Privacy

House of Holos is a free place to keep track of your Pokémon cards. This page says what we collect, why, and what you can do about it. We don't sell your data or use it for advertising.

What we collect

Your account. When you sign in, we keep your email address so we can send you a sign-in link. Sign-in runs on Supabase, which also hosts our database. You can add a display name for shared pages; your email is never shown on them.

Your collection. The cards and sealed products you add, their condition, grade and quantity, what you paid and any notes, your binders, your wishlist and target prices, your rips, and files you import. This is what the app is for, and only you can see it unless you make a share link.

Share links. If you share your collection, a set, a binder or a want list, anyone with the link can see which cards are in it. They never see your email, notes, what you paid or your wishlist targets. Signed-in visitors can privately compare a want list with their own cards; that comparison is shown only to the visitor. You can turn a link off at any time from the share panel or your account (sign in to open).

Signed-out collections. If you add cards before signing in, they're kept only in your browser until you sign in and move them into your account.

Saved releases. Saving a release from the release calendar without an account keeps it only in your browser. Signed in, it is saved privately to your account and is never shared. Saving a release does not sign you up for email.

Waitlists. If you ask to be told when something launches (like the iPhone app), we keep that email address for that message.

Analytics. We use Google Analytics 4 to count visits and a few actions, like where a visit came from (a link's utm_source or ref), adding your first card, making a share link, joining a Notify me list and signing up. We also count when you view a nonempty collection, return to it on a later day, or view a collection with at least ten different cards. These collection events say whether you are signed in and whether your collection has fewer than ten or at least ten different cards. They never include your email, account id, which cards you have, exact collection size, notes or purchase costs.

Google Analytics sets cookies in your browser to tell visits apart. We keep dates and milestone flags in browser storage to avoid counting the same collection actions repeatedly. These measurements describe activity in a browser, not an identified person. Google signals and ad personalization are turned off.

Errors. If something breaks in your browser, an error report with technical details of the problem may be sent to our error-tracking service.

Where it lives

The website runs on Vercel, our API on Railway, and your data and sign-in on Supabase. Card images and details come from TCGdex.

Your choices

• Download your data anytime from your account (sign in to open): your collection, binders, transactions and wishlist as CSV files.
• Delete your account from your account (sign in to open). This permanently deletes your sign-in and everything in your collection, binders, wishlist and share links.
• Block analytics cookies with your browser's settings or a content blocker. The app works the same without them.

Questions

For anything about your data, use Report a problem on any card page and we'll get back to you.

We'll update this page when what we collect changes.