Legal
Privacy policy
This policy describes which personal data is processed when you visit Cardfolio, why, on which legal basis, and which rights you have. It describes the actual state of the website: Cardfolio has no account, sets no cookies and uses no analytics or advertising services.
1. The short version
- There is no user account, no login and no database of user data on a Cardfolio server.
- Your binders, cards and settings live only in your browser and are not transmitted to Cardfolio.
- Cardfolio sets no cookies and loads no analytics, tracking, advertising or chat scripts.
- When you open the site, the hosting provider Cloudflare processes technically necessary connection data.
- Your browser loads card data and card images directly from TCGdex; TCGdex receives your IP address in the process.
- Only when you click a link to Cardmarket, TCGplayer or Amazon do you leave Cardfolio, and that provider processes data under its own policy.
2. Controller
SeitenHafen361, Sole proprietorship, owner Schayan Yousefian, Freienwalder Str. 34, 13359 Berlin, Germany. Email: [email protected].
No data protection officer has been appointed, as none is required under Art. 37 GDPR and Section 38 of the German Federal Data Protection Act.
3. Hosting and server logs (Cloudflare)
Cardfolio is a static website. It is delivered through Cloudflare Pages, and the domain yourcardbinder.com is managed through Cloudflare. When you open a page, Cloudflare processes technically necessary connection data: IP address, date and time, requested address, referrer, browser and system information and technical routing data. This can include security data used to defend against abusive access.
The purpose is to deliver the website securely, reliably and quickly and to protect it from abuse. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the secure and reliable operation of the website.
Cloudflare processes this data as a processor. Recipients may include Cloudflare Germany GmbH and other Cloudflare group companies. For transfers to the United States, Cloudflare states that it relies on certification under the EU–US Data Privacy Framework and, where necessary, EU Standard Contractual Clauses. The retention of the logs follows Cloudflare's settings and policies. Cardfolio keeps no logs of its own and does not evaluate this data.
The site's responses also carry a technical header for network error reporting (Network Error Logging). Browsers that support it may send an anonymous error report to Cloudflare when a connection fails. Successful visits are not reported this way.
4. Storage in your browser
Cardfolio stores information on your device so that the function you asked for works. These are not cookies but browser storage. They are not sent to Cardfolio. Storing them is strictly necessary for the function you expressly requested (Section 25(2) no. 2 of the German TDDDG), so no consent is needed. The content is processed only in your browser.
| Storage | Content | Purpose and duration |
|---|---|---|
| IndexedDB “cardfolio” | Your binders with names, pages and slots, selected cards, ownership status, purchase settings (language, minimum condition, region), gift projects and recently loaded card data | So your binders are still there on your next visit. Until you delete them, clear the site data in your browser or the browser clears the storage. |
| localStorage “cardfolio-theme” | Light or dark display | Remembers your choice. Until you clear site data. |
| localStorage “cardfolio-locale” | Selected language (German or English) | Remembers your choice. Until you clear site data. |
| sessionStorage “cardfolio-gift-summary” | The finished gift proposal with selected cards, settings and, if entered, your greeting | Keeps the proposal when you switch to the purchase view and back. This browser tab only, at most six hours, and until the tab is closed. |
| BroadcastChannel “cardfolio-binder-sync” | Only a note that a binder has changed | Keeps several open tabs of the same site in step. Not stored and does not leave the browser. |
The names, notes and greetings you enter in Cardfolio stay in your browser. Please do not enter information you do not want to store on your device. You can delete the data at any time in your browser settings under “site data”, or delete single binders in Cardfolio.
5. Backups and exports
When you export a backup or copy or download a shopping list, a file or text is created on your device. Cardfolio does not upload it. A backup contains your binders and the related card data but no images. You decide where to store it and with whom to share it. A file you import is only read and checked in your browser.
