Privacy policy

Ninefoil is an independent Pokémon card binder planner. You can browse and edit locally without registering. Accounts are optional. Signed-in collectors get automatic cloud sync as well as a device copy.

Owner

Ninefoil is owned and operated by Xivn Studios. The Ninefoil™ wordmark and 9F logo belong to Xivn Studios. Pokémon trademarks and artwork belong to their respective owners.

Information you choose to give us

When you register, Supabase Auth processes your email address, password and session information. We store your chosen username and account-owned binder document in a Supabase database. Your browser sends credentials to Supabase Auth; Ninefoil does not store your raw password. Supabase handles password storage and authentication. Your binder can include page titles, card names, ownership statuses, quantities, variants, condition, private notes and custom image URLs.

How saving works

Guests’ binders save on the device. Signed-in edits sync automatically to the account’s private database row, protected by row-level security. A device copy supports offline use and uploads when you reconnect. A choice is needed only when both copies have changed or a guest binder meets an existing account binder. Replacing a copy keeps the previous one in local storage, available through Restore previous copy in the account menu. The newest previous copy replaces the older recovery copy. If storage is full, Ninefoil downloads that copy before replacement. This recovery copy may contain another account’s data on a shared device; remove site data when you need to erase all local copies. Share links contain layout and printing labels only, without ownership, condition or notes.

Services that process information

Vercel serves the website and may process standard request data such as IP addresses. Supabase handles authentication and cloud storage when enabled. Card search uses a hosted TCGdex index, an English public Pokémon TCG dataset, and a small curated list. The retired archive is no longer queried. Card image hosts receive requests to deliver card images. Opening TCGplayer or other linked sites subjects you to their own terms and privacy policies. Fonts may load from Google Fonts. The pinned authentication library is served by Ninefoil.

Security and deletion

We use HTTPS for remote connections and Supabase database row-level security to restrict access to your cloud binder. No online system is risk-free. You can delete the local copy using browser site-data settings. You can request permanent deletion of your cloud account and binder from the Account menu after entering your email and password. Deletion keeps the current device binder as a guest copy; browser site-data settings remove local copies. Signing out also keeps the device copy unless you select the removal option, which is available only when sync is clean. If account deletion is unavailable, contact the site owner through the GitHub profile. Export a backup before deleting any account.

Ads and analytics

We have not installed advertising scripts or a dedicated analytics tracker in this version. If advertising is enabled later, this policy and appropriate consent controls will be updated first. Providers may still maintain infrastructure logs.

Children and sensitive information

Account sign-up is intended for people old enough to register under applicable law. Do not put sensitive personal details into binder titles, notes or image URLs. Parents or guardians should supervise younger collectors.

Policy changes

This page describes the current code. See the site owner's GitHub profile for questions or updates.