Privacy Policy

Effective October 16, 2026

1. What we collect

• Account: your username, display name and a scrambled (one-way hashed) password. We can't read your password.
• If you sign in with Google: your Google account ID and email address, so we can recognise you next time. We don't get your Google password or access to your Gmail or files.
• What you do in Holodex: your digital collection, packs, coins, goals, trades and Play games (including chat messages and the game log), and the supporter style you chose. Other players can see your username, display name, supporter badge, leaderboard stats, best pulls and public profile.
• If you opt in to the weekly email: the email address you give us, used only to send that email. Every email has a one-click unsubscribe link, and you can turn it off on your Me page.
• If you pay or donate: Stripe processes the payment. We receive and keep a Stripe customer ID, your subscription ID and plan, payment amounts and dates. We never receive or store your card number. Stripe's privacy policy covers what Stripe collects.
• Technical: a session cookie that keeps you signed in (and a short-lived cookie during Google sign-in). Your IP address is used briefly in memory to limit abuse (for example, too many password attempts) and is not stored in our records. If something breaks, we log the error and the page address (not your personal details).

2. What we don't do

• We don't sell or rent your personal information.
• We don't use analytics or tracking cookies of our own.
• Ads: players who haven't gone ad-free may see ads served by Google AdSense. Google and its partners use cookies to show ads based on your visits to this and other websites. You can turn off personalised ads at Google's Ads Settings, and read how Google uses information from sites that use its services. Visitors in the EEA, UK and Switzerland are asked for consent first. Ads never appear during a pack opening or a match, and the ad-free plan turns them off completely.
• We only send marketing email if you opt in to the weekly email, and you can stop it any time.

3. Who else is involved

• Stripe (payments), Google (Sign in with Google if you choose it, and AdSense ads), and Cloudflare, which carries traffic to the site and protects it; Cloudflare processes connection data such as IP addresses to do that.
• Card images load from TCGdex and Scryfall's image servers, which can see your IP address when your browser loads them.
• We may share information if the law requires it, or to protect players and Holodex from fraud or abuse.

4. How long we keep it

As long as your account exists. When you delete your account, we delete your profile, login, digital collection, packs, coins and goals. Payment records needed for tax and accounting are kept as long as the law requires (usually up to 7 years), and finished Play game logs may keep your name as it appeared in that game. Backups roll over within about 14 days.

5. Your choices and rights

• Delete your account: Me page > Delete my account.
• See or correct your data: most of it is visible in Holodex; for a copy of everything, email us.
• Depending on where you live (for example California or the EU/UK), you may have rights to access, correct, delete or port your data and to object to some uses. Email [email protected] and we'll respond within 30 days.

6. Children

Holodex is not for children under 13, and we don't knowingly collect their information. If you believe a child under 13 has an account, email us and we'll delete it.

7. Security

Passwords are hashed with PBKDF2, the site uses HTTPS, sessions use secure cookies, and the public site only exposes the game. No system is perfectly secure; if we learn of a breach affecting you, we'll tell you as the law requires.

8. Changes and contact

If we change this policy significantly, we'll show a notice in Holodex first. Questions: [email protected].