Privacy policy
Last updated 12 August 2026pkfolio is a tool for tracking a Pokémon card collection. This page explains what it stores about you, why, who else touches that data, and what you can do about it. It is written to satisfy Articles 13 and 14 of the GDPR, and to be readable.
Who is responsible
pkfolio is run by one person in Portugal. The full trader identity and postal address are published in the legal notice. For anything about your data, email hello@pkfolio.com and it reaches me directly.
There is no data protection officer. pkfolio is small enough that the GDPR does not require one, and the contact address above is the fastest route to a human.
What pkfolio stores
Account details. Your name, email address and avatar, as supplied by Google or Discord when you sign in. pkfolio never sees or stores a password.
Your collection. The cards and sealed products you record, and for each acquisition the quantity, condition, price paid, currency, purchase date, print language and any notes you write.
Organisation. The binders and lists you create, their contents and layout, and which binders you have marked public.
Profile. Your username, if you claim one, and the achievements you unlock. A claimed username creates a public page at /u/your-name.
Preferences. Display currency, colour theme and interface language.
Technical data. Your IP address is used to rate limit requests, so one visitor cannot overwhelm the service. It is checked against a short-lived counter and is not stored in a profile or linked to your account.
Prices, card images and set data come from public catalogues and are not personal data.
Why, and on what legal basis
Performance of a contract, Article 6(1)(b). Without this data there is no collection to show you.
Legitimate interests, Article 6(1)(f). Keeping the service available and resistant to abuse.
Legitimate interests, Article 6(1)(f). Aggregate page and performance statistics with no cookie and no identifier that follows you.
Legal obligation, Article 6(1)(c), once you subscribe. Accounting records have to be kept for the period Portuguese tax law requires.
Cookies and local storage
pkfolio shows no cookie banner, because it sets no cookie that needs consent. Everything stored in your browser is first party, and each item is either strictly necessary for the service you asked for or set only in direct response to something you clicked. That is the exemption in Article 5(3) of the ePrivacy Directive.
Keeps you signed in. Strictly necessary. Removed when you sign out.
Remembers the interface language you picked in Settings.
Remembers that you dismissed the first-run tip and whether the movers panel is collapsed, plus which achievement celebrations you have already seen.
Usage measurement runs through Vercel Analytics and Vercel Speed Insights, both of which are cookieless and store no identifier on your device. If that ever changes, this page changes with it and a consent request appears first.
Who else processes your data
pkfolio runs on services that necessarily see some of your data. Each acts as a processor under a data processing agreement, and none of them is permitted to use your data for their own purposes.
Hosting and delivery of the application, served from London.
The database holding your account and collection, hosted in London.
Card image delivery, DNS and email routing.
The short-lived counters behind rate limiting.
Sign-in. They confirm your identity and pass back your name, email and avatar. What they do with the fact that you signed in is governed by their own privacy policies.
Outbound email, when pkfolio needs to write to you.
Payments, if you subscribe. Polar is the merchant of record and the seller, so your card details go to them and never reach pkfolio.
Your collection is never sold, rented or shared for advertising. There is no advertising on pkfolio.
Where your data goes
The application and the database are hosted in the United Kingdom, which the European Commission has recognised as providing an adequate level of protection. Some of the services listed above are established in the United States and may process data there, relying on the EU-US Data Privacy Framework or on standard contractual clauses.
How long it is kept
Your account and collection are kept for as long as the account exists.
Deleting your account erases it immediately, along with every acquisition entry, binder, list, achievement and your public profile. Database backups holding a copy expire on their own rolling schedule shortly afterwards.
Rate limiting counters expire within minutes and are never associated with an account.
Records relating to a payment are kept for the period Portuguese tax law requires, even after the account is gone. That obligation overrides erasure.
Your rights
Under the GDPR you can ask for access to your data, correction of it, erasure of it, a portable copy of it, restriction of how it is used, and you can object to processing based on legitimate interests. Two of those are buttons rather than emails:
Export. Settings has a CSV export of your full acquisition ledger, one row per copy, available at any time.
Erasure. Settings has account deletion. It takes effect immediately and needs no email to me.
For anything else, write to hello@pkfolio.com and you will get a reply within 30 days, as the GDPR requires. If you think your data has been handled badly, you can complain to the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority, or to the authority where you live.
Automated decisions and profiling
There are none. Nothing on pkfolio makes an automated decision that produces legal effects for you, and your collection is not used to build a profile of you.
Age
pkfolio is not intended for children under 16. If you are under 18, ask whoever is responsible for you before subscribing to anything paid.
Changes
When this policy changes materially, the date at the top moves and, if the change affects how your data is used, you will hear about it in the app or by email before it takes effect.