Privacy Policy

Cardolith stores your account details and the card collection you import so it can show that collection to you and to whoever you choose to share it with. We don't run ads and we don't sell or rent your data. We use Google Analytics to understand how the site is used (see below). Deleting your account deletes your data.

Cardolith is a small independent web app at cardolith.com that turns a ManaBox or TCG Archivist export into a shareable, browsable collection page. Questions about this policy go to hello@cardolith.com.

Account information. Your display name, email address, and — if you sign up with a password — a salted hash of that password (never the password itself). If you sign in with Google, we receive your name, email address, and profile picture URL from Google; we never see your Google password.

Collection data. Everything in the CSV you import: card identifiers, set, quantity, foil, condition, language, ManaBox row IDs, timestamps, and any purchase price or currency the export included (TCG Archivist exports carry none of the last three). We keep a copy of the original CSV file and, if some rows fail, a CSV of those rows, so you can download and re-import them and so an import can be reverted.

Emailed imports. Each account gets a personal import address on import.cardolith.com. When you email a CSV to it, we receive the message through our email provider and use the sender address, subject line, and the attachment. Only mail sent from your account email address is processed; anything else is dropped and you're notified.

Sharing. If you share your collection with a friend by email, we store that address. If they don't have an account, we email them an invite that includes your display name and the name of your collection.

Technical data. Sign-in sessions record an IP address and browser user-agent string, which we use for security. Our hosting provider keeps standard server logs for a short period.

Usage analytics. We use Google Analytics to see which pages are visited, roughly where visitors come from, what devices and browsers they use, and how features are used in aggregate. Google Analytics sets its own cookies and receives your IP address and browser details to do this; we've configured it not to build advertising profiles, and we never send it your name, email, or the contents of your collection. See Google's privacy policy and their opt-out browser add-on.

Session replays. We also use Microsoft Clarity, which records how pages are used — clicks, scrolling, mouse movement, and the layout of the page — so we can watch anonymised replays and heatmaps and fix things that are confusing. Text you type into forms is masked before it leaves your browser, and we mask your import address as well; Clarity does not receive your name, email, or password. It sets its own cookies and receives your IP address and browser details. See Microsoft's privacy statement.

What we don't collect: no advertising identifiers, no ad networks, no payment details (Cardolith is free).

• To run the service: sign you in, store and display your collection, match your cards against the Scryfall card catalog, and process imports in the background.
• To send you transactional email: verification and password-reset links, import results, sharing invites, and blocked-sender warnings. We don't send marketing email.
• To show your collection to the people you've chosen, according to your visibility setting (see below).
• To keep the service secure and prevent abuse, such as rate limiting and rejecting spoofed import emails.

Purchase prices from your CSV are stored so they round-trip when you export, but they are not displayed anywhere and are not used for anything else.

Your collection is private by default — only you can see it. You can switch it to friends (only accounts you've explicitly added) or public link (anyone who has the link; it isn't listed or searchable anywhere). Shared views show your display name and the contents of your collection. They never show your email address, your import address, or purchase prices. You can change visibility or remove a friend at any time.

We don't sell or share your data with anyone for their own purposes. To run Cardolith we rely on a small number of infrastructure providers who process data on our behalf:

• Vercel — hosting and storage of uploaded CSV files.
• Neon — the database.
• Inngest — background processing of imports and catalog updates.
• Mailgun — receiving import emails and sending transactional email.
• Google — only if you choose to sign in with Google.
• Scryfall — the source of card names, sets, and images. Card images are loaded directly from Scryfall's servers, so your browser makes requests to them when you view a collection.
• MTGJSON — the source of preconstructed deck lists and set sizes. No personal data is sent to them; we download their data on a schedule.
• Google Analytics — usage analytics, as described above.
• Microsoft Clarity — session replays and heatmaps, as described above.
• eBay and TCGplayer — “Find on eBay” and “Find on TCGplayer” links open that marketplace's page for a card. Cardolith is a member of the eBay Partner Network and the TCGplayer affiliate program: those links carry an affiliate tracking id and the card's catalog id (never your name, email, or account), and we earn a commission if you buy something after following one. Each site sets its own cookies under its own privacy policy; nothing happens until you click. When you follow one of these links, Cardolith counts the click for its own reporting: which marketplace, where on the site, which card or set, and whether you were signed in. That count is not linked to your account. We also check eBay each night for new listings of cards your Full Set binders are missing and show the cheapest we found; that lookup involves no data about you.

We may also disclose data if required by law or to protect the service and its users from abuse.

Cardolith sets one essential cookie to keep you signed in; signing out removes it. Google Analytics (_ga and similar) and Microsoft Clarity (_clck, _clsk) set their own cookies to tell returning visitors from new ones. There are no advertising cookies. You can block analytics cookies in your browser without affecting the site.

We keep your data for as long as your account exists. You can export your collection as a ManaBox- or TCG Archivist-compatible CSV at any time from the collection page.

Deleting your account (Settings → Delete account) permanently removes your account, sessions, collection, import history, uploaded CSV files, and any shares you've created or received. This is immediate and cannot be undone. Copies may survive in encrypted backups held by our infrastructure providers for a limited period before they roll off.

Cardolith isn't directed at children under 13, and we don't knowingly collect their data. If you believe a child has created an account, email us and we'll remove it.

If this policy changes in a way that matters, we'll update the date at the top and, for significant changes, tell you by email or a notice in the app. Continued use after a change means you accept it.

hello@cardolith.com — for questions, data requests, or to ask us to delete something. See also our Terms of Service.