Privacy policy

1. Who is responsible

The controller under the GDPR is Max-Hermann Hoek, individual entrepreneur (OSVČ), IČO 17184576, Revoluční 1082/8, 110 00 Praha 1 – Nové Město, Czech Republic. Email: privacy@slabfolio.app. Contact form: slabfolio.app/contact.

We have not appointed a data protection officer because the law doesn't require one for a service like ours (Art. 37 GDPR). Please send any privacy question to privacy@slabfolio.app.

2. What we process, why, and on what legal basis

2.1 Visiting the website

When you open slabfolio.app, your browser sends technical data that our server needs to deliver the page: your IP address, date and time, the page requested, the response status, the amount of data, the referring page and your browser and operating system (user agent).

Purpose: deliver the website, keep it stable and protect it against attacks and abuse, for example by limiting how many requests one address can send.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure, working website.

Retention: Our web server keeps access logs for 7 days, with the last part of your IP address removed. Counters that limit requests per IP address exist only in memory, for at most one hour. Our application logs contain no IP addresses and are deleted after 30 days.

2.2 Using Slabfolio without an account (guest and demo mode)

Without an account, your portfolio, watchlist and settings are stored only in your browser (see section 4). To show values, your browser asks our server for individual items, for example a card, a grader and grade, a cert number or a search term. We answer these requests without linking them to you and don't store them beyond section 2.1.

Legal basis: Art. 6(1)(b) GDPR (providing the service you request) and Art. 6(1)(f) GDPR.

2.3 Your account

When you create an account, we process your email address and your password. We store your password only as a salted hash (argon2id), never the password itself. We also process an optional display name; the dates you signed up, confirmed your email, last signed in and last used the app; your settings (for example currency and theme); your plan (currently everyone uses Slabfolio for free); your role; the version of the Terms of use you accepted; and, if you joined through an invite link, which link you used.

If you turn on the optional two-factor authentication, we also store the secret for your authenticator app and your backup codes, both encrypted. If you ask for a sign-in link by email, we store its one-time token until you use it or it expires after 10 minutes.

Purpose: create and run your account, sign you in, keep your account secure and keep your portfolio in sync across devices.

Legal basis: Art. 6(1)(b) GDPR (our contract: the Terms of use).

Retention: as long as your account exists. If you don't confirm your email address within 7 days, we delete the unconfirmed account. For deleting your account, see section 6.

You need an email address and a password to create an account. Without them we can't provide one, but you can still use Slabfolio in guest mode.

2.4 Your portfolio

We process what you add: slabs and items (grader, grade, cert number, item and variant), purchase price and date, how you got an item, sales you record, notes, your watchlist and the history of your portfolio value.

Purpose: show your portfolio, its values, gains and history.

Legal basis: Art. 6(1)(b) GDPR.

Retention: until you remove the entry or delete your account.

We never ask for your postal address or phone number. Please don't put personal information into notes that you don't want stored.

2.5 Sign-in security and sessions

When you sign in, we set a session cookie (section 4) and store a session record: a random session ID, when it was created and when it expires, and the IP address and browser or device it was created from. You can see your sessions and your recent security events in Settings › Account, under “Active sessions” and “Security activity”, and end any session there. We also record security events, such as failed sign-ins, password resets, email changes and sign-ins from a new device, and we count sign-in attempts per IP address and per account to stop password guessing.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR (protecting your account and our service).

Retention: session records until you sign out or the session expires, at the latest after 30 days. Security events: 90 days. Attempt counters: at most 24 hours.

2.6 Emails we send you

We send service emails: confirming your email address, sign-in links, password resets, security alerts (for example a new sign-in or a changed email address), the confirmation that your account was deleted, and important notices about the service or these policies. These emails are part of running your account, so you can't opt out of them while you have one.

We don't send newsletters or advertising. If we ever offer a newsletter, you'll receive it only if you sign up and confirm by email, and you'll be able to unsubscribe in every message.

Processor: mailbox.org (section 3). We log that a message was sent (recipient, type, time, delivery status) for 90 days to fix delivery problems.

Legal basis: Art. 6(1)(b) and (f) GDPR.

2.7 When you contact us

If you write to us by email or through the contact form, we process your email address, your name if you give it, your message and any attachments, so we can answer you.

Legal basis: Art. 6(1)(b) GDPR if your message is about your account or the service; otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries).

Retention: we delete conversations 24 months after the last message, unless we need them longer to establish, exercise or defend legal claims. Emails are stored at mailbox.org.

2.8 Reports and moderation

If you report content or an account, for example as illegal content under the EU Digital Services Act, we process your name, your email address, the reported content, your explanation and the outcome of our review. If we restrict content or an account, we keep our decision and the reasons we gave.

Legal basis: Art. 6(1)(c) GDPR together with Art. 16 and 17 of the Digital Services Act (Regulation (EU) 2022/2065), and Art. 6(1)(f) GDPR.

Retention: 12 months after the case is closed.

2.9 Invite links and the creator program

Some people join through a personal invite link, for example creators who test Slabfolio. We store which link an account used and count sign-ups per link. Creators only see totals (for example “12 sign-ups”), never who signed up.

Legal basis: Art. 6(1)(f) GDPR (our interest in running and measuring the invite program).

Retention: as long as the account exists. Totals that don't relate to any person may be kept longer.