6. Card data and card images (TCGdex)
For card search and card details, your browser queries the interface api.tcgdex.net directly. This transmits your search term, the chosen card language and the requested card or set identifiers. Your browser loads the card images directly from assets.tcgdex.net. Cardfolio does not copy, store or bundle the images. This also applies to the nine example cards at the top of the home page: they are loaded directly from assets.tcgdex.net when you open it.
As with any connection, TCGdex receives technically necessary data, in particular your IP address, date and time, browser type and the requested address. The connection is necessary to show the cards and images you asked for (Art. 6(1)(b) and (f) GDPR). TCGdex is an independently operated, community-maintained project. I have no influence on the processing there, the location of the servers or the retention period. Information is available from TCGdex at tcgdex.dev.
The artwork search (“Smart Search”) runs entirely in your browser. The search index it needs is delivered by Cardfolio like the other files of the site. Your search text is not transmitted to third parties. For the cards found, your browser then retrieves the card data from TCGdex as described above.
7. External links to marketplaces and shops
Cardfolio prepares shopping lists for Cardmarket and TCGplayer and links binders on Amazon. These providers are only opened when you click a link yourself or paste a list there. Cardfolio does not log in for you there and does not complete a purchase. When you click, the site's referrer policy sends only the origin (yourcardbinder.com), not the exact page. After that the privacy policy of the respective provider applies, for Cardmarket and TCGplayer as well as for Amazon.
Some binder recommendations lead to Amazon (amazon.de) through affiliate links. They carry a partner identifier with which Amazon can attribute a purchase to Cardfolio. After the click Amazon may set its own cookies on amazon.de and process data under its own privacy notice (Amazon EU S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg). Cardfolio only sees the partner reports provided by Amazon about clicks and qualifying purchases, not names or addresses. Your price stays the same. This notice also appears directly on the offer.
As an Amazon Associate I earn from qualifying purchases.
8. No cookies, no analytics, no advertising
Cardfolio sets no cookies of its own and uses no web analytics, advertising networks, social media plugins, embedded videos or maps, or third-party fonts. Fonts are loaded from the site's own domain. There is no profiling and no automated decision-making within the meaning of Art. 22 GDPR. Since no cookies or similar technologies are used for analytics or advertising, there is no consent banner.
9. Contact by email
If you write to me, I process your sender address, your message and any voluntary details in order to reply. The legal basis is Art. 6(1)(b) GDPR where a contract or pre-contractual questions are concerned, otherwise Art. 6(1)(f) GDPR. I delete the data once it is no longer needed for the purpose and no statutory retention duties apply.
10. Recipients and transfers to third countries
Recipients of connection data are Cloudflare (hosting), TCGdex (card data and images) and, after your click, the respective marketplace or shop. A transfer to countries outside the EU and the EEA cannot be ruled out, for example to Cloudflare in the USA or to marketplaces based outside the EU. Cloudflare states that it relies on the EU–US Data Privacy Framework and Standard Contractual Clauses. For the other providers their own safeguards apply.
Cardfolio's source code and public catalogue data are kept in a public GitHub repository. Visiting Cardfolio makes no connection to GitHub, and your binders do not get there.
11. Your rights
Under the GDPR you have the following rights against the controller:
- Access to the data processed about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR). Cardfolio currently processes nothing on the basis of consent.
To exercise them, write to [email protected]. You can view, export and delete the data in your browser yourself at any time, because Cardfolio does not receive it. Data arising at Cloudflare, TCGdex or the marketplaces falls under their own responsibility; please contact the respective provider about it.
12. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. For the controller this is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin (datenschutz-berlin.de). You can also contact the supervisory authority where you live.
13. Security and changes
The website is delivered only encrypted over HTTPS. It uses a strict Content Security Policy that limits connections and images to its own domain and the two TCGdex addresses, and it loads no scripts from third-party servers.
If the website changes, for example through an account, statistics or new embedded services, I will update this policy beforehand. Last updated: 20 October 2026.