Apple, we receive the identifier Apple provides (and the relay email if you choose to share one); we do not receive your Apple password.
• Cards you scan and add to your binder. Card identity, set, number, condition, and the price at the time you added it. Used to build your binder, compute portfolio totals, and (with your permission) match you with nearby users.
• Camera and photos of cards. When you scan, the camera captures frames of the card. Some frames are stored to help our recognition models improve identification accuracy. They are used to identify cards, never to identify you, and never for advertising.
• Approximate location (only if you opt in to The Den). Your location is bucketed to a ~5 km cell (geohash5) at the moment you opt in. We never store your exact coordinates. A vendor who lists a public storefront provides that store's public address/location, which is shown to buyers — that is business information, not your personal location.
• Your handle and Trader badge. If you opt in to The Den, you pick a public handle. Other users within your radius can see your handle and the cards you mark tradeable. We do not share your email, your full binder, your real name, or your home address.
• Operational logs. Standard server logs (request paths, status codes, response timing). No request bodies, no card images, no tokens.
• Diagnostics and bug reports. If you submit a bug report in the app, we receive the description you write plus basic context (app version, the screen you were on, and device type) so we can reproduce and fix the issue. Crash and performance diagnostics may also be collected to keep the app stable. This is used only to operate and improve the app — never for advertising.

What we share

• To other users in The Den: only your handle, your Trader badge tier, the cards you have explicitly marked tradeable, your activity counts, and an approximate distance (rounded to the nearest km).
• To service providers we rely on to run the app:
  • Cloud hosting and database providers run the application and store your data.
  • A content-delivery and security provider protects the service and supplies country-level region headers.
  • A third-party card-recognition service identifies your cards: when you scan, the card image is sent to that service for identification.
  • Third-party pricing-data providers supply card prices. Pricing queries do not include your identity.
  • If you purchase a subscription, payment is processed by Apple (on iOS) or our web payment processor; see "Subscriptions and payments" below.
  We do not sell your data to anyone.

What we do not collect

• Precise location. The Den only stores a ~5 km cell prefix; exact coordinates are dropped after the cell is computed.
• Behavioral analytics, advertising identifiers, or third-party tracking. We do not track you across other apps or websites.
• Contacts, calendar, or any device data unrelated to scanning and the features you use.

Subscriptions and payments

Holofire offers a free tier and may offer paid subscriptions (e.g. Pro). If you subscribe, payment is handled by Apple's App Store on iOS, or by our web payment processor (Stripe) on the web. Holofire never receives or stores your full payment-card number. Apple and Stripe process payments under their own privacy policies. We store only your subscription status (e.g. active/expired) and tier, so we can unlock the features you paid for. You manage or cancel an App Store subscription in your Apple account settings.

Cookies

We use one cookie: a session token that keeps you logged in. It is httpOnly (JavaScript cannot read it), Secure (HTTPS only), and SameSite=Strict. We do not use analytics, advertising, or third-party cookies.

Your rights and choices

You can delete your account at any time inside the app — go to Account → Delete my account. Deletion removes your account, binder, wants, trade list, vendor listings, and any location data. If you can't access the app, you can also request deletion at app.getholofire.com/delete-account or email us (below). If you are in California you have the rights described in the CCPA/CPRA — to know what we hold, to request deletion, and to opt out of any "sale" of personal information (we do not sell personal information). EU residents are not currently served by The Den; we will add a GDPR-aligned flow before opening it to the EU.

Data retention

Scan frames are retained while your account is active to support model improvements, and are deleted within 30 days of account deletion. Binder and price records are retained to preserve your collection history; you can delete them at any time by deleting your account.

Children

Holofire is for users 13 and older. The Den (location-based discovery and trading) is restricted to users 18 and older.

Changes

If we make a material change to this policy, we will update the date above and post the new version here, and where appropriate notify you in the app.

Contact

Privacy questions or requests: [email protected].