2.10 Usage statistics without cookies

To understand how Slabfolio is used and keep it running well, our own server counts page views. It records the page address, the domain of the referring website, a rough device type (phone, tablet or desktop) and browser family taken from the user agent. The IP address is never stored. To count unique visitors per day, we compute a one-way code from the IP address, the user agent and a random value that we replace and delete every day. The code can't be traced back to you and becomes useless the next day. We use no cookies, no storage on your device, no fingerprinting and no third-party analytics service. For signed-in users, we also use the date of last activity on the account to count daily and monthly active users. If your browser sends a “Global Privacy Control” or “Do Not Track” signal, we don't include you in unique-visitor counts.

Legal basis: Art. 6(1)(f) GDPR (our interest in understanding usage in aggregate, so we can improve and protect the service). You can object (section 7).

Retention: individual page-view records for at most 24 hours. After that we keep only daily totals that don't relate to any person.

2.11 Card, game and price lookups by our server

To identify items and show values, our server asks external data sources, for example: the PSA certification database (Collectors Universe, Inc., USA) for cert numbers; the Pokémon TCG API (Scrydex) for card data; IGDB and libretro-thumbnails for box art; and Frankfurter (European Central Bank reference rates) for currency conversion. We send only what the lookup needs, such as a cert number, a card name or an item ID, and we send it from our server. We never send your IP address, name, email address or account ID. Because these sources can't identify you, this isn't a transfer of your personal data to them.

Legal basis: Art. 6(1)(b) and (f) GDPR.

2.12 Images and fonts

Our server fetches card images and box art from their sources and delivers them from slabfolio.app, so your browser doesn't connect to these third-party servers. Our fonts and the scanner's text-recognition data are also hosted on our own server. No requests go to Google or other font or CDN services.

2.13 Camera and photos

The scanner reads the label of a slab (QR code, barcode and text) from your camera or from a photo you choose. This happens entirely on your device, in your browser. We don't upload or store photos or video frames. Your browser asks for permission before the camera is used, and you can withdraw it at any time in your browser settings.

2.14 Running the service

We use an admin area to run Slabfolio, for example to help with support requests, resend confirmation emails or block abusive accounts. Only the operator has access. Access needs a second sign-in factor, and every admin action on an account is recorded in an audit log (who, what and when) that we keep for 12 months. We also keep an error log (error message, page, app version, time and, if you were signed in, your account ID; no IP addresses) for 30 days to fix bugs.

Legal basis: Art. 6(1)(f) GDPR, and our duties under Art. 5(2) and 32 GDPR.

2.15 Backups

We back up the database every night and keep the last 14 backups on our server in Germany, readable only by the operator. Data you delete disappears from the backups at the latest after 14 days. We restore from backups only to recover from errors or incidents.

Legal basis: Art. 6(1)(f) and Art. 32 GDPR.

3. Who receives your data

Processors that work only on our instructions, under data processing agreements (Art. 28 GDPR):

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: server hosting, servers in Germany.
• Heinlein Hosting GmbH (mailbox.org), Schwedter Straße 8/9A, 10119 Berlin, Germany: email.

Other recipients: the data sources in section 2.11 receive lookup data only, without anything that identifies you. We pass data to authorities only when the law requires it.

We don't sell or rent personal data, and we don't share it for advertising.

We don't transfer your personal data to countries outside the EU or EEA.

4. Cookies and storage on your device

We store only what Slabfolio needs to work. That's why we don't ask for cookie consent: storage that is strictly necessary for a service you request is allowed without consent (Art. 5(3) of the ePrivacy Directive, implemented in § 89(3) of Czech Act No. 127/2005 Coll. and, for users in Germany, § 25(2) No. 2 TDDDG).

Cookie names start with __Secure- because they are only ever sent over an encrypted connection. Data in your browser's storage stays on your device. It reaches us only when you use a feature that needs it, for example when you import your browser portfolio into your account. To remove it, use Settings › Delete all data, or clear this site's data in your browser.

We set no advertising, analytics or social media cookies, and we don't embed third-party content.

5. Children

Slabfolio is for people aged 16 and over. We don't knowingly process data of younger children. If you believe a child under 16 has created an account, please tell us and we'll delete it.

6. Deleting your account and downloading your data

• Download: Settings › Account › Export my data gives you everything we store about your account in a machine-readable file (JSON), plus your holdings as CSV.
• Delete: Settings › Account › Delete account deletes your account and your portfolio immediately. We email you a confirmation. Copies in our backups disappear within 14 days. We keep only a record that an account was deleted, without your email address, and any data we must keep for an open legal case or report.

7. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), and to receive it in a portable format (Art. 20). Where we rely on consent, you can withdraw it at any time with effect for the future (Art. 7(3)). Most of this you can do yourself in Settings. For everything else, write to privacy@slabfolio.app. We reply within one month.

Right to complain. You can complain to a data protection authority. Ours is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, uoou.gov.cz). You can also contact the authority where you live or work.

We don't use automated decision-making that has legal or similarly significant effects on you (Art. 22 GDPR). Values in Slabfolio are calculations about items, not decisions about people.

8. Security

Connections to Slabfolio are always encrypted (HTTPS with HSTS). Passwords are stored only as salted hashes, and session cookies can't be read by scripts. Admin access needs a second sign-in factor. Our server and backups are in Germany. Found a vulnerability? See our Security policy.

9. Changes to this policy

We update this policy when our processing changes. The date at the top shows the current version. Previous versions are linked below. If a change matters for you, we'll tell you by email or in the app before it takes effect.

Previous versions: none yet. Version 1.0 is the first.