Privacy Policy

Last updated: September 2026

Holofire ("we", "us") is a real-time trading-card scanner and price tool. This policy explains what we collect, how we use it, and the choices you have. We collect as little as possible and we never sell your personal information.

What we collect

• Email and password. Email is used to log you in. Passwords are stored as Argon2id hashes — never in plain text. We never share your email with other users. If you sign in with Apple, we receive the identifier Apple provides (and the relay email if you choose to share one); we do not receive your Apple password.
• Cards you scan and add to your binder. Card identity, set, number, condition, and the price at the time you added it. Used to build your binder, compute portfolio totals, and (with your permission) match you with nearby users.
• Camera and photos of cards. When you scan, the camera captures frames of the card. Some frames are stored to help our recognition models improve identification accuracy. They are used to identify cards, never to identify you, and never for advertising.
• Approximate location. When you create an account, our content-delivery provider tells us which country your connection comes from; we keep only a regional flag, used to apply regional rules. If you opt in to The Den, your location is also bucketed to a ~5 km cell (geohash5). We never store your exact coordinates. A vendor who lists a public storefront provides that store's public address/location, which is shown to buyers — that is business information, not your personal location.
• Your handle and Trader badge. If you opt in to The Den, you pick a public handle. Other users within your radius can see your handle and the cards you mark tradeable. We do not share your email, your full binder, your real name, or your home address.
• Operational logs. Standard server logs (request paths, status codes, response timing). No request bodies, no card images, no tokens.
• Diagnostics and bug reports. If you submit a bug report in the app, we receive the description you write plus basic context (app version, the screen you were on, and device type) so we can reproduce and fix the issue. Reports are delivered to our team's private chat tool, identified by your account number only. Crash and performance diagnostics may also be collected to keep the app stable. This is used only to operate and improve the app — never for advertising.
• How you use the app (first-party analytics). We record in-app events on our own servers, such as which cards you open, the kind of searches you run (not the search text), when the subscription screen is shown, how long a scanning session lasts, and whether the camera permission was granted. When you are signed in, these events are linked to your account; when you are signed out, they are stored without any account or device identifier. They are used only to understand and improve Holofire and are never sent to advertising companies or data brokers. Events linked to your account are deleted when you delete your account; diagnostic and error records are deleted automatically within 30 days.

What we share

• To other users in The Den: only your handle, your Trader badge tier, the cards you have explicitly marked tradeable, your activity counts, and an approximate distance (rounded to the nearest km).
• To service providers we rely on to run the app:
  • Cloud hosting and database providers run the application and store your data.
  • A content-delivery and security provider protects the service, supplies country-level region headers, and measures page-load performance (cookieless page-view and timing statistics that are not linked to your account).
  • A third-party card-recognition service identifies your cards: when you scan, the card image is sent to that service for identification.
  • Third-party pricing-data providers supply card prices. Pricing queries do not include your identity.
  • If you purchase a subscription, payment is processed by Apple (on iOS) or Google Play (on Android); see "Subscriptions and payments" below.
  We do not sell your data to anyone.

What we do not collect

• Precise location. The Den only stores a ~5 km cell prefix; exact coordinates are dropped after the cell is computed.
• Advertising identifiers, advertising SDKs, or cross-app tracking. We do not track you across other apps or websites, and we do not share app-usage data with advertisers or data brokers.
• Contacts, calendar, or any device data unrelated to scanning and the features you use.

Subscriptions and payments

Holofire offers a free tier and may offer paid subscriptions (e.g. Pro). If you subscribe, payment is handled entirely by the app store you installed from — Apple's App Store on iOS, or Google Play on Android — and processed under their own privacy policies. We use RevenueCat to receive the subscription status those stores report. Holofire never receives, processes or stores your payment-card details at any point. We store only your subscription status (e.g. active/expired) and tier, so we can unlock the features you paid for. You manage or cancel a subscription in your Apple or Google account settings.

Cookies

We use one cookie: a session token that keeps you logged in. It is httpOnly (JavaScript cannot read it), Secure (HTTPS only), and SameSite=Lax. We do not use analytics, advertising, or third-party cookies.

Your rights and choices

You can delete your account at any time inside the app — go to Account → Delete my account. Deletion removes your account, binder, wants, trade list, vendor listings, and any location data. If you can't access the app, you can also request deletion at app.getholofire.com/delete-account or email us (below). If you are in California you have the rights described in the CCPA/CPRA — to know what we hold, to request deletion, and to opt out of any "sale" of personal information (we do not sell personal information). EU residents are not currently served by The Den; we will add a GDPR-aligned flow before opening it to the EU.

Data retention

Scan frames are retained while your account is active to support model improvements, and are deleted within 30 days of account deletion. Binder and price records are retained to preserve your collection history; you can delete them at any time by deleting your account.

Children

Holofire is for users 13 and older. The Den (location-based discovery and trading) is restricted to users 18 and older.

Changes

If we make a material change to this policy, we will update the date above and post the new version here, and where appropriate notify you in the app.

Contact

Privacy questions or requests: [email protected].