Privacy policy
In effect from 10 October 2026
EchoFolio TCG is a free website for tracking Magic: The Gathering collections and card prices. It’s run by Brett Cochrane, an individual in Victoria, Australia (“we” and “us” below). Nobody else has access to account information, apart from the hosting providers that store it for us (listed below).
This policy explains what we hold about you, why, who stores it, and how to see, correct, download or delete it. Questions, requests and complaints: [email protected]
What we hold
If you have an account:
- Your email address, to log in with. It’s the address your invitation was sent to.
- Your display name, shown at the top of the page. It can be a nickname.
- Your password, only as a hash (Argon2id) that can’t be turned back into the password. We never store the password itself.
- Your collections: the cards in them, how many you have and what’s on order, and your preferred currency.
- When you agreed to the terms of use and this policy, and to which version.
- Your login session: hashes of the tokens that keep you logged in, and when they expire.
For each invitation, we hold the email address it was sent to and a hash of its sign-up link.
For security, whether you have an account or not:
- Failed logins: a hash of the email address that was tried, how many times and when, so repeated guessing of a password is locked out.
- Your IP address, counted in the server’s memory for about a minute to limit how many requests each visitor can make. It’s never stored in the database, and the site’s logs don’t record it. The hosting providers below also see it when they pass your requests on to the site.
We don’t collect payment details, and the site has no analytics, advertising, tracking or third-party cookies.
How we collect it
From you: when you sign up, change your settings and build your collections. And automatically, when your browser talks to the site: your IP address, and the cookies listed below.
Why we hold it
Only to run your account and the site, to keep it secure (limiting requests and locking out password guessing) and to back it up. We don’t sell your information or share it for marketing, and we don’t send marketing emails.
Using the site without an account
Searching cards and seeing their pictures and prices needs no account. With an account, your display name can be a nickname: only your email address needs to be real, so you can log in.
Who stores it for us, and where
- Render runs the website and its server, and Neon runs the database. Both are US companies, and hold your information in their data centres in Singapore.
- Cloudflare, a US company, passes every request to the site through its worldwide network, so it sees IP addresses. It also forwards emails sent to our contact address to the owner’s personal email account.
- Backblaze, a US company, stores our backups, encrypted, in its data centres in the United States. Backups are also kept on the owner’s computer in Australia.
Card pictures and set symbols are passed on by the site, so Scryfall, where they come from, never sees your IP address. The copies of them we keep with Cloudflare hold no personal information.
How we protect it
Connections to the site are encrypted (HTTPS). Passwords and login tokens are stored only as hashes, backups are encrypted before they’re stored with Backblaze, and the site’s access to the database is limited to what it needs. The site’s logs name accounts only by a number, never by email address or name. Our accounts with each provider are protected with two-factor authentication.
How long we keep it
- Your account and collections: until the account is deleted.
- Login sessions: deleted within a day of expiring, which is 30 days at most.
- Invitations: deleted 30 days after the sign-up link expires, about 37 days after it was sent.
- Failed logins: deleted within a day.
- The site’s logs: 7 days.
- Backups: about 4 weeks.
When an account is deleted, it leaves the database at once, and the backups within about 28 days, as they’re replaced.
Seeing, correcting, downloading or deleting it
- See and correct: your email address, display name and currency are on the Settings page, where you can change your display name and currency. To correct your email address, email us.
- Download: each collection can be downloaded as a CSV file from its page. For a copy of anything else we hold about you, email us.
- Delete: email us to delete your account. We’ll delete it with your collections and login sessions.
Email [email protected] from the address on your account, so we know the request is yours. We answer requests within 30 days, and usually much sooner.
Complaints
If you’re unhappy with how we’ve handled your information, email [email protected]. We’ll look into it and reply within 30 days.
18 or over
EchoFolio TCG is only for people 18 or over (see the terms of use). If we learn that an account belongs to someone younger, we’ll delete it.
If something goes wrong
If information we hold is lost, or seen or shared without permission, we’ll act quickly to contain it and work out the harm it could do. If it could seriously harm you, we’ll tell you as soon as we can: what happened, what information was involved and what you can do.
Changes to this policy
When we update this policy, the date at the top changes. We’ll tell you about significant changes on the site or by email before they take effect